Analysis

  • max time kernel
    119s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/12/2022, 22:47

General

  • Target

    file.exe

  • Size

    7.3MB

  • MD5

    97c57dba01e051aefa8cdca5f29d20cd

  • SHA1

    178fede4b249f7dbefb887003b8f36360a00ad0f

  • SHA256

    6e82fdf9791c3706dbe035d98bf1ca8fedb622386ca5e57c3aa41c35a2facdc7

  • SHA512

    fb95cdbe21ac00c1b2f081c43baef3c34048a3c2ddc4c02e083ee8604e3f83b2f8acea482cceeb90a6987b67d2ab80c4c53c6cac8f1a45ca7dfd30c2cdaf1c52

  • SSDEEP

    196608:91OhtoK/KIBI3lyJbVf4c5X1j6IjA8xc6n1tYwaikgWaN:3OhtzKvs1FjDc2HLaik4

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 29 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5004
    • C:\Users\Admin\AppData\Local\Temp\7zS5D72.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:764
      • C:\Users\Admin\AppData\Local\Temp\7zS614A.tmp\Install.exe
        .\Install.exe /S /site_id "525403"
        3⤵
        • Executes dropped EXE
        • Checks BIOS information in registry
        • Checks computer location settings
        • Drops file in System32 directory
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:4484
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2308
          • C:\Windows\SysWOW64\cmd.exe
            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3280
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
              6⤵
                PID:3536
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                6⤵
                  PID:4472
            • C:\Windows\SysWOW64\forfiles.exe
              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2224
              • C:\Windows\SysWOW64\cmd.exe
                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:3424
                • \??\c:\windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                  6⤵
                    PID:2488
                  • \??\c:\windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                    6⤵
                      PID:2556
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /CREATE /TN "gpDAFzAjH" /SC once /ST 20:38:01 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                  4⤵
                  • Creates scheduled task(s)
                  PID:5012
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /run /I /tn "gpDAFzAjH"
                  4⤵
                    PID:4032
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /DELETE /F /TN "gpDAFzAjH"
                    4⤵
                      PID:4400
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /CREATE /TN "bcmBoHFysFBidtSprQ" /SC once /ST 23:48:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\pNGCAFJFsZdszXlNr\AFzekPlfQCDUbED\cPYjhlK.exe\" RP /site_id 525403 /S" /V1 /F
                      4⤵
                      • Drops file in Windows directory
                      • Creates scheduled task(s)
                      PID:3380
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4092
                • C:\Windows\system32\gpupdate.exe
                  "C:\Windows\system32\gpupdate.exe" /force
                  2⤵
                    PID:3668
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                  1⤵
                    PID:1512
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                    1⤵
                      PID:3712
                    • C:\Windows\system32\gpscript.exe
                      gpscript.exe /RefreshSystemParam
                      1⤵
                        PID:4244
                      • C:\Users\Admin\AppData\Local\Temp\pNGCAFJFsZdszXlNr\AFzekPlfQCDUbED\cPYjhlK.exe
                        C:\Users\Admin\AppData\Local\Temp\pNGCAFJFsZdszXlNr\AFzekPlfQCDUbED\cPYjhlK.exe RP /site_id 525403 /S
                        1⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious use of WriteProcessMemory
                        PID:4744
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:3056
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3764
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              4⤵
                                PID:4908
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:828
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:5100
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:772
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:2776
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:484
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:2836
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:880
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:4016
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:2256
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:4620
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:1564
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:4300
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:1364
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:1852
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:4564
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:4196
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:1956
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:3936
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:4232
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:2556
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:3808
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:3424
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:2020
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LJVhNoouCIYvC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LJVhNoouCIYvC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cdLvKHOLDZopLOAbkDR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cdLvKHOLDZopLOAbkDR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fFIwvsLyPfUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fFIwvsLyPfUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nNTpTrwDNnPU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nNTpTrwDNnPU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\xPPqLUFFU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\xPPqLUFFU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\STCeEXnoOCFBHvVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\STCeEXnoOCFBHvVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pNGCAFJFsZdszXlNr\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pNGCAFJFsZdszXlNr\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\dZAkCesbbUKSZxso\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\dZAkCesbbUKSZxso\" /t REG_DWORD /d 0 /reg:64;"
                                                                          2⤵
                                                                          • Drops file in System32 directory
                                                                          • Modifies data under HKEY_USERS
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:4136
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LJVhNoouCIYvC" /t REG_DWORD /d 0 /reg:32
                                                                            3⤵
                                                                              PID:2360
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LJVhNoouCIYvC" /t REG_DWORD /d 0 /reg:32
                                                                                4⤵
                                                                                  PID:4416
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LJVhNoouCIYvC" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:1100
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cdLvKHOLDZopLOAbkDR" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:4032
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cdLvKHOLDZopLOAbkDR" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:1128
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fFIwvsLyPfUn" /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:4820
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fFIwvsLyPfUn" /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:1220
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nNTpTrwDNnPU2" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:632
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nNTpTrwDNnPU2" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:312
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xPPqLUFFU" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:3448
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xPPqLUFFU" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:3752
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\STCeEXnoOCFBHvVB /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:1864
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\STCeEXnoOCFBHvVB /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:2208
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\pNGCAFJFsZdszXlNr /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:1080
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\pNGCAFJFsZdszXlNr /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:2476
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\dZAkCesbbUKSZxso /t REG_DWORD /d 0 /reg:32
                                                                                                          3⤵
                                                                                                            PID:4588
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\dZAkCesbbUKSZxso /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:4064
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "gbhgiGQOD" /SC once /ST 11:24:06 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                            2⤵
                                                                                                            • Creates scheduled task(s)
                                                                                                            PID:1804
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "gbhgiGQOD"
                                                                                                            2⤵
                                                                                                              PID:720
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /DELETE /F /TN "gbhgiGQOD"
                                                                                                              2⤵
                                                                                                                PID:4628
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /CREATE /TN "yTojJpVlyxZWLIphK" /SC once /ST 12:23:43 /RU "SYSTEM" /TR "\"C:\Windows\Temp\dZAkCesbbUKSZxso\sOClMsGvOFCDJVp\NQBgkgk.exe\" 8a /site_id 525403 /S" /V1 /F
                                                                                                                2⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                • Creates scheduled task(s)
                                                                                                                PID:4212
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /run /I /tn "yTojJpVlyxZWLIphK"
                                                                                                                2⤵
                                                                                                                  PID:4108
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                1⤵
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:3500
                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                  2⤵
                                                                                                                    PID:1992
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                  1⤵
                                                                                                                    PID:3112
                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                    1⤵
                                                                                                                      PID:4328
                                                                                                                    • C:\Windows\Temp\dZAkCesbbUKSZxso\sOClMsGvOFCDJVp\NQBgkgk.exe
                                                                                                                      C:\Windows\Temp\dZAkCesbbUKSZxso\sOClMsGvOFCDJVp\NQBgkgk.exe 8a /site_id 525403 /S
                                                                                                                      1⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Checks computer location settings
                                                                                                                      • Drops Chrome extension
                                                                                                                      • Drops desktop.ini file(s)
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:2196
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /DELETE /F /TN "bcmBoHFysFBidtSprQ"
                                                                                                                        2⤵
                                                                                                                          PID:3248
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                          2⤵
                                                                                                                            PID:4012
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:5028
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                              2⤵
                                                                                                                                PID:1928
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:4684
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\xPPqLUFFU\fDURml.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "mvThVpxzbhgVRbG" /V1 /F
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:1412
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "mvThVpxzbhgVRbG2" /F /xml "C:\Program Files (x86)\xPPqLUFFU\QnojOmP.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:2960
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /END /TN "mvThVpxzbhgVRbG"
                                                                                                                                  2⤵
                                                                                                                                    PID:3260
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "mvThVpxzbhgVRbG"
                                                                                                                                    2⤵
                                                                                                                                      PID:2760
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "xJPCobCplaVVxr" /F /xml "C:\Program Files (x86)\nNTpTrwDNnPU2\sasvaOv.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:4572
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "xtMHrquZTnBqG2" /F /xml "C:\ProgramData\STCeEXnoOCFBHvVB\lSmsoVP.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:2360
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "wJXbRFPdEfkDfWLvy2" /F /xml "C:\Program Files (x86)\cdLvKHOLDZopLOAbkDR\cprKwRC.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:4376
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "whexYRdIIbHjcPpcGRQ2" /F /xml "C:\Program Files (x86)\LJVhNoouCIYvC\WIRvwRm.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:5064
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "diAnMdtAazTJxxqKi" /SC once /ST 06:44:44 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\dZAkCesbbUKSZxso\JAwtkTAV\qSpHqjl.dll\",#1 /site_id 525403" /V1 /F
                                                                                                                                      2⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:4092
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /run /I /tn "diAnMdtAazTJxxqKi"
                                                                                                                                      2⤵
                                                                                                                                        PID:1864
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                        2⤵
                                                                                                                                          PID:4136
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:3576
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                            2⤵
                                                                                                                                              PID:1084
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:3728
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /DELETE /F /TN "yTojJpVlyxZWLIphK"
                                                                                                                                                2⤵
                                                                                                                                                  PID:1036
                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\dZAkCesbbUKSZxso\JAwtkTAV\qSpHqjl.dll",#1 /site_id 525403
                                                                                                                                                1⤵
                                                                                                                                                  PID:3028
                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\dZAkCesbbUKSZxso\JAwtkTAV\qSpHqjl.dll",#1 /site_id 525403
                                                                                                                                                    2⤵
                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                    PID:5044
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /DELETE /F /TN "diAnMdtAazTJxxqKi"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:980

                                                                                                                                                  Network

                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  • C:\Program Files (x86)\LJVhNoouCIYvC\WIRvwRm.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    f251974bb2572c7091801df909e80f57

                                                                                                                                                    SHA1

                                                                                                                                                    5ecd0f8772c94f58e2fb11113b36e6e1b2ea40c1

                                                                                                                                                    SHA256

                                                                                                                                                    4456c5226807ae054b58ddb153b366c6bb6802027d798f3a9c6027e4e78fd438

                                                                                                                                                    SHA512

                                                                                                                                                    63c09d41a488cc2e213ed14f04140f486e5f27cac06bbd9650388288ecd15dbcd63572f556444b77101caee0a7cb4014edbfb77c2c5e017ebb22de3a7109fd11

                                                                                                                                                  • C:\Program Files (x86)\cdLvKHOLDZopLOAbkDR\cprKwRC.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    6f9d59ecb405e471bfdc17e2380ee903

                                                                                                                                                    SHA1

                                                                                                                                                    23083be7fa4272ee306c5ab07599ec82140dc889

                                                                                                                                                    SHA256

                                                                                                                                                    047c40dad5b20f9d58be07e014e7b78290dc93b420c411f85ab8845c21d1ed93

                                                                                                                                                    SHA512

                                                                                                                                                    0509496d2614aacf7d1fdcbddf04d917e574164b722fd5bf9e457bf9e865258c07b3a6fa7e3f0248fb8e4a23185efafd3070ec2d19e83f8ae33cdb859f17cb61

                                                                                                                                                  • C:\Program Files (x86)\nNTpTrwDNnPU2\sasvaOv.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    0ee3554cc89d5b2d68a0ca893d2bfb31

                                                                                                                                                    SHA1

                                                                                                                                                    e9f9e812682671ad894bb34a0f8f8e06c9e18806

                                                                                                                                                    SHA256

                                                                                                                                                    5c5c5e8d3efbd803b68adccf05540f3e4cea9c8acfb70d31d907dd73addf4368

                                                                                                                                                    SHA512

                                                                                                                                                    1773addace5e51e69d54912c0178e33b514c4d9d96c56a6ffea3ddc6ea2ca00286fcc6f709e6294065351fa801c79c8c0c9f3fc699b12c4eafadd07ae826dda8

                                                                                                                                                  • C:\Program Files (x86)\xPPqLUFFU\QnojOmP.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    8b75d14961fe5225c7481ab37f3e34fa

                                                                                                                                                    SHA1

                                                                                                                                                    9ab2dcb5fe74765b2764c5e5026b5988b84ffe5b

                                                                                                                                                    SHA256

                                                                                                                                                    e057f90cd288e8f530a67fd49df501e122ec8de85dc75930732a2bbe5922c49f

                                                                                                                                                    SHA512

                                                                                                                                                    935150210778f4c883004125db4c632c32e51e179638a6682c8778dda2035487d44882586ed15addc59da4921fed100fe6d81eaf8e5130b8119a132327825c22

                                                                                                                                                  • C:\ProgramData\STCeEXnoOCFBHvVB\lSmsoVP.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    b9851d5e617fff61c04641bd0d0f3c88

                                                                                                                                                    SHA1

                                                                                                                                                    108aaf42344ebdcc77e10af24fe5662525281e25

                                                                                                                                                    SHA256

                                                                                                                                                    fb05aed26c82be71764580e2ee89aa76ee24101de424c0be78df137036cd01a4

                                                                                                                                                    SHA512

                                                                                                                                                    a87d77a7cf1534ac937e4063ecc5bde97b8f2f36b9913fdf45bff7409826073d8e73bf21c23de2e1238ac232004c83522784dae87009087564b76c6a5361598f

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    6cf293cb4d80be23433eecf74ddb5503

                                                                                                                                                    SHA1

                                                                                                                                                    24fe4752df102c2ef492954d6b046cb5512ad408

                                                                                                                                                    SHA256

                                                                                                                                                    b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                                                                                                    SHA512

                                                                                                                                                    0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                    Filesize

                                                                                                                                                    64B

                                                                                                                                                    MD5

                                                                                                                                                    3ca1082427d7b2cd417d7c0b7fd95e4e

                                                                                                                                                    SHA1

                                                                                                                                                    b0482ff5b58ffff4f5242d77330b064190f269d3

                                                                                                                                                    SHA256

                                                                                                                                                    31f15dc6986680b158468bf0b4a1c00982b07b2889f360befd8a466113940d8f

                                                                                                                                                    SHA512

                                                                                                                                                    bbcfd8ea1e815524fda500b187483539be4a8865939f24c6e713f0a3bd90b69b4367c36aa2b09886b2006b685f81f0a77eec23ab58b7e2fb75304b412deb6ca3

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS5D72.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.3MB

                                                                                                                                                    MD5

                                                                                                                                                    e0f1ff2320da54d462e80728f82abdc8

                                                                                                                                                    SHA1

                                                                                                                                                    68148ab877859718f477f915337484889369a6d1

                                                                                                                                                    SHA256

                                                                                                                                                    80feb82bedcc13ee1b294ef2b991eddb8779f9d751218a0c0c12551abe790d9c

                                                                                                                                                    SHA512

                                                                                                                                                    2966d4c681bd1bb441a3d42af588ac304c2b6c438a1902c72ca2060d1f2829bd37da8df15d2df53a7898d2f3751fbff9fd373365219ff4dcaef6dafd8dfb4885

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS5D72.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.3MB

                                                                                                                                                    MD5

                                                                                                                                                    e0f1ff2320da54d462e80728f82abdc8

                                                                                                                                                    SHA1

                                                                                                                                                    68148ab877859718f477f915337484889369a6d1

                                                                                                                                                    SHA256

                                                                                                                                                    80feb82bedcc13ee1b294ef2b991eddb8779f9d751218a0c0c12551abe790d9c

                                                                                                                                                    SHA512

                                                                                                                                                    2966d4c681bd1bb441a3d42af588ac304c2b6c438a1902c72ca2060d1f2829bd37da8df15d2df53a7898d2f3751fbff9fd373365219ff4dcaef6dafd8dfb4885

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS614A.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    227d32b4fe7b705457ab38d11e9afb43

                                                                                                                                                    SHA1

                                                                                                                                                    0819eeefa40132a16fc5805a8dbe3b3db62a0525

                                                                                                                                                    SHA256

                                                                                                                                                    1c83453a383db77945a2e1e445241f4e6b5efd435cc243ef51bf6782dd1a8ba5

                                                                                                                                                    SHA512

                                                                                                                                                    8a2c9e6ae450ac36e655f32f503baa33993c1a00bda6f027285448b6b9ade8c5c58e0e044a5c91e42ce9d27f2c6d8629a39a2a2037a11f057bea64c5cd9d2e08

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS614A.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    227d32b4fe7b705457ab38d11e9afb43

                                                                                                                                                    SHA1

                                                                                                                                                    0819eeefa40132a16fc5805a8dbe3b3db62a0525

                                                                                                                                                    SHA256

                                                                                                                                                    1c83453a383db77945a2e1e445241f4e6b5efd435cc243ef51bf6782dd1a8ba5

                                                                                                                                                    SHA512

                                                                                                                                                    8a2c9e6ae450ac36e655f32f503baa33993c1a00bda6f027285448b6b9ade8c5c58e0e044a5c91e42ce9d27f2c6d8629a39a2a2037a11f057bea64c5cd9d2e08

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\pNGCAFJFsZdszXlNr\AFzekPlfQCDUbED\cPYjhlK.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    227d32b4fe7b705457ab38d11e9afb43

                                                                                                                                                    SHA1

                                                                                                                                                    0819eeefa40132a16fc5805a8dbe3b3db62a0525

                                                                                                                                                    SHA256

                                                                                                                                                    1c83453a383db77945a2e1e445241f4e6b5efd435cc243ef51bf6782dd1a8ba5

                                                                                                                                                    SHA512

                                                                                                                                                    8a2c9e6ae450ac36e655f32f503baa33993c1a00bda6f027285448b6b9ade8c5c58e0e044a5c91e42ce9d27f2c6d8629a39a2a2037a11f057bea64c5cd9d2e08

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\pNGCAFJFsZdszXlNr\AFzekPlfQCDUbED\cPYjhlK.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    227d32b4fe7b705457ab38d11e9afb43

                                                                                                                                                    SHA1

                                                                                                                                                    0819eeefa40132a16fc5805a8dbe3b3db62a0525

                                                                                                                                                    SHA256

                                                                                                                                                    1c83453a383db77945a2e1e445241f4e6b5efd435cc243ef51bf6782dd1a8ba5

                                                                                                                                                    SHA512

                                                                                                                                                    8a2c9e6ae450ac36e655f32f503baa33993c1a00bda6f027285448b6b9ade8c5c58e0e044a5c91e42ce9d27f2c6d8629a39a2a2037a11f057bea64c5cd9d2e08

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                    Filesize

                                                                                                                                                    1KB

                                                                                                                                                    MD5

                                                                                                                                                    33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                    SHA1

                                                                                                                                                    36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                    SHA256

                                                                                                                                                    b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                    SHA512

                                                                                                                                                    676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                    Filesize

                                                                                                                                                    11KB

                                                                                                                                                    MD5

                                                                                                                                                    52fec14c19690e3b12ce56852b107a78

                                                                                                                                                    SHA1

                                                                                                                                                    9beac47814784bd9c444504cd60a245b596b9849

                                                                                                                                                    SHA256

                                                                                                                                                    8e46fa7eaa6e81224b481de15779a4b42329bd6b7f41d8dfdb86a5e4ab86fb17

                                                                                                                                                    SHA512

                                                                                                                                                    da8cb69a8fff1afc9899bdaa37e2832f32080a240343d461d5e14dc2857ca52c2434a2f96e2b19fac9da3e9bd690529d56bee291dbab1817d9687a0433fb5fd7

                                                                                                                                                  • C:\Windows\Temp\dZAkCesbbUKSZxso\JAwtkTAV\qSpHqjl.dll

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    28bb482c5d839f494746a32742c9c1da

                                                                                                                                                    SHA1

                                                                                                                                                    f8fba62d31751ddf672988cc1d4a6d256658dfab

                                                                                                                                                    SHA256

                                                                                                                                                    4bf11f60bb02bd1c85a3be302d91633e5e631dd6cdc9f91c824c527b0b143e88

                                                                                                                                                    SHA512

                                                                                                                                                    5ef8c3f093e372ad3c1eb0140d6dfd29eb22eba0a98b275943e3b1745c5ebb4e5c501b531ecac1c951927f372e3df32b4f009de55bef8878f9384330e89602fe

                                                                                                                                                  • C:\Windows\Temp\dZAkCesbbUKSZxso\JAwtkTAV\qSpHqjl.dll

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    28bb482c5d839f494746a32742c9c1da

                                                                                                                                                    SHA1

                                                                                                                                                    f8fba62d31751ddf672988cc1d4a6d256658dfab

                                                                                                                                                    SHA256

                                                                                                                                                    4bf11f60bb02bd1c85a3be302d91633e5e631dd6cdc9f91c824c527b0b143e88

                                                                                                                                                    SHA512

                                                                                                                                                    5ef8c3f093e372ad3c1eb0140d6dfd29eb22eba0a98b275943e3b1745c5ebb4e5c501b531ecac1c951927f372e3df32b4f009de55bef8878f9384330e89602fe

                                                                                                                                                  • C:\Windows\Temp\dZAkCesbbUKSZxso\sOClMsGvOFCDJVp\NQBgkgk.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    227d32b4fe7b705457ab38d11e9afb43

                                                                                                                                                    SHA1

                                                                                                                                                    0819eeefa40132a16fc5805a8dbe3b3db62a0525

                                                                                                                                                    SHA256

                                                                                                                                                    1c83453a383db77945a2e1e445241f4e6b5efd435cc243ef51bf6782dd1a8ba5

                                                                                                                                                    SHA512

                                                                                                                                                    8a2c9e6ae450ac36e655f32f503baa33993c1a00bda6f027285448b6b9ade8c5c58e0e044a5c91e42ce9d27f2c6d8629a39a2a2037a11f057bea64c5cd9d2e08

                                                                                                                                                  • C:\Windows\Temp\dZAkCesbbUKSZxso\sOClMsGvOFCDJVp\NQBgkgk.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    227d32b4fe7b705457ab38d11e9afb43

                                                                                                                                                    SHA1

                                                                                                                                                    0819eeefa40132a16fc5805a8dbe3b3db62a0525

                                                                                                                                                    SHA256

                                                                                                                                                    1c83453a383db77945a2e1e445241f4e6b5efd435cc243ef51bf6782dd1a8ba5

                                                                                                                                                    SHA512

                                                                                                                                                    8a2c9e6ae450ac36e655f32f503baa33993c1a00bda6f027285448b6b9ade8c5c58e0e044a5c91e42ce9d27f2c6d8629a39a2a2037a11f057bea64c5cd9d2e08

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    MD5

                                                                                                                                                    963e39fe86ef7f0c70ccbf9dc360f23c

                                                                                                                                                    SHA1

                                                                                                                                                    75292ccdceacd5e69c16fc3fe628bc5a62c64445

                                                                                                                                                    SHA256

                                                                                                                                                    b1711fc93dd396d14d107e06ab66b227bd153bdba32d92f0d0d38b51c56359a4

                                                                                                                                                    SHA512

                                                                                                                                                    35785acb58bd93a1742823004478cbff225beabd20f7c644cc3aef21853eb3772a9df109a554c4853ab03584c73a253c3941578888c7e05971536418457daefd

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                    Filesize

                                                                                                                                                    268B

                                                                                                                                                    MD5

                                                                                                                                                    a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                    SHA1

                                                                                                                                                    1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                    SHA256

                                                                                                                                                    9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                    SHA512

                                                                                                                                                    9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                  • memory/2196-233-0x00000000038F0000-0x0000000003951000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    388KB

                                                                                                                                                  • memory/2196-229-0x0000000003360000-0x00000000033E5000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    532KB

                                                                                                                                                  • memory/2196-243-0x0000000004180000-0x00000000041FA000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    488KB

                                                                                                                                                  • memory/2196-250-0x00000000043C0000-0x000000000447C000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    752KB

                                                                                                                                                  • memory/3056-166-0x0000000004A80000-0x0000000004AE6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/3056-167-0x0000000004AF0000-0x0000000004B56000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/3056-164-0x0000000004260000-0x0000000004888000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                  • memory/3056-168-0x0000000005110000-0x000000000512E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    120KB

                                                                                                                                                  • memory/3056-163-0x0000000001810000-0x0000000001846000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    216KB

                                                                                                                                                  • memory/3056-165-0x0000000004180000-0x00000000041A2000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/3500-219-0x00007FFC1CF30000-0x00007FFC1D9F1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/3500-221-0x00007FFC1CF30000-0x00007FFC1D9F1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/4092-154-0x00007FFC1D0D0000-0x00007FFC1DB91000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/4092-151-0x0000022EC5220000-0x0000022EC5242000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/4092-152-0x00007FFC1D0D0000-0x00007FFC1DB91000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/4484-138-0x0000000010000000-0x00000000109FC000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.0MB

                                                                                                                                                  • memory/4744-159-0x0000000010000000-0x00000000109FC000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.0MB

                                                                                                                                                  • memory/5044-247-0x0000000001820000-0x000000000221C000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.0MB