amadey | 782bdfd0de0d78f62dc62dbfc64e50e0f1dbaecf04340fdd41aa2da00e0ccdbc

Analysis

max time kernel
84s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/02/2024, 15:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
662bcd1f5ad0f99508002d4562f42869.exe
Size 233KB
Sample240209-s1cgfaeb96
SHA256 782bdfd0de0d78f62dc62dbfc64e50e0f1dbaecf04340fdd41aa2da00e0ccdbc
MD5 662bcd1f5ad0f99508002d4562f42869
SHA1 4e1d6a634ad1de7a5cbbb4f0cc02280c5b01e832
SHA512 7e76bed5e1274e73722c51589f32e445c9ca6f59c1a2e8f460b16890aa615387e08eaab812ff21e82dbe78479054678e004ab3134195b7e4bc596ca0258996e2
SSDEEP 3072:RNS+H6SLytAwHtxNIN3N3QRlCR/rjbeIXMoZjnO34Gtgc9t8Xk+5YQ0o/8B:1aSLy7tML3QRlYrjVDL1c9eAQ9
MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family

smokeloader

Version

2022

http://selebration17io.io/index.php
http://vacantion18ffeu.cc/index.php
http://valarioulinity1.net/index.php
http://buriatiarutuhuob.net/index.php
http://cassiosssionunu.me/index.php
http://sulugilioiu19.net/index.php
http://goodfooggooftool.net/index.php
http://legdfls2369.com/index.php
http://fpodsp0532xc.com/index.php
http://gucc352093520.com/index.php
http://sjyey.com/tmp/index.php
http://babonwo.ru/tmp/index.php
http://mth.com.ua/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php

rc4.i32

Extracted

Family

smokeloader

Botnet

autm

Extracted

Family

smokeloader

Botnet

pub1

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

DcRat 5 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI		662bcd1f5ad0f99508002d4562f42869.exe
		4392	schtasks.exe
		3608	schtasks.exe
		1612	schtasks.exe
		4528	schtasks.exe

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 7 IoCs

resource	yara_rule
behavioral2/memory/1100-196-0x0000000002E50000-0x000000000373B000-memory.dmp	family_glupteba
behavioral2/memory/1100-197-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1100-209-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1100-247-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1100-261-0x0000000002E50000-0x000000000373B000-memory.dmp	family_glupteba
behavioral2/memory/1100-280-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1788-408-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral2/memory/2640-510-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4384	netsh.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	5784.exe

Deletes itself 1 IoCs

pid	Process
3444	Process not Found

Executes dropped EXE 18 IoCs

pid	Process
2052	2E2F.exe
1440	3024.exe
3596	3BAE.exe
2072	3BAE.tmp
2656	xrevealcddvd.exe
4208	xrevealcddvd.exe
3984	5784.exe
1980	6485.exe
1100	288c47bbc1871b439df19ff4df68f076.exe
2364	InstallSetup4.exe
4788	FourthX.exe
5096	6746.exe
464	BroomSetup.exe
820	nsy7368.tmp
1788	288c47bbc1871b439df19ff4df68f076.exe
4200	vueqjgslwynd.exe
5020	F436.exe
2972	F436.exe

Loads dropped DLL 19 IoCs

pid	Process
2072	3BAE.tmp
2072	3BAE.tmp
2072	3BAE.tmp
2364	InstallSetup4.exe
2364	InstallSetup4.exe
4840	regsvr32.exe
4840	regsvr32.exe
2972	F436.exe
2972	F436.exe
2972	F436.exe
2972	F436.exe
2972	F436.exe
2972	F436.exe
2972	F436.exe
2972	F436.exe
2972	F436.exe
2972	F436.exe
2972	F436.exe
2972	F436.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2640-450-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2640-478-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2640-500-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/files/0x000600000002328d-505.dat	upx
behavioral2/memory/2640-453-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2640-503-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/files/0x000600000002328d-506.dat	upx
behavioral2/memory/2640-510-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/files/0x0006000000023287-537.dat	upx
behavioral2/files/0x0006000000023258-541.dat	upx
behavioral2/files/0x0006000000023290-546.dat	upx
behavioral2/files/0x0006000000023254-540.dat	upx
behavioral2/files/0x0006000000023255-536.dat	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
106	pastebin.com
107	pastebin.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
126	api.ipify.org
127	api.ipify.org

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	6746.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	vueqjgslwynd.exe
File opened for modification	C:\Windows\system32\MRT.exe	WerFault.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	cmd.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	cmd.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4200 set thread context of 4320	4200	vueqjgslwynd.exe	147
PID 4200 set thread context of 2640	4200	vueqjgslwynd.exe	150

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	288c47bbc1871b439df19ff4df68f076.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1616	sc.exe
1916	sc.exe
528	sc.exe
2556	sc.exe

Detects Pyinstaller 3 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x0009000000023247-405.dat	pyinstaller
behavioral2/files/0x0009000000023247-415.dat	pyinstaller
behavioral2/files/0x0009000000023247-501.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 33 IoCs

pid	pid_target	Process	procid_target
3024	2052	WerFault.exe	91
2992	1100	WerFault.exe	103
4952	4060	WerFault.exe	155
2256	4060	WerFault.exe	155
3436	4060	WerFault.exe	155
1340	4060	WerFault.exe	155
4520	4060	WerFault.exe	155
4460	4060	WerFault.exe	155
3188	4060	WerFault.exe	155
2268	4060	WerFault.exe	155
2372	4060	WerFault.exe	155
2240	4060	WerFault.exe	155
4876	4060	WerFault.exe	155
388	800	WerFault.exe	191
4272	800	WerFault.exe	191
4212	800	WerFault.exe	191
4808	800	WerFault.exe	191
4072	800	WerFault.exe	191
3120	800	WerFault.exe	191
4804	800	WerFault.exe	191
3012	800	WerFault.exe	191
3952	800	WerFault.exe	191
5100	800	WerFault.exe	191
3120	800	WerFault.exe	191
4716	800	WerFault.exe	191
4228	800	WerFault.exe	191
5100	800	WerFault.exe	191
4952	800	WerFault.exe	191
1472	800	WerFault.exe	191
404	800	WerFault.exe	191
4788	800	WerFault.exe	191
1452	800	WerFault.exe	191
3692	800	WerFault.exe	191

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	662bcd1f5ad0f99508002d4562f42869.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	662bcd1f5ad0f99508002d4562f42869.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	662bcd1f5ad0f99508002d4562f42869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3024.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3024.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6485.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6485.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6485.exe

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4392	schtasks.exe
3608	schtasks.exe
1612	schtasks.exe
4528	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	cmd.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	cmd.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)"	288c47bbc1871b439df19ff4df68f076.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
8	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2140	662bcd1f5ad0f99508002d4562f42869.exe
2140	662bcd1f5ad0f99508002d4562f42869.exe
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found

Suspicious behavior: MapViewOfSection 9 IoCs

pid	Process
2140	662bcd1f5ad0f99508002d4562f42869.exe
1440	3024.exe
1980	6485.exe
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3444	Process not Found
Token: SeCreatePagefilePrivilege	3444	Process not Found
Token: SeShutdownPrivilege	3444	Process not Found
Token: SeCreatePagefilePrivilege	3444	Process not Found
Token: SeShutdownPrivilege	3444	Process not Found
Token: SeCreatePagefilePrivilege	3444	Process not Found
Token: SeShutdownPrivilege	3444	Process not Found
Token: SeCreatePagefilePrivilege	3444	Process not Found
Token: SeShutdownPrivilege	3444	Process not Found
Token: SeCreatePagefilePrivilege	3444	Process not Found
Token: SeShutdownPrivilege	3444	Process not Found
Token: SeCreatePagefilePrivilege	3444	Process not Found
Token: SeShutdownPrivilege	3444	Process not Found
Token: SeCreatePagefilePrivilege	3444	Process not Found
Token: SeShutdownPrivilege	3444	Process not Found
Token: SeCreatePagefilePrivilege	3444	Process not Found
Token: SeShutdownPrivilege	3444	Process not Found
Token: SeCreatePagefilePrivilege	3444	Process not Found
Token: SeShutdownPrivilege	3444	Process not Found
Token: SeCreatePagefilePrivilege	3444	Process not Found
Token: SeShutdownPrivilege	3444	Process not Found
Token: SeCreatePagefilePrivilege	3444	Process not Found
Token: SeDebugPrivilege	4940	powershell.exe
Token: SeShutdownPrivilege	3444	Process not Found
Token: SeCreatePagefilePrivilege	3444	Process not Found
Token: SeDebugPrivilege	1100	288c47bbc1871b439df19ff4df68f076.exe
Token: SeImpersonatePrivilege	1100	288c47bbc1871b439df19ff4df68f076.exe
Token: SeShutdownPrivilege	3444	Process not Found
Token: SeCreatePagefilePrivilege	3444	Process not Found
Token: SeDebugPrivilege	3940	powershell.exe
Token: SeDebugPrivilege	3644	powershell.exe
Token: SeDebugPrivilege	2600	cmd.exe
Token: SeShutdownPrivilege	3444	Process not Found
Token: SeCreatePagefilePrivilege	3444	Process not Found
Token: SeShutdownPrivilege	3444	Process not Found
Token: SeCreatePagefilePrivilege	3444	Process not Found
Token: SeDebugPrivilege	5036	powershell.exe
Token: SeShutdownPrivilege	3444	Process not Found
Token: SeCreatePagefilePrivilege	3444	Process not Found
Token: SeShutdownPrivilege	3444	Process not Found
Token: SeCreatePagefilePrivilege	3444	Process not Found
Token: SeLockMemoryPrivilege	2640	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2072	3BAE.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
464	BroomSetup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 2052	3444	Process not Found	91
PID 3444 wrote to memory of 2052	3444	Process not Found	91
PID 3444 wrote to memory of 2052	3444	Process not Found	91
PID 3444 wrote to memory of 1440	3444	Process not Found	92
PID 3444 wrote to memory of 1440	3444	Process not Found	92
PID 3444 wrote to memory of 1440	3444	Process not Found	92
PID 3444 wrote to memory of 3596	3444	Process not Found	94
PID 3444 wrote to memory of 3596	3444	Process not Found	94
PID 3444 wrote to memory of 3596	3444	Process not Found	94
PID 3596 wrote to memory of 2072	3596	3BAE.exe	97
PID 3596 wrote to memory of 2072	3596	3BAE.exe	97
PID 3596 wrote to memory of 2072	3596	3BAE.exe	97
PID 2072 wrote to memory of 2656	2072	3BAE.tmp	99
PID 2072 wrote to memory of 2656	2072	3BAE.tmp	99
PID 2072 wrote to memory of 2656	2072	3BAE.tmp	99
PID 2072 wrote to memory of 4208	2072	3BAE.tmp	100
PID 2072 wrote to memory of 4208	2072	3BAE.tmp	100
PID 2072 wrote to memory of 4208	2072	3BAE.tmp	100
PID 3444 wrote to memory of 3984	3444	Process not Found	101
PID 3444 wrote to memory of 3984	3444	Process not Found	101
PID 3444 wrote to memory of 3984	3444	Process not Found	101
PID 3444 wrote to memory of 1980	3444	Process not Found	102
PID 3444 wrote to memory of 1980	3444	Process not Found	102
PID 3444 wrote to memory of 1980	3444	Process not Found	102
PID 3984 wrote to memory of 1100	3984	5784.exe	103
PID 3984 wrote to memory of 1100	3984	5784.exe	103
PID 3984 wrote to memory of 1100	3984	5784.exe	103
PID 3984 wrote to memory of 2364	3984	5784.exe	104
PID 3984 wrote to memory of 2364	3984	5784.exe	104
PID 3984 wrote to memory of 2364	3984	5784.exe	104
PID 3984 wrote to memory of 4788	3984	5784.exe	105
PID 3984 wrote to memory of 4788	3984	5784.exe	105
PID 3444 wrote to memory of 5096	3444	Process not Found	107
PID 3444 wrote to memory of 5096	3444	Process not Found	107
PID 3444 wrote to memory of 5096	3444	Process not Found	107
PID 2364 wrote to memory of 464	2364	InstallSetup4.exe	106
PID 2364 wrote to memory of 464	2364	InstallSetup4.exe	106
PID 2364 wrote to memory of 464	2364	InstallSetup4.exe	106
PID 3444 wrote to memory of 4044	3444	Process not Found	108
PID 3444 wrote to memory of 4044	3444	Process not Found	108
PID 4044 wrote to memory of 4840	4044	regsvr32.exe	109
PID 4044 wrote to memory of 4840	4044	regsvr32.exe	109
PID 4044 wrote to memory of 4840	4044	regsvr32.exe	109
PID 2364 wrote to memory of 820	2364	InstallSetup4.exe	110
PID 2364 wrote to memory of 820	2364	InstallSetup4.exe	110
PID 2364 wrote to memory of 820	2364	InstallSetup4.exe	110
PID 464 wrote to memory of 3308	464	BroomSetup.exe	111
PID 464 wrote to memory of 3308	464	BroomSetup.exe	111
PID 464 wrote to memory of 3308	464	BroomSetup.exe	111
PID 3308 wrote to memory of 3356	3308	cmd.exe	113
PID 3308 wrote to memory of 3356	3308	cmd.exe	113
PID 3308 wrote to memory of 3356	3308	cmd.exe	113
PID 3308 wrote to memory of 4392	3308	cmd.exe	114
PID 3308 wrote to memory of 4392	3308	cmd.exe	114
PID 3308 wrote to memory of 4392	3308	cmd.exe	114
PID 1100 wrote to memory of 4940	1100	288c47bbc1871b439df19ff4df68f076.exe	115
PID 1100 wrote to memory of 4940	1100	288c47bbc1871b439df19ff4df68f076.exe	115
PID 1100 wrote to memory of 4940	1100	288c47bbc1871b439df19ff4df68f076.exe	115
PID 1788 wrote to memory of 3940	1788	288c47bbc1871b439df19ff4df68f076.exe	121
PID 1788 wrote to memory of 3940	1788	288c47bbc1871b439df19ff4df68f076.exe	121
PID 1788 wrote to memory of 3940	1788	288c47bbc1871b439df19ff4df68f076.exe	121
PID 5080 wrote to memory of 4524	5080	cmd.exe	131
PID 5080 wrote to memory of 4524	5080	cmd.exe	131
PID 1788 wrote to memory of 212	1788	288c47bbc1871b439df19ff4df68f076.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\662bcd1f5ad0f99508002d4562f42869.exe
"C:\Users\Admin\AppData\Local\Temp\662bcd1f5ad0f99508002d4562f42869.exe"
1⤵
- DcRat
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2140

C:\Users\Admin\AppData\Local\Temp\2E2F.exe
C:\Users\Admin\AppData\Local\Temp\2E2F.exe
1⤵
- Executes dropped EXE
PID:2052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 608
  2⤵
  - Program crash
  PID:3024

C:\Users\Admin\AppData\Local\Temp\3024.exe
C:\Users\Admin\AppData\Local\Temp\3024.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1440

C:\Users\Admin\AppData\Local\Temp\3BAE.exe
C:\Users\Admin\AppData\Local\Temp\3BAE.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Users\Admin\AppData\Local\Temp\is-PK641.tmp\3BAE.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-PK641.tmp\3BAE.tmp" /SL5="$500FE,7287413,54272,C:\Users\Admin\AppData\Local\Temp\3BAE.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Users\Admin\AppData\Local\X-Reveal CD DVD\xrevealcddvd.exe
    "C:\Users\Admin\AppData\Local\X-Reveal CD DVD\xrevealcddvd.exe" -i
    3⤵
    - Executes dropped EXE
    PID:2656
- - C:\Users\Admin\AppData\Local\X-Reveal CD DVD\xrevealcddvd.exe
    "C:\Users\Admin\AppData\Local\X-Reveal CD DVD\xrevealcddvd.exe" -s
    3⤵
    - Executes dropped EXE
    PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2052 -ip 2052
1⤵
PID:3844

C:\Users\Admin\AppData\Local\Temp\5784.exe
C:\Users\Admin\AppData\Local\Temp\5784.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
  "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4940
- - C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
    "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
    3⤵
    - Executes dropped EXE
    - Checks for VirtualBox DLLs, possible anti-VM trick
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      PID:3940
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      PID:212
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:4384
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      PID:5036
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:2600
  - - C:\Windows\rss\csrss.exe
      C:\Windows\rss\csrss.exe
      4⤵
      PID:732
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:2136
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        DcRat
        Creates scheduled task(s)
        
        PID:3608
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        5⤵
        
        PID:3244
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:1192
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        5⤵
        
        PID:1144
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        DcRat
        Creates scheduled task(s)
        
        PID:4528
    - - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        5⤵
        
        PID:3088
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        6⤵
        
        PID:5100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 804
    3⤵
    - Program crash
    PID:2992
- C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:464
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3308
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        5⤵
        
        PID:3356
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
        5⤵
        DcRat
        Creates scheduled task(s)
        
        PID:4392
- - C:\Users\Admin\AppData\Local\Temp\nsy7368.tmp
    C:\Users\Admin\AppData\Local\Temp\nsy7368.tmp
    3⤵
    - Executes dropped EXE
    PID:820
- C:\Users\Admin\AppData\Local\Temp\FourthX.exe
  "C:\Users\Admin\AppData\Local\Temp\FourthX.exe"
  2⤵
  - Executes dropped EXE
  PID:4788
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3644
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "UTIXDCVF"
    3⤵
    - Launches sc.exe
    PID:2556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5080
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:4524
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "UTIXDCVF" binpath= "C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:1616
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:1916
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "UTIXDCVF"
    3⤵
    - Launches sc.exe
    PID:528

C:\Users\Admin\AppData\Local\Temp\6485.exe
C:\Users\Admin\AppData\Local\Temp\6485.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1980

C:\Users\Admin\AppData\Local\Temp\6746.exe
C:\Users\Admin\AppData\Local\Temp\6746.exe
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:5096

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\734D.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\734D.dll
  2⤵
  - Loads dropped DLL
  PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1100 -ip 1100
1⤵
PID:1116

C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe
C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
PID:4200
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  PID:2600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:5028
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:456
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:4320
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2640

C:\Users\Admin\AppData\Local\Temp\F436.exe
C:\Users\Admin\AppData\Local\Temp\F436.exe
1⤵
- Executes dropped EXE
PID:5020
- C:\Users\Admin\AppData\Local\Temp\F436.exe
  C:\Users\Admin\AppData\Local\Temp\F436.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2972
- - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\netconn_properties.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/netconn_properties.exe
    3⤵
    PID:1064
- - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\netconn_properties.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/netconn_properties.exe
    3⤵
    PID:2784
- - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\registers.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/registers.exe
    3⤵
    PID:2140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t """
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t ""
      4⤵
      PID:4964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "Registry""
    3⤵
    PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "Registry"
      4⤵
      PID:2860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\dwm.exe""
    3⤵
    PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\dwm.exe"
      4⤵
      PID:2248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\dwm.exe""
    3⤵
    PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\dwm.exe"
      4⤵
      PID:4384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\servicing\TrustedInstaller.exe""
    3⤵
    PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\servicing\TrustedInstaller.exe"
      4⤵
      PID:3416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\servicing\TrustedInstaller.exe""
    3⤵
    PID:3808
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\servicing\TrustedInstaller.exe"
      4⤵
      PID:2460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\smss.exe""
    3⤵
    PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\smss.exe"
      4⤵
      PID:1060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\smss.exe""
    3⤵
    PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\smss.exe"
      4⤵
      PID:4660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:2088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:3692
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:4712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\csrss.exe""
    3⤵
    PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\csrss.exe"
      4⤵
      PID:3748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\csrss.exe""
    3⤵
    PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\csrss.exe"
      4⤵
      PID:1764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe""
    3⤵
    PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe"
      4⤵
      PID:4444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe""
    3⤵
    PID:1020
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe"
      4⤵
      PID:3544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:2140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:2372
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:3436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\wininit.exe""
    3⤵
    PID:3692
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\wininit.exe"
      4⤵
      PID:4964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\wininit.exe""
    3⤵
    PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\wininit.exe"
      4⤵
      PID:4784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\csrss.exe""
    3⤵
    PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\csrss.exe"
      4⤵
      PID:4212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\csrss.exe""
    3⤵
    PID:1584
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\csrss.exe"
      4⤵
      PID:1832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:3176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:1372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:3660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:3416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\winlogon.exe""
    3⤵
    PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\winlogon.exe"
      4⤵
      PID:2652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\winlogon.exe""
    3⤵
    PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\winlogon.exe"
      4⤵
      PID:1420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\services.exe""
    3⤵
    PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\services.exe"
      4⤵
      PID:4712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\services.exe""
    3⤵
    PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\services.exe"
      4⤵
      PID:4992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\lsass.exe""
    3⤵
    PID:1764
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\lsass.exe"
      4⤵
      PID:4480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\lsass.exe""
    3⤵
    PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\lsass.exe"
      4⤵
      PID:4288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\SysWOW64\explorer.exe""
    3⤵
    PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\SysWOW64\explorer.exe"
      4⤵
      PID:4352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\SysWOW64\explorer.exe""
    3⤵
    PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\SysWOW64\explorer.exe"
      4⤵
      PID:4324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\rss\csrss.exe""
    3⤵
    PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\rss\csrss.exe"
      4⤵
      PID:4452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\rss\csrss.exe""
    3⤵
    PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\rss\csrss.exe"
      4⤵
      PID:4228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\wbem\unsecapp.exe""
    3⤵
    PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\wbem\unsecapp.exe"
      4⤵
      PID:4868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\wbem\unsecapp.exe""
    3⤵
    PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\wbem\unsecapp.exe"
      4⤵
      PID:4332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:4076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:1940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\fontdrvhost.exe""
    3⤵
    PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\fontdrvhost.exe"
      4⤵
      PID:1868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\fontdrvhost.exe""
    3⤵
    PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\fontdrvhost.exe"
      4⤵
      PID:372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\fontdrvhost.exe""
    3⤵
    PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\fontdrvhost.exe"
      4⤵
      PID:5108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\fontdrvhost.exe""
    3⤵
    PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\fontdrvhost.exe"
      4⤵
      PID:4288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe""
    3⤵
    PID:388
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe"
      4⤵
      PID:3396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe""
    3⤵
    PID:4336
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe"
      4⤵
      PID:4004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Users\Admin\AppData\Local\Temp\nsy7368.tmp""
    3⤵
    PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Users\Admin\AppData\Local\Temp\nsy7368.tmp"
      4⤵
      PID:4776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Users\Admin\AppData\Local\Temp\nsy7368.tmp""
    3⤵
    PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Users\Admin\AppData\Local\Temp\nsy7368.tmp"
      4⤵
      PID:4452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:404
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:4396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:2992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:3024
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:3488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:4840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\explorer.exe""
    3⤵
    PID:2948
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\explorer.exe"
      4⤵
      PID:4076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\explorer.exe""
    3⤵
    PID:2204
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\explorer.exe"
      4⤵
      PID:3804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:1020
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:1060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:3808
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:5016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:1764
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:3172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:2596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:2340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:4344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:1124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:4072
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:4668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:1536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:636
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:3904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:2652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:1420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:2268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:3580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:2644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:3308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:3792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:2204
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:1604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:3064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:1452
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:5016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:3172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\SysWOW64\explorer.exe""
    3⤵
    PID:1136
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\SysWOW64\explorer.exe"
      4⤵
      PID:4288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\SysWOW64\explorer.exe""
    3⤵
    PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\SysWOW64\explorer.exe"
      4⤵
      PID:1768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:4860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:3660
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:1132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:388
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:1240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:1092
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:5080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:4668
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:3704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:1672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:4896
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:2200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:1168
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:3752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:872
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:1224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:4812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\spoolsv.exe""
    3⤵
    PID:1868
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\spoolsv.exe"
      4⤵
      PID:864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\spoolsv.exe""
    3⤵
    PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\spoolsv.exe"
      4⤵
      PID:4008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:4684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:1828
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:2416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:4424
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:1996
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:1768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:4784
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:2088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:3544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:4740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:184
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:4968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:4072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:1672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\SppExtComObj.Exe""
    3⤵
    PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\SppExtComObj.Exe"
      4⤵
      PID:2992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\SppExtComObj.Exe""
    3⤵
    PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\SppExtComObj.Exe"
      4⤵
      PID:3752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:1212
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:4400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:1224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:2140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:3792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:3124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:864
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Users\Admin\AppData\Local\Temp\is-PK641.tmp\3BAE.tmp""
    3⤵
    PID:4680
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Users\Admin\AppData\Local\Temp\is-PK641.tmp\3BAE.tmp"
      4⤵
      PID:4480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Users\Admin\AppData\Local\Temp\is-PK641.tmp\3BAE.tmp""
    3⤵
    PID:1020
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Users\Admin\AppData\Local\Temp\is-PK641.tmp\3BAE.tmp"
      4⤵
      PID:4828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:1616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:3736
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:4808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\RuntimeBroker.exe""
    3⤵
    PID:4424
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\RuntimeBroker.exe"
      4⤵
      PID:2488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\RuntimeBroker.exe""
    3⤵
    PID:1768
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\RuntimeBroker.exe"
      4⤵
      PID:2340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:1456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:1180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:3832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:1092
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:3884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:1536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:1192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:1516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:636
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:1048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe""
    3⤵
    PID:2604
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe"
      4⤵
      PID:3904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe""
    3⤵
    PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe"
      4⤵
      PID:3324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\SysWOW64\explorer.exe""
    3⤵
    PID:2948
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\SysWOW64\explorer.exe"
      4⤵
      PID:2656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\SysWOW64\explorer.exe""
    3⤵
    PID:1288
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\SysWOW64\explorer.exe"
      4⤵
      PID:3840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\conhost.exe""
    3⤵
    PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\conhost.exe"
      4⤵
      PID:2224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\conhost.exe""
    3⤵
    PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\conhost.exe"
      4⤵
      PID:3804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\sihost.exe""
    3⤵
    PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\sihost.exe"
      4⤵
      PID:2204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\sihost.exe""
    3⤵
    PID:2432
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\sihost.exe"
      4⤵
      PID:1360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:1952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:5100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:1136
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:1616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:3396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:2468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe""
    3⤵
    PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
      4⤵
      PID:3544

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1396

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:896

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4592

C:\Users\Admin\AppData\Local\Temp\D9B.exe
C:\Users\Admin\AppData\Local\Temp\D9B.exe
1⤵
PID:4060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 584
  2⤵
  - Program crash
  PID:4952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 708
  2⤵
  - Program crash
  PID:2256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 768
  2⤵
  - Program crash
  PID:3436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 852
  2⤵
  - Program crash
  PID:1340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 856
  2⤵
  - Program crash
  PID:4520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 856
  2⤵
  - Program crash
  PID:4460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 1104
  2⤵
  - Program crash
  PID:3188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 1168
  2⤵
  - Program crash
  PID:2268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 1164
  2⤵
  - Program crash
  PID:2372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 1172
  2⤵
  - Program crash
  PID:2240
- C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
  "C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe"
  2⤵
  PID:800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 612
    3⤵
    - Program crash
    PID:388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 920
    3⤵
    - Program crash
    PID:4272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 928
    3⤵
    - Program crash
    PID:4212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 984
    3⤵
    - Program crash
    PID:4808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 992
    3⤵
    - Program crash
    PID:4072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 1064
    3⤵
    - Program crash
    PID:3120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 1072
    3⤵
    - Program crash
    PID:4804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 984
    3⤵
    - Program crash
    PID:3012
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe" /F
    3⤵
    - DcRat
    - Creates scheduled task(s)
    PID:1612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 908
    3⤵
    - Program crash
    PID:3952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 692
    3⤵
    - Program crash
    PID:5100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 1224
    3⤵
    - Program crash
    PID:3120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 1236
    3⤵
    - Program crash
    PID:4716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 660
    3⤵
    - Program crash
    PID:4228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 1132
    3⤵
    - Program crash
    PID:5100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 1232
    3⤵
    - Program crash
    PID:4952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 1296
    3⤵
    - Program crash
    PID:1472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 1376
    3⤵
    - Program crash
    PID:404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 1384
    3⤵
    - Drops file in System32 directory
    - Program crash
    PID:4788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 1444
    3⤵
    - Program crash
    PID:1452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 1644
    3⤵
    - Program crash
    PID:3692
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
    3⤵
    PID:5060
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
      4⤵
      PID:2356
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
    3⤵
    PID:4796
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
      4⤵
      PID:1764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 1240
  2⤵
  - Program crash
  PID:4876

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4548

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:712

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4060 -ip 4060
1⤵
PID:2136

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4060 -ip 4060
1⤵
PID:4748

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4060 -ip 4060
1⤵
PID:2132

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4060 -ip 4060
1⤵
PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4060 -ip 4060
1⤵
PID:2004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4060 -ip 4060
1⤵
PID:960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4060 -ip 4060
1⤵
PID:4784

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
PID:2532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4060 -ip 4060
1⤵
PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4060 -ip 4060
1⤵
PID:1728

C:\Users\Admin\AppData\Local\Temp\4A08.exe
C:\Users\Admin\AppData\Local\Temp\4A08.exe
1⤵
PID:3972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\4A08.exe"
  2⤵
  PID:3188
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - Runs ping.exe
    PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4060 -ip 4060
1⤵
PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4060 -ip 4060
1⤵
PID:2748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 800 -ip 800
1⤵
PID:1144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 800 -ip 800
1⤵
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 800 -ip 800
1⤵
PID:2404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 800 -ip 800
1⤵
PID:2644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 800 -ip 800
1⤵
PID:1544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 800 -ip 800
1⤵
PID:2996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 800 -ip 800
1⤵
PID:3064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 800 -ip 800
1⤵
PID:4288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 800 -ip 800
1⤵
PID:3832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 800 -ip 800
1⤵
PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 800 -ip 800
1⤵
PID:2996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 800 -ip 800
1⤵
PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 800 -ip 800
1⤵
PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 800 -ip 800
1⤵
PID:2992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 800 -ip 800
1⤵
PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 800 -ip 800
1⤵
PID:3120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 800 -ip 800
1⤵
PID:4060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 800 -ip 800
1⤵
PID:1064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 800 -ip 800
1⤵
PID:2204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 800 -ip 800
1⤵
PID:4408

C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe\upx.exe
C:\Users\Admin\AppData\Local\Temp\_MEI50202\exe/upx.exe -t "C:\Windows\System32\svchost.exe"
1⤵
PID:3836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

vueqjgslwynd.exe

Path C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe
Size 832KB
SHA256 082ab87e967c75809e40fab5cdfd97aa48c3827b52e26188d9fabfadd5da4bf2
MD5 b29cd31f15d37cebbe2804adc62ce2e9
SHA1 e036f370e3b9a849609823c1cf295c07968b91a0
SHA512 2a031213cadf534acf2ef564937fa6102f7103d91513498c0c4dfef4f3056a1f568e7db70ef9ad817e75117dbead7b0f5e4e8bf59767f026ca09831f321860f4
SSDEEP 24576:iT6UqvN4F5+wKxkQiKAlb0SCCWgYXL508qIdXMFVa49:iVkNC5+XxkQKlb0FjgS0+ct
MD5 SHA1 SHA512 SSDEEP

Submit Download

vueqjgslwynd.exe

Path C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe
Size 640KB
SHA256 bc68e6b0b61ce6967b4dd57b0b8d6b1965bf273fcad3714d639499c09ffd9731
MD5 22098700e93deb64083efcfceb80e634
SHA1 5b005d666d45be92dcf6ddf2a26412d72c581db8
SHA512 92b17ce806ef61db252f30f5a15eaee33cd010ca52d0268a1a41afa610a730507d2388ea1ad0efffb1412c4e3837f9eae36e89d1eee62b51292dc10cfb2cd163
SSDEEP 12288:iTiyWCTPivNQjI45+wPlKxQPQKxZ0bA4kb0vkUowAhUxCyPg8BCFOFbTdd2tX8F:iT6UqvN4F5+wKxkQiKAlb0SCCWgYXLF
MD5 SHA1 SHA512 SSDEEP

Submit Download

288c47bbc1871b439df19ff4df68f076.exe

Path C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
Size 3.2MB
SHA256 0774c2e1349c193926417a5f1783ed1961111ab1d30d2383fca93e6525262a6f
MD5 f6bf5c21a8247203eb4280e83fba6664
SHA1 e7558d48e41f127dd779c35a7eb1613c74761249
SHA512 60da2899d4fbc8910a69eb3daad48f96bdd769178ccba6c55e640989514943897a2f9f6a355ed97cb16bacdcceb57eaa7eedacd6901242887c045ae4593f0817
SSDEEP 98304:Ox34CiKzvjm7SLtMZTm7LASnwWEuCSeZHe31O6Y/qP:OB4yzvjmEtMf+wT3Us6Y/qP
MD5 SHA1 SHA512 SSDEEP

Submit Download

288c47bbc1871b439df19ff4df68f076.exe

Path C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
Size 1.7MB
SHA256 58d6747e01ef0fce7a9a53341707556e91276314acbae7f6228d782291686b3c
MD5 0f68106658c054bde5c705e5b1f000e6
SHA1 5cc1bb15c4dfd5ad0630ae0ae9ac2286f3050102
SHA512 30bbfc56175b7245acb175f85fc5023b497bb0ed26e6ccf6a585b408044b6adc8d165e1b6e797f1de1e5dd33806c14c9e3d5d818f5455ea0d7a2c381c269e59e
SSDEEP 49152:Ox3YeaCYntkzvlJT+5G4zfKMSLtAcwjZ0wl0ADmLAGFB:Ox34CiKzvjm7SLtMZTm7LASB
MD5 SHA1 SHA512 SSDEEP

Submit Download

288c47bbc1871b439df19ff4df68f076.exe

Path C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
Size 2.2MB
SHA256 85d8fa5ebfc3fc150872fd0fb5dd3388dd58af0aea8ce0f6f8408dddd2bb0247
MD5 c0cbbc37afd3038489867a901c78525d
SHA1 45c528c015647624bd72cca399115a4f77a98a2e
SHA512 994e3bc4058cc285cf3439e1611a7365b9a38aa95de924038e9242d100308d3f5d7be51460e5777913daba683714cf53242a06ec9d84576a9fd999a3c56d586f
SSDEEP 49152:Ox3YeaCYntkzvlJT+5G4zfKMSLtAcwjZ0wl0ADmLAGFnwWEr6CfJ8ezdHG:Ox34CiKzvjm7SLtMZTm7LASnwWEuCSe4
MD5 SHA1 SHA512 SSDEEP

Submit Download

288c47bbc1871b439df19ff4df68f076.exe

Path C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
Size 4.1MB
SHA256 b7a6dcfdd64173ecbcef562fd74aee07f3639fa863bd5740c7e72ddc0592b4fc
MD5 d122f827c4fc73f9a06d7f6f2d08cd95
SHA1 cd1d1dc2c79c0ee394b72efc264cfd54d96e1ee5
SHA512 8755979d7383d6cb5e7d63798c9ca8b9c0faeec1fe81907fc75bbbb7be6754ab7b5a09a98492a27f90e3f26951b6891c43d8acd21414fb603cd86a4e10dac986
SSDEEP 98304:Ox34CiKzvjm7SLtMZTm7LASnwWEuCSeZHe31O6Y/qHYq9Pei:OB4yzvjmEtMf+wT3Us6Y/qHYKB
MD5 SHA1 SHA512 SSDEEP

Submit Download

2E2F.exe

Path C:\Users\Admin\AppData\Local\Temp\2E2F.exe
Size 3.3MB
SHA256 ca35d0581791390f299c4ce45cac0339cfa11ebef38fde517c9823c6cf6d3b3e
MD5 50f2e865696beeb3c20e1f05dc72d03c
SHA1 21a7625cae875b09fd20c14f5f5217e2fd51cab4
SHA512 d8386334a31a62b8280d659de1bbc72971c18ae481961f08e8b4e77fa6b107e880f02dcf5b28f3efa2db3833d17075f6283550cc0c0fc74d935c427c314747c8
SSDEEP 49152:zD9Zf63RpjUA2/SBEz7e24xcMDSMIZbe3o9YJumw4wMr2ciI+:zxaFUA2/SO+5OMOMIZb8oya4wMr2ciI
MD5 SHA1 SHA512 SSDEEP

Submit Download

3024.exe

Path C:\Users\Admin\AppData\Local\Temp\3024.exe
Size 233KB
SHA256 b8e8d02adef8c901bb1dade919eb9e74d25142437ae09b94c6b1eb8856163163
MD5 92e6deefde837f6152fea7f3d0811e7f
SHA1 29781ce12871d285f182f49e0260dc43450d74fd
SHA512 1e43d0215c8b45875e1003eecd1630b2088118727cf0e70ea756d1b468073a93c6d278bf1e1fbc096efd49c55d3093de73c0c3d2641de29ddc540910b37e59c3
SSDEEP 3072:+jy7KRLORAwGh/iao9Ecxe6atvaCdNXwaLm8Xa85wdroS8B:+0KRLOOh/iavcUbhzdNX/LnYdp
MD5 SHA1 SHA512 SSDEEP

Submit Download

356085813370

Path C:\Users\Admin\AppData\Local\Temp\356085813370
Size 66KB
SHA256 6c7f9150547b83f0de5bbbb99233cca03460089904f9529612c95e5acb9f5443
MD5 623e927762f1bddec7bb1f783930ca2e
SHA1 af8398d5610ff289c8c02690983065647a34c414
SHA512 7ec4f68fb4139d8977e0d42d9adc1490373ada9c4ee6d89bd332ceaca267119ba60eabed12a714ce349b9bd49c0033f5df72970fa873bbcc5c356becfc4988f4
SSDEEP 1536:sHXPGxuVeCmGOwvLFF9fKX0PkAY9dr/ffGT8ab:K/F0Cm0FI0PkAUfGgA
MD5 SHA1 SHA512 SSDEEP

Submit Download

3BAE.exe

Path C:\Users\Admin\AppData\Local\Temp\3BAE.exe
Size 7.2MB
SHA256 13efa1438185286baf05e6b36e742ada84be458d68c318d5fa81b3ec2c78742b
MD5 3970f2b3ae852a17575eb3c62425775e
SHA1 327901dac9a816d190787afb7da7b738a7f613e3
SHA512 7ca43d4d25540c0fe7d8c12a9eeb73955164262c42e2641aa9e0a8da8557cfcdecd2a83f0dd19dee9bc100feaba04bdd5837442a6a763f36470a3779880ad197
SSDEEP 196608:pQGV9gBq0n4KKaAJFMU9ubAL2XnXVbAEvcV7:p79gBq0nWaAgUwNXVE
MD5 SHA1 SHA512 SSDEEP

Submit Download

5784.exe

Path C:\Users\Admin\AppData\Local\Temp\5784.exe
Size 6.9MB
SHA256 87eeab0823d73141f2f1676bfab3062997f5408fbc3716a4721829c654efcc16
MD5 bab36bbe9e6b5dd1e9499777ebb45d37
SHA1 f3a2ffa91a5f7a135bc63ae745fc70f2057f5460
SHA512 491a60f3f811ab2265e6f8e77a275854d651e20111f8b4bdf8497ad46dfa0a6ae15b4dea9e9af1cc48a30836e85ba7568df95dcf55475ae4c3d84525b8d0e516
SSDEEP 196608:drdPa3Pl8j7Ke1k6N25U0agbrT6NZ+t0ZGhsYN6mF:d5P08KeDQtSb+t0ZEJF
MD5 SHA1 SHA512 SSDEEP

Submit Download

5784.exe

Path C:\Users\Admin\AppData\Local\Temp\5784.exe
Size 7.3MB
SHA256 a6ebd82c126e832b57b5bfb89686850fd1c8e3cf82b5ebd212146c797946a02d
MD5 1772d73cef40195ed6a4dbe520294ead
SHA1 cfc3eaec0fb69e2fc7982c87e8a00801a8bc6319
SHA512 a8e59d81a6c12713b054580fcfea0788b8ceecd8b11019433959f70564f444d2b9af8c4d7f94d33b43a6b386883d7800bd195789f36ae025f2908adf13cd4e6a
SSDEEP 196608:drdPa3Pl8j7Ke1k6N25U0agbrT6NZ+t0ZGhsYN6mQws:d5P08KeDQtSb+t0ZEJQws
MD5 SHA1 SHA512 SSDEEP

Submit Download

6485.exe

Path C:\Users\Admin\AppData\Local\Temp\6485.exe
Size 235KB
SHA256 db0cea6deac4cf4de0d383c1ddbefa1a89c6852ad084550d9c3d5408ed310341
MD5 b84ee29e35cbe9790c24770e314a5460
SHA1 da6282537cb74fb9f3d31797d5d3235568d0b69f
SHA512 045f3c0b953682d8f77311c1cb09d0a59aa20372d0393dca3777658a15a8f244fc6ddd19aed11444e42be6f50528cdba185d89de893649ee4af082387bf9c769
SSDEEP 3072:U5SKDoSLWB8wDguCFNauq08yuKTmBFaImo98Xvl5RtMinbo/8B:qkSLW/guCbauq07hsFaZhG7
MD5 SHA1 SHA512 SSDEEP

Submit Download

6746.exe

Path C:\Users\Admin\AppData\Local\Temp\6746.exe
Size 421KB
SHA256 e40c8e14e8cb8a0667026a35e6e281c7a8a02bdf7bc39b53cfe0605e29372888
MD5 1996a23c7c764a77ccacf5808fec23b0
SHA1 5a7141b167056bf8f01c067ebe12ed4ccc608dc7
SHA512 430c8b43c2cbb937d2528fa79c754be1a1b80c95c45c49dba323e3fe6097a7505fc437ddafab54b21d00fba9300b5fa36555535a6fa2eb656b5aa45ccf942e23
SSDEEP 6144:4phcsngKdHpPXECq6Xz4G/rmnHXekVB9YNeeA23YMd7pMFW54AXIEB93KWZMxEHL:4pasngwHpP5qa4G4eIWsyHd0XKBBXL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Utsysc.exe

Path C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
Size 382KB
SHA256 010448a14f98ceab89b065f65badce4a307c78b576adcb122b596815cf343ee9
MD5 876a6280f3f412d0e60503c1c4393ff8
SHA1 29a4b5755453dde0aaf704621c5a49dfb3677179
SHA512 91a4b30c9abd641ac5737c5ebdf188b455aa0330113849dc0573eba9f94fab7aeec026d687031d3e8cc2d5be764396eec179cd05edcf483d66c23b869526228a
SSDEEP 6144:v+DbL+qMMB8n/oCLbTxdXRKEOhqn/XxJUmFO7VvLS30DCqHSsTPrrU/hpQm:4Cq1mn/HLbfXRKUPxJUmAJvRD9H1PM7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

734D.dll

Path C:\Users\Admin\AppData\Local\Temp\734D.dll
Size 1.4MB
SHA256 b7dcda8d3982152756c5738a49b7cc8da90ccc423363a5cbaf3260f8dedd3f4b
MD5 eceed7c6d0970052ca39f07f95179874
SHA1 0ae5cf9834af15670fb50dee6e8f2be1de38dcc2
SHA512 fb6ec31c9aa9e268cdc10d385ef8a0f832f0dfd6b4184bd4300413f7e9dcee1ee83b2dfdb3484cba2e208e33d4383093f9d63ab79eddaab3fce521067f406fbc
SSDEEP 24576:eYSsyRBMtKp2otDjI7ebtZdLxubdonrsUUKNGPhFWl8RdM8PYQ63:Ys6MFUn8ebp1uRonrv2hw8Ru8AQ63
MD5 SHA1 SHA512 SSDEEP

Submit Download

734D.dll

Path C:\Users\Admin\AppData\Local\Temp\734D.dll
Size 1.7MB
SHA256 c321b5b4a9e924ae67bef52c7ba2c9d1d3b1f1c0a7419f2305a143670397abb5
MD5 7a89d2b3c277e5e1a7475b2e32020e72
SHA1 8fff21fee872277af124e9e2b0654d6b07a3e91d
SHA512 44283a730d96bda8e35a3a552207dae022457b1cba5a5b2f63e324e07f3fc168dad8e70f31edabbce6cee1ec06f730860b7aa28c7f6098f7bf74995465a8c665
SSDEEP 49152:Ys6MFUn8ebp1uRonrv2hw8Ru8AQ6f883X:YkFgjl1uRonr+/RRW88H
MD5 SHA1 SHA512 SSDEEP

Submit Download

734D.dll

Path C:\Users\Admin\AppData\Local\Temp\734D.dll
Size 1024KB
SHA256 893de8b3efadab53a5565256bc66f16b45387622e67560de084486b40f0c20e3
MD5 d6c483f408bdbb4335d5da9a8bed731d
SHA1 f2afe315be08e697715caae2ea4dfa94f06e6535
SHA512 b0346a518f03079b7f2fbd5220c9cc2576b73beac574f7326dbfe56fd9cbd7266ab895dc259e5bf558687d3070d4a536d34279d9c772dd3a76c1e5b0d39d9d41
SSDEEP 24576:eYSsyRBMtKp2otDjI7ebtZdLxubdonrsUUKNW:Ys6MFUn8ebp1uRonrvg
MD5 SHA1 SHA512 SSDEEP

Submit Download

BroomSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
Size 256KB
SHA256 d1605c5bec82ffd54eeff6adfe5c1a700e4633232d27e903655adeadddab2347
MD5 c66156682cd08ea200547907b7e5e1ea
SHA1 f6778e34905907b10fe0788e3ddd5e1766a7a205
SHA512 1a3da2b1c45a1a1a698c55a1dd09e1c88e174e13b7ed40dbda41f6a69077d613b7758f380dd28f29ebd9a41bc95e13e13c6fecc49c61d120e6671a4ff7fd4e3d
SSDEEP 6144:PRzUaw/edhb3p/uL5kMhrYAg4yQmbEoufR:PFTw/eTb3pq5kMx129uJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

F436.exe

Path C:\Users\Admin\AppData\Local\Temp\F436.exe
Size 1.4MB
SHA256 0a3a11d04379d8aa4f165f5f23e8f7ad6a6919473fe94c5c26eff088f8c99cbb
MD5 c10cbfd086a1de6c44c2688efef68ad0
SHA1 a5ea8aef3d8c24bdec06874838b263b6ee96b761
SHA512 b228f081b099d3e4b4f49ba87ebdf6b9a93b00c5f8ae6d93b428e6e62c264b99e50aa5ea26312d6459b789c75f9bdcab9922f6c076569096d3f1f7e2d8f1d88c
SSDEEP 24576:BsjGHv3eCTz78vOaJRGGhII9L3HoTz+YKONZ2l+ZYKBwRb9KuiQMPNpBqOdCS/zL:JR785GlI9LrSmZuwXuPH7CSrL
MD5 SHA1 SHA512 SSDEEP

Submit Download

F436.exe

Path C:\Users\Admin\AppData\Local\Temp\F436.exe
Size 1.8MB
SHA256 4195c42feb7a4422296f237f54e3debe06c74996a5e92688a0a2f72cfe638e64
MD5 4ae5609b4dd28a0da64da38c8b8b874c
SHA1 afbda2047dbf142f9e9dbb03a15cbbd3e82f43b8
SHA512 c35ff034201d05c31264b7568f800c97a64cb7c005cbb0d1e678db454332faf5f8014c9ffd6d7f18d8fd8cc33f7cdf9bc2f710c1130bda0709ea85af8415caa4
SSDEEP 49152:JR785GlI9LrSmZuwXuPH7CSrO94oubD16Xx3:X78gW4mlXujC/MB6Xx3
MD5 SHA1 SHA512 SSDEEP

Submit Download

F436.exe

Path C:\Users\Admin\AppData\Local\Temp\F436.exe
Size 1.1MB
SHA256 96f95ead1e7a9d999b9b7588b53cc2a1e3135d850e3ef26ae9c4dfc7c12c0d00
MD5 b7572acec13520e5de6ee28c2a0bcb85
SHA1 59c20277c68a02e92fd5617e1da6aed5bacbb5a2
SHA512 e4f287426ec4f74f942ea7dc15e48639e9565fb37df932b0ae762e96cd1d18076e2f06c59eb13355315f47678b44c479664cc643a7cb2c6c44b6cfb0cf322884
SSDEEP 24576:BsjGHv3eCTz78vOaJRGGhII9L3HoTz+YKONZ2l+ZYKBwRb9KuiQMPNc:JR785GlI9LrSmZuwXuPy
MD5 SHA1 SHA512 SSDEEP

Submit Download

FourthX.exe

Path C:\Users\Admin\AppData\Local\Temp\FourthX.exe
Size 1.4MB
SHA256 8754b3baec6e18a79cce990aec7f93ac56fa3323b5a1cb30c8f5b19d8422d92f
MD5 280c788cc0280197d4152e6f0b5b8a65
SHA1 255860ecf68a5055f9975829ea42771f0a57567a
SHA512 8b537f4df8fdaf07850ecafc8554d4bd015cd30e059bbc17915212669cbc444e90c20ac7eb38c6a181eb2cc72c8649b583b985b930154848e0fbc978670ca9a7
SSDEEP 24576:iT6UqvN4F5+wKxkQiKAlb0SCCWgYXL508qIdXMFVa4iNT6nU4L4IaVJER9EXwOrq:iVkNC5+XxkQKlb0FjgS0+cywnZLIJK2+
MD5 SHA1 SHA512 SSDEEP

Submit Download

FourthX.exe

Path C:\Users\Admin\AppData\Local\Temp\FourthX.exe
Size 1.1MB
SHA256 d753eef117aabaa8247c3bcea0d39f64cfeaf612193e30995f5c00ead203e9c5
MD5 10da85ae04da6c225fd4ea9d204378c9
SHA1 d3730e020f9e2a5c217926180d44b65a91cf6a4a
SHA512 1cc1ef5da86f4683422301f8318c1bd6d30515aa36e1d6949eb749b47a3b557990b79f7bc682eb3e3f2ccef4155e56f8adeb1f09beec97de067acf40c91e9d69
SSDEEP 24576:iT6UqvN4F5+wKxkQiKAlb0SCCWgYXL508qIdXMFVa4iNT6nU4L4t:iVkNC5+XxkQKlb0FjgS0+cywnZLQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

FourthX.exe

Path C:\Users\Admin\AppData\Local\Temp\FourthX.exe
Size 704KB
SHA256 cd1818fa6f2a4cbdd75985ba9e36c6141d206f5728b994875c3af7c874938566
MD5 029a5147d2f0d080800b095d06298a55
SHA1 6d53b0c00f128318d23de9db082989e30369baad
SHA512 b035c22bd7b41375cff69882f696d37f8167c12a770da3f6d919d1350789bd1f1d4cfc623fe325c696b3f30e96632bbd1233cdff878df05e8c5b7a153f3c9e1c
SSDEEP 12288:iTiyWCTPivNQjI45+wPlKxQPQKxZ0bA4kb0vkUowAhUxCyPg8BCFOFbTdd2tX85y:iT6UqvN4F5+wKxkQiKAlb0SCCWgYXL5y
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallSetup4.exe

Path C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe
Size 1.9MB
SHA256 17947e1227e767b6ddd00884eab28ecaffc7c97591a141912c12f165733a673c
MD5 8964d20ad832e50ab1ebeeb4896f00ca
SHA1 fb2406a9d3066349937987a87f67253d0e82a87a
SHA512 50e5554a1d9329d22894e9693231aff91ebdc87964fd3d69b633b0265273242b31c4cad25d674fb6acd823ff0996136d6f96a4851cd2850917c99d309c267366
SSDEEP 49152:ChrF2z0X1W34qvuyXPHcqaGqW9gwLgMyu5noEiyIJAuX:ChFdFWINS/NF9gpMR5oEfW
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallSetup4.exe

Path C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe
Size 1.7MB
SHA256 80b1a676e9c68df1ef63045b4825e4bd812dc0cea2bc42c7abe1a4a724bc9fb5
MD5 50be993208397a828702e97eddb68559
SHA1 068ae2e90c269a7bb8e56ba86123281041c529a4
SHA512 05a62cd158de16fc3dae28bc3ca8724ccfca2a04eba387dd1563ab76aa8b9d0ff2e90a9c8f3200da19a35cfe4235410ef0ca7336ac2d3a7f539a8a1522741283
SSDEEP 49152:ChrF2z0X1W34qvuyXPHcqaGqW9gwLgMyu5noEi1:ChFdFWINS/NF9gpMR5oE+
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallSetup4.exe

Path C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe
Size 768KB
SHA256 d2ed2c2940a1994e68fb473cf5e7c0ab0487d38ea141f35c0f6c07230e7e868b
MD5 f0ff5f372a958f41fa51da9c9f03c8b2
SHA1 06d46a56e5bc97c19dd5fb7195e973121b641c55
SHA512 8ebc3a3acd0f9139707f0681f85457ffdaba8f6532bb7d28a196be05a0bf04692ffff4c0cf0a712897068c395e3f5aa64c799fd9cffc810b0139cb7d778e8424
SSDEEP 12288:IfLo7clx/rJTysd72z1AlH3xHPuUWyZDyguw4aeVi1GE8r7P910tv2N2Z8s/GAS3:IfLq8xtTysF2z1yX1W3ViqP91AZisOB3
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\VCRUNTIME140.dll
Size 93KB
SHA256 6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c
MD5 4a365ffdbde27954e768358f4a4ce82e
SHA1 a1b31102eee1d2a4ed1290da2038b7b9f6a104a3
SHA512 54e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722
SSDEEP 1536:dkb0wrlWxdV4tyfa/PUFSAM/HQUucN2f0MFOqH+F3fecbTUEuvw:dWD4eUp+HQpcNg0MFnH+F3fecbTUED
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\VCRUNTIME140_1.dll
Size 35KB
SHA256 b1d3b6b3cdeb5b7b8187767cd86100b76233e7bbb9acf56c64f8288f34b269ca
MD5 9cff894542dc399e0a46dee017331edf
SHA1 d1e889d22a5311bd518517537ca98b3520fc99ff
SHA512 ca254231f12bdfc300712a37d31777ff9d3aa990ccc129129fa724b034f3b59c88ed5006a5f057348fa09a7de4a0c2e0fb479ce06556e2059f919ddd037f239e
SSDEEP 384:nNn62MCmWEPhUcSLt5a9Y6v4HOE5fY/ntz5BBW0O3+XfeuncS79+pWrQKWhD/HRj:YdCm5PhUcxgHY/ntXBzxvV7KtDvCTO
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\_bz2.pyd
Size 46KB
SHA256 0dd68268a9d47ce935ff932c3fe281e7a6d57e9cd424299d05560e56a773ef4b
MD5 5f464b4f06dfe3ab504169ffdc7f53ae
SHA1 2942cf1f492213842d7bb8e8198355d3607b2f3b
SHA512 d66c3c238a1ebdfb6f81436f8d0481f3ed8a0ff1212e3efe466d6820e36db50c31dcdb1019e46dcedb753149a6cef3f9485fc232f3dd42b96b7b0604dbad6040
SSDEEP 768:fSt1pAaIL2thxk3rjQgofeVaIqCGoDFQ7yqnuIJ7TpcgIIMVGpDG4yAehFj:C1pAaIaes3feV1iizgIIMVGry7
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\_ctypes.pyd
Size 56KB
SHA256 19b813bcd356f37e73fe7d367051eb0bd901f2bd14ca8ad4662b1503b1459cea
MD5 332d773008e12399ab98d085cd60c583
SHA1 c3aa78e9ba7732b989a3cab996e63791eaf46a7f
SHA512 381c2083ccfdb39f3986060b21ff168ee87cfafc4ad53b34de3ae473a4fc0204615af87e9ee69407d07528064c7b2a7d9f23a94939de0e26c614169b8cc418aa
SSDEEP 1536:GCwIk2ERK2HZqd6d93oXrCedXfxsYazzIIBPt0yzl:GHTPok3oXr5dvxsYafIIBPtbl
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\_lzma.pyd
Size 84KB
SHA256 2b41390d1bffa9c5b7018bc0544b0a2c188ecb9b00ebc56df5a864dc47e32697
MD5 6cf80dca091dad17790a6b1af4e85381
SHA1 bcb4052a4f960b429eb9db019734fc00b41c4427
SHA512 da00f86c7a4168fa46faec79605831d26e4c86dd1d009b89f5087ac756bdfc32e0c036471639131eb881bcc53b8f1f92d947f3ef47f3dc7e56bb2e99d1357cf3
SSDEEP 1536:r1mzwAeL7Ij2wtqklnNNxP/SxbtYOndQqUAVGd+fP3S+9kAUmIID1tmyPx:Io3wDNNxP/6btYUUEGd+HTPVIID1tNx
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\base_library.zip
Size 448KB
SHA256 b9f0155fe25b0e1522b3087d724f006182c19639705d8a3a812ec52a0e2e9127
MD5 43bbac6a5be26b24d1df3d074da570e5
SHA1 43bb25003ca2276a4f0a7ffe5cfba7baf5ce8885
SHA512 c95c0be17fb1d1edc0b4c6b6918daaf116fb1eea4c8383e092211e78be2ab06ec84ea55ab9aa3abac41e14a83b76e3bf38ae64b04c61945a7ca6dccd6d125b48
SSDEEP 6144:EtYhidCQIojSXZ/27lWP46ZrhszsK2tMX//j0qG6fUkdWHUrg:E+hidCQIo6ZNh
MD5 SHA1 SHA512 SSDEEP

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\libffi-7.dll
Size 23KB
SHA256 3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56
MD5 6f818913fafe8e4df7fedc46131f201f
SHA1 bbb7ba3edbd4783f7f973d97b0b568cc69cadac5
SHA512 5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639
SSDEEP 384:hRZBxuj5W4IBzuU2CUvOEvba4Za7gJXkrZRCXEpnYPLxDG4y80uzFLhHj:rwlGuUm2Evb1p07pWDG4yKRF
MD5 SHA1 SHA512 SSDEEP

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\python3.dll
Size 58KB
SHA256 074b06ae1d0a0b5c26f0ce097c91e2f24a5d38b279849115495fc40c6c10117e
MD5 c9f0b55fce50c904dff9276014cef6d8
SHA1 9f9ae27df619b695827a5af29414b592fc584e43
SHA512 8dd188003d8419a25de7fbb37b29a4bc57a6fd93f2d79b5327ad2897d4ae626d7427f4e6ac84463c158bcb18b6c1e02e83ed49f347389252477bbeeb864ac799
SSDEEP 768:bS99q+0o22ByfbEap+VCBQ53gUiT5pLFdBk4/yFi1nuVwWBjChtFyrUdmd9RSxD0:M9xiEAnUvdy5IIB0/ya7
MD5 SHA1 SHA512 SSDEEP

Submit Download

python38.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\python38.dll
Size 1.3MB
SHA256 c544d2b603736516b92f84f37f0136a1a3e966999b7bb9ccda880e4cc44d62ee
MD5 6fcecca04d922ce3355ef33e98068f1c
SHA1 d8f87b05f53f9359ddbcfeb8816bd8209b015ca2
SHA512 8cb95b5ffe5e457687d2c2cd369e71372cc238914fadc23ad4676e42b139f3556b3214092631fe1006575dc1b83fedc11fb2e4bd4437cd9b70f4b03015978e1f
SSDEEP 24576:4x/FMCGq6fqOD+5QKiQ6SqHPz5nTD8DRr7iNh+PyteisMfU5cSNdFHpFetZv710T:sSCYfqVmK56SK9TD80ptebRNXHpFegT
MD5 SHA1 SHA512 SSDEEP

Submit Download

python38.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\python38.dll
Size 832KB
SHA256 bba11cd1ebfee99f008534b9b938095d633246ff9e46f167dea9fa9c3aeace85
MD5 f3268abae040088aac590dba5ffe094b
SHA1 b7508551d670569743002ea439e493a689f2b181
SHA512 582f3d791af3e72c17813dff08c956c4b158bda1a49e7cfa722c7953197db93804ef257de53c44c0d1e6c21ba2b7830dce234a0314170898bbe4e6285be441f2
SSDEEP 24576:4x/FMCGq6fqOD+5QKiQ6SqHPz5nTD8DRr7iNh+PyteisMfr:sSCYfqVmK56SK9TD80ptey
MD5 SHA1 SHA512 SSDEEP

Submit Download

pywintypes38.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\pywin32_system32\pywintypes38.dll
Size 62KB
SHA256 f1d4431da1300b9fe40dbe6c1e2c8311cd7f458ea1d8f2db234137cf57c5d2d2
MD5 c9b84b1ac14813c7c8fc5e7ab6ef788b
SHA1 c5eed330f129e5c6a9b817ad081cf8722e9eb147
SHA512 bd4b3af8c9b87110197ea64572e97ea027ead198eb24de8eee43bb70913e53bf96368ff2c1bf4d2bb5db3eab24ddb9f043760cf5a64ef6bbaf09dc63000eca26
SSDEEP 1536:48yGA8d6epdvLhWVhLAS1FjL9NxFRgCbTp4SZt8ei:9x7hYLAgFjLnxFV/p4le
MD5 SHA1 SHA512 SSDEEP

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\ucrtbase.dll
Size 1011KB
SHA256 6238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232
MD5 849959a003fa63c5a42ae87929fcd18b
SHA1 d1b80b3265e31a2b5d8d7da6183146bbd5fb791b
SHA512 64958dabdb94d21b59254c2f074db5d51e914ddbc8437452115dff369b0c134e50462c3fdbbc14b6fa809a6ee19ab2fb83d654061601cc175cddcb7d74778e09
SSDEEP 24576:EsKxVJ/pRRK0Y/9fCrl4NbpjONcncXEomxvSZX0yp49C:lKxDPHQCrlQBXxw
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_1vpq2ihr.5xq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1vpq2ihr.5xq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-0GETR.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
MD5 SHA1 SHA512

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-0GETR.tmp\_isetup\_isdecmp.dll
Size 19KB
SHA256 71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
MD5 3adaa386b671c2df3bae5b39dc093008
SHA1 067cf95fbdb922d81db58432c46930f86d23dded
SHA512 bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
SSDEEP 384:ED4NeA1PrXPBdHCNPJEQkWybd0oBSRnAZ806OSDrgtOFXqYUPYNQLJ/k+9tPEBer:64NHPfHCs6GNOpiM+RFjFyzcN23A
MD5 SHA1 SHA512 SSDEEP

Submit Download

3BAE.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-PK641.tmp\3BAE.tmp
Size 687KB
SHA256 f5325bffc6ca6af7023f5c79e5e32f6949c6442bb8cb8536383c717bd1ca5980
MD5 f20268a482d34bc05ee497247fc2327e
SHA1 e3dcf87f57476087974d2e9b63d4c46d595a0e78
SHA512 2403c25fb65ffd4da259103dfe2a1e6337efb5b2c0f71be9bbe78c81c4c77f7afd31a04e7361348159385e5137a7044d4b2f9db8ca1d99706d2db7928bd371db
SSDEEP 12288:m/kqO+1G7DMvrP537dzHsA6BllcOuGbnH3ERNIg9rNlQyRnh1K8xyF:WkqZ1G7DMvrP537dzHsA6hcHGbH3ERhs
MD5 SHA1 SHA512 SSDEEP

Submit Download

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu6955.tmp\INetC.dll
Size 25KB
SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
MD5 40d7eca32b2f4d29db98715dd45bfac5
SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
SSDEEP 384:pjj9e9dE95XD+iTx58Y5oMM3O9MEoLr1VcQZ/ZwcSyekMRlZ4L4:dAvE90GuY2tO93oLrJRM7Z4E
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsy7368.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsy7368.tmp
Size 246KB
SHA256 b058ebd19e905fd4710c87e3069813b182b52fd7ec37faa2e65ff9be9a3ba6ac
MD5 365bd5e2897191e0538425286aae91cb
SHA1 03ccf0b42f2d9d03c9f76a76195eb78f704e8640
SHA512 ddce73f69ed9d20e541564f1df53e3cce1f26aef660d53b7d3cb51042e4999e4ca98394ef3b618b0c89b0cca819f635f8feadf6e7b7e892ae8e24f11d117655e
SSDEEP 3072:CPJ1IwLH7XU11jYPEMelFWznM7c9FUDBoHw36sQ8wqRsmj8h230nckx8XQ+5CYYX:iZLw11jYPEMmF69TFQ8h2kcJOYx
MD5 SHA1 SHA512 SSDEEP

Submit Download

xrevealcddvd.exe

Path C:\Users\Admin\AppData\Local\X-Reveal CD DVD\xrevealcddvd.exe
Size 3.5MB
SHA256 130d8b5e78f0112e0a3ec99568d1759878de4e6b2b96fadd2ef08f6c4ae376d6
MD5 74194449650d7c9ff07df973bd7c5dfa
SHA1 a4f3a9198438ed03cc848f1687d05e5ca3664a34
SHA512 2639a6ac36e42dcb44bb2c45def37bcd1f81bbf0113c23ed251dea7266a41462ec9ebac855f1540c47b25da32d5f58ae11e078ce017463342288dfa60dfa23f0
SSDEEP 98304:31yXpZBJKZZZZZwrxe/b/7LYfq3d3jeWL9nKNhXC:eBzGTe7DXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll
Size 1.1MB
SHA256 83ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
MD5 f01f5bc76b9596e0cfeab8a272cba3a5
SHA1 19cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA512 ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
SSDEEP 24576:Pc6CX/YqLAS81Un+J35XBMpZ9+Jo73Jw/tDMX/td:rqLAS81UnI5XQZ92ogO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Task.bat

Path C:\Users\Admin\AppData\Roaming\Temp\Task.bat
Size 128B
SHA256 6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331
MD5 11bb3db51f701d4e42d3287f71a6a43e
SHA1 63a4ee82223be6a62d04bdfe40ef8ba91ae49a86
SHA512 907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 6dff43255aae1b92ed83a15bcb3fdb19c20a1d33ce695dd3ccd4767fccc4ee43
MD5 afae8ae91b5a638c328390b91d175c82
SHA1 78d7ebc991daccac7266798d54b5b7638da1d8eb
SHA512 50d804bb54c3ba8dd8742f6fc65473b2c0bcfad864ffc4711c519cb75a5ab179ef9cf2e7d8cf8e9e01be11da4670bcaf10c8efd1fdc4c7b9f369854cc69d4397
SSDEEP 384:h6+B19m+2JabQ1V+OMlm0Uo9hSMdT9K6seYbne2Yv/ZJwM0hOaEIjaiFqZbObTUA:A/JaIxMH5hS+T9N+n4vgOaEIV4qMB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/464-239-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

Download

memory/464-169-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

Download

memory/464-237-0x0000000000400000-0x00000000008E2000-memory.dmp

Download

memory/820-198-0x00000000007E0000-0x00000000008E0000-memory.dmp

Download

memory/820-199-0x0000000002180000-0x00000000021B4000-memory.dmp

Download

memory/820-201-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/820-238-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/1100-247-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/1100-209-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/1100-261-0x0000000002E50000-0x000000000373B000-memory.dmp

Download

memory/1100-280-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/1100-246-0x0000000002A40000-0x0000000002E47000-memory.dmp

Download

memory/1100-194-0x0000000002A40000-0x0000000002E47000-memory.dmp

Download

memory/1100-197-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/1100-196-0x0000000002E50000-0x000000000373B000-memory.dmp

Download

memory/1440-28-0x00000000005F0000-0x00000000006F0000-memory.dmp

Download

memory/1440-30-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/1440-29-0x0000000000560000-0x000000000056B000-memory.dmp

Download

memory/1440-106-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/1788-408-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/1980-171-0x00000000004D0000-0x00000000004DB000-memory.dmp

Download

memory/1980-170-0x0000000000600000-0x0000000000700000-memory.dmp

Download

memory/1980-204-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/1980-172-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/2052-27-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/2052-24-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/2052-15-0x0000000000900000-0x0000000001019000-memory.dmp

Download

memory/2052-23-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/2052-26-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/2052-25-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/2072-195-0x0000000000760000-0x0000000000761000-memory.dmp

Download

memory/2072-44-0x0000000000760000-0x0000000000761000-memory.dmp

Download

memory/2072-168-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/2140-8-0x00000000006F0000-0x00000000006FB000-memory.dmp

Download

memory/2140-1-0x0000000000720000-0x0000000000820000-memory.dmp

Download

memory/2140-3-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/2140-5-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/2140-2-0x00000000006F0000-0x00000000006FB000-memory.dmp

Download

memory/2640-453-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/2640-500-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/2640-478-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/2640-503-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/2640-450-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/2640-510-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/2656-98-0x0000000000400000-0x000000000078E000-memory.dmp

Download

memory/2656-103-0x0000000000400000-0x000000000078E000-memory.dmp

Download

memory/2656-99-0x0000000000400000-0x000000000078E000-memory.dmp

Download

memory/3444-202-0x0000000002F80000-0x0000000002F96000-memory.dmp

Download

memory/3444-102-0x0000000002D90000-0x0000000002DA6000-memory.dmp

Download

memory/3444-4-0x0000000002600000-0x0000000002616000-memory.dmp

Download

memory/3596-35-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3596-167-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3984-160-0x0000000073630000-0x0000000073DE0000-memory.dmp

Download

memory/3984-117-0x0000000000C70000-0x0000000001526000-memory.dmp

Download

memory/3984-116-0x0000000073630000-0x0000000073DE0000-memory.dmp

Download

memory/4208-185-0x0000000000400000-0x000000000078E000-memory.dmp

Download

memory/4208-109-0x0000000000400000-0x000000000078E000-memory.dmp

Download

memory/4208-111-0x0000000000400000-0x000000000078E000-memory.dmp

Download

memory/4208-376-0x0000000000400000-0x000000000078E000-memory.dmp

Download

memory/4208-269-0x0000000000400000-0x000000000078E000-memory.dmp

Download

memory/4208-200-0x0000000000400000-0x000000000078E000-memory.dmp

Download

memory/4208-236-0x0000000000400000-0x000000000078E000-memory.dmp

Download

memory/4320-412-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4320-423-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4320-417-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4320-414-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4320-411-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4320-413-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4840-215-0x0000000002610000-0x0000000002734000-memory.dmp

Download

memory/4840-207-0x00000000024C0000-0x0000000002602000-memory.dmp

Download

memory/4840-187-0x0000000000BB0000-0x0000000000D67000-memory.dmp

Download

memory/4840-188-0x0000000000B30000-0x0000000000B36000-memory.dmp

Download

memory/4840-218-0x0000000002610000-0x0000000002734000-memory.dmp

Download

memory/4840-181-0x0000000000BB0000-0x0000000000D67000-memory.dmp

Download

memory/4840-232-0x0000000002610000-0x0000000002734000-memory.dmp

Download

memory/4940-210-0x0000000003010000-0x0000000003046000-memory.dmp

Download

memory/4940-273-0x0000000007DC0000-0x0000000007DDA000-memory.dmp

Download

memory/4940-272-0x0000000007D70000-0x0000000007D84000-memory.dmp

Download

memory/4940-271-0x0000000007D60000-0x0000000007D6E000-memory.dmp

Download

memory/4940-268-0x0000000007D10000-0x0000000007D21000-memory.dmp

Download

memory/4940-267-0x0000000007DF0000-0x0000000007E86000-memory.dmp

Download

memory/4940-265-0x000000007FCC0000-0x000000007FCD0000-memory.dmp

Download

memory/4940-266-0x0000000007CE0000-0x0000000007CEA000-memory.dmp

Download

memory/4940-262-0x0000000007BF0000-0x0000000007C93000-memory.dmp

Download

memory/4940-260-0x0000000007B90000-0x0000000007BAE000-memory.dmp

Download

memory/4940-250-0x0000000070B70000-0x0000000070EC4000-memory.dmp

Download

memory/4940-249-0x0000000073480000-0x00000000734CC000-memory.dmp

Download

memory/4940-248-0x0000000007BB0000-0x0000000007BE2000-memory.dmp

Download

memory/4940-244-0x00000000079F0000-0x0000000007A0A000-memory.dmp

Download

memory/4940-243-0x0000000008050000-0x00000000086CA000-memory.dmp

Download

memory/4940-242-0x0000000007950000-0x00000000079C6000-memory.dmp

Download

memory/4940-241-0x0000000003190000-0x00000000031A0000-memory.dmp

Download

memory/4940-240-0x0000000007830000-0x0000000007874000-memory.dmp

Download

memory/4940-234-0x0000000006670000-0x00000000066BC000-memory.dmp

Download

memory/4940-233-0x0000000006580000-0x000000000659E000-memory.dmp

Download

memory/4940-231-0x00000000060A0000-0x00000000063F4000-memory.dmp

Download

memory/4940-221-0x0000000006030000-0x0000000006096000-memory.dmp

Download

memory/4940-220-0x0000000005780000-0x00000000057E6000-memory.dmp

Download

memory/4940-219-0x0000000005660000-0x0000000005682000-memory.dmp

Download

memory/4940-212-0x0000000003190000-0x00000000031A0000-memory.dmp

Download

memory/4940-214-0x0000000003190000-0x00000000031A0000-memory.dmp

Download

memory/4940-213-0x0000000005890000-0x0000000005EB8000-memory.dmp

Download

memory/4940-211-0x0000000072790000-0x0000000072F40000-memory.dmp

Download