Malware Analysis Report

2024-10-23 17:17

Sample ID 240910-ep773swdmj
Target ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8
SHA256 ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8
Tags
amadey cryptbot lumma redline stealc @cloudytteam bundle default default2 fed3aa livetraffic credential_access defense_evasion discovery evasion infostealer persistence spyware stealer trojan zharkbot botnet execution
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8

Threat Level: Known bad

The file ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8 was found to be: Known bad.

Malicious Activity Summary

amadey cryptbot lumma redline stealc @cloudytteam bundle default default2 fed3aa livetraffic credential_access defense_evasion discovery evasion infostealer persistence spyware stealer trojan zharkbot botnet execution

Detects ZharkBot payload

Stealc

Amadey

RedLine

Suspicious use of NtCreateUserProcessOtherParentProcess

CryptBot

ZharkBot

Lumma Stealer, LummaC

RedLine payload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Credentials from Password Stores: Credentials from Web Browsers

Downloads MZ/PE file

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Checks BIOS information in registry

Loads dropped DLL

Unsecured Credentials: Credentials In Files

Drops startup file

Checks computer location settings

Indirect Command Execution

Identifies Wine through registry keys

Executes dropped EXE

Reads user/profile data of web browsers

Reads data files stored by FTP clients

Legitimate hosting services abused for malware hosting/C2

Drops desktop.ini file(s)

Indicator Removal: File Deletion

Adds Run key to start application

Accesses cryptocurrency files/wallets, possible credential harvesting

Drops Chrome extension

Checks installed software on the system

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Enumerates processes with tasklist

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Program crash

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Modifies system certificate store

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Suspicious use of SendNotifyMessage

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-10 04:08

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-10 04:08

Reported

2024-09-10 04:10

Platform

win10v2004-20240802-en

Max time kernel

147s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8.exe"

Signatures

Amadey

trojan amadey

CryptBot

spyware stealer cryptbot

Lumma Stealer, LummaC

stealer lumma

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\filen8ame.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\eSxAZ8KNDN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\52qeO4hoCV.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\filename.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\filen8ame.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service123.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\acentric = "\"C:\\Users\\Admin\\Pictures\\Opportunistic Telegraph\\acentric.exe\" /update" C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe N/A

Checks installed software on the system

discovery

Indicator Removal: File Deletion

defense_evasion

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\PrerequisiteCents C:\Users\Admin\AppData\Local\Temp\filen8ame.exe N/A
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8.exe N/A
File created C:\Windows\Tasks\Hkbsse.job C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
File opened for modification C:\Windows\ChipsCounted C:\Users\Admin\AppData\Local\Temp\filen8ame.exe N/A
File opened for modification C:\Windows\MaximizeRepresentative C:\Users\Admin\AppData\Local\Temp\filen8ame.exe N/A
File opened for modification C:\Windows\ChristmasHerbal C:\Users\Admin\AppData\Local\Temp\filen8ame.exe N/A
File opened for modification C:\Windows\LadySquare C:\Users\Admin\AppData\Local\Temp\filen8ame.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\choice.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\filename.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\filen8ame.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\52qeO4hoCV.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\eSxAZ8KNDN.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\eSxAZ8KNDN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\eSxAZ8KNDN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\52qeO4hoCV.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\52qeO4hoCV.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\52qeO4hoCV.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\52qeO4hoCV.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\52qeO4hoCV.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\52qeO4hoCV.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\eSxAZ8KNDN.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\eSxAZ8KNDN.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\eSxAZ8KNDN.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\eSxAZ8KNDN.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\eSxAZ8KNDN.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\eSxAZ8KNDN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\52qeO4hoCV.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1512 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 1512 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 1512 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 1276 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 1276 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 1276 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 924 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 924 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 924 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 924 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 924 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 924 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 924 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 924 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1276 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 1276 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 1276 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 1628 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1628 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1628 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1628 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1628 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1628 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1628 wrote to memory of 3268 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1628 wrote to memory of 3268 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1628 wrote to memory of 3268 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1628 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1628 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1628 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1628 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1628 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1628 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1628 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1628 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1628 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1628 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2360 wrote to memory of 2616 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\eSxAZ8KNDN.exe
PID 2360 wrote to memory of 2616 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\eSxAZ8KNDN.exe
PID 2360 wrote to memory of 2616 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\eSxAZ8KNDN.exe
PID 2360 wrote to memory of 4204 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\52qeO4hoCV.exe
PID 2360 wrote to memory of 4204 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\52qeO4hoCV.exe
PID 2360 wrote to memory of 4204 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\52qeO4hoCV.exe
PID 1276 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 1276 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 1276 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 3512 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 3512 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 3512 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 1276 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 1276 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 1276 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 4048 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe
PID 4048 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe
PID 4048 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe
PID 1276 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe
PID 1276 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe
PID 1276 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe
PID 1276 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 1276 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 1276 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 1276 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 1276 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 1276 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 2888 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8.exe

"C:\Users\Admin\AppData\Local\Temp\ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Roaming\eSxAZ8KNDN.exe

"C:\Users\Admin\AppData\Roaming\eSxAZ8KNDN.exe"

C:\Users\Admin\AppData\Roaming\52qeO4hoCV.exe

"C:\Users\Admin\AppData\Roaming\52qeO4hoCV.exe"

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"

C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe

"C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe"

C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe

"C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe"

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

"C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

C:\Users\Admin\AppData\Local\Temp\service123.exe

"C:\Users\Admin\AppData\Local\Temp\service123.exe"

C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe

"C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"

C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe

"C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f

C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe

"C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\service123.exe

C:\Users\Admin\AppData\Local\Temp\/service123.exe

C:\Users\Admin\AppData\Local\Temp\service123.exe

"C:\Users\Admin\AppData\Local\Temp\service123.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Users\Admin\AppData\Local\Temp\filename.exe

"C:\Users\Admin\AppData\Local\Temp\filename.exe"

C:\Users\Admin\AppData\Local\Temp\filen8ame.exe

"C:\Users\Admin\AppData\Local\Temp\filen8ame.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k move Investigations Investigations.bat & Investigations.bat & exit

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe' -Force

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa opssvc"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 590819

C:\Windows\SysWOW64\findstr.exe

findstr /V "MEDICAIDGROUPSSHARPGOVERNOR" Novels

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b ..\Sheet + ..\Drums + ..\Actually + ..\Mls + ..\Real + ..\Zoophilia + ..\Ah + ..\Opposed + ..\Affiliated y

C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif

Associates.pif y

C:\Windows\SysWOW64\choice.exe

choice /d y /t 5

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"

C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif

C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\service123.exe

C:\Users\Admin\AppData\Local\Temp\/service123.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
RU 185.215.113.117:80 185.215.113.117 tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 117.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
DE 95.179.250.45:26212 tcp
RU 185.215.113.26:80 185.215.113.26 tcp
US 8.8.8.8:53 26.113.215.185.in-addr.arpa udp
FI 65.21.18.51:45580 tcp
RU 185.215.113.26:80 185.215.113.26 tcp
US 8.8.8.8:53 51.18.21.65.in-addr.arpa udp
US 154.216.17.216:80 154.216.17.216 tcp
RU 185.215.113.17:80 185.215.113.17 tcp
US 8.8.8.8:53 216.17.216.154.in-addr.arpa udp
FI 95.216.107.53:12311 tcp
US 8.8.8.8:53 17.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 53.107.216.95.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
DE 95.179.250.45:26212 tcp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 sevtv17pn.top udp
RU 195.133.13.230:80 sevtv17pn.top tcp
US 8.8.8.8:53 230.13.133.195.in-addr.arpa udp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 fivev5sb.top udp
RU 80.249.144.180:80 fivev5sb.top tcp
US 8.8.8.8:53 180.144.249.80.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
RU 80.249.144.180:80 fivev5sb.top tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
RU 80.249.144.180:80 fivev5sb.top tcp
US 8.8.8.8:53 37.56.20.217.in-addr.arpa udp
DE 95.179.250.45:26212 tcp
TM 91.202.233.158:80 91.202.233.158 tcp
CZ 188.124.59.28:443 tcp
US 8.8.8.8:53 158.233.202.91.in-addr.arpa udp
DE 95.179.250.45:26212 tcp
RU 185.215.113.67:15206 tcp
US 8.8.8.8:53 67.113.215.185.in-addr.arpa udp
DE 95.179.250.45:26212 tcp
NL 45.156.25.118:443 tcp
US 8.8.8.8:53 evoto-pc.ru udp
RU 37.140.192.11:443 evoto-pc.ru tcp
US 8.8.8.8:53 11.192.140.37.in-addr.arpa udp
US 8.8.8.8:53 conditionprovice.pro udp
FI 81.19.139.138:443 conditionprovice.pro tcp
RU 185.215.113.19:80 185.215.113.19 tcp
RU 185.215.113.19:80 185.215.113.19 tcp
US 8.8.8.8:53 138.139.19.81.in-addr.arpa udp
US 8.8.8.8:53 19.113.215.185.in-addr.arpa udp
CZ 188.124.59.28:443 tcp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 softonic-pc.ru udp
RU 37.140.192.11:443 softonic-pc.ru tcp
CZ 188.124.59.28:443 tcp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 DGLQIQwMnon.DGLQIQwMnon udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
FR 176.150.119.15:56001 tcp
US 8.8.8.8:53 millyscroqwp.shop udp
US 8.8.8.8:53 locatedblsoqp.shop udp
US 8.8.8.8:53 traineiwnqo.shop udp
US 8.8.8.8:53 condedqpwqm.shop udp
US 8.8.8.8:53 evoliutwoqm.shop udp
US 8.8.8.8:53 stagedchheiqwo.shop udp
US 8.8.8.8:53 stamppreewntnq.shop udp
US 8.8.8.8:53 caffegclasiqwp.shop udp
US 8.8.8.8:53 steamcommunity.com udp
GB 2.22.99.85:443 steamcommunity.com tcp
US 8.8.8.8:53 tenntysjuxmz.shop udp
US 104.21.39.10:443 tenntysjuxmz.shop tcp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 85.99.22.2.in-addr.arpa udp
US 8.8.8.8:53 10.39.21.104.in-addr.arpa udp
DE 95.179.250.45:26212 tcp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 femininedspzmhu.shop udp
US 104.21.66.172:443 femininedspzmhu.shop tcp
US 8.8.8.8:53 172.66.21.104.in-addr.arpa udp
US 8.8.8.8:53 locatedblsoqp.shop udp
US 8.8.8.8:53 traineiwnqo.shop udp
US 8.8.8.8:53 condedqpwqm.shop udp
US 8.8.8.8:53 evoliutwoqm.shop udp
US 8.8.8.8:53 millyscroqwp.shop udp
US 8.8.8.8:53 stagedchheiqwo.shop udp
US 8.8.8.8:53 stamppreewntnq.shop udp
US 8.8.8.8:53 caffegclasiqwp.shop udp
GB 2.22.99.85:443 steamcommunity.com tcp
US 104.21.39.10:443 tenntysjuxmz.shop tcp
FR 176.150.119.15:56002 tcp
DE 95.179.250.45:26212 tcp
DE 95.179.250.45:26212 tcp
DE 95.179.250.45:26212 tcp
FR 176.150.119.15:56003 tcp
DE 95.179.250.45:26212 tcp
DE 95.179.250.45:26212 tcp
DE 95.179.250.45:26212 tcp

Files

memory/1512-0-0x0000000000FB0000-0x0000000001461000-memory.dmp

memory/1512-1-0x0000000077654000-0x0000000077656000-memory.dmp

memory/1512-2-0x0000000000FB1000-0x0000000000FDF000-memory.dmp

memory/1512-3-0x0000000000FB0000-0x0000000001461000-memory.dmp

memory/1512-4-0x0000000000FB0000-0x0000000001461000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

MD5 b4a5d241373c621a7a0d9ba5fac59fb5
SHA1 2f8e03a99f3a1bbcdc7841ae032e07af8b2fb7ac
SHA256 ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8
SHA512 d20d0d0c7ccfbc85a7d6cd7b0303536f3c6facd46fecacd14c87e1f7ab8aeda3d2bfe8dba395f60cf005608f81a928915991407dd4c497f9d08c3aa40b59ec39

memory/1276-18-0x0000000000840000-0x0000000000CF1000-memory.dmp

memory/1512-17-0x0000000000FB0000-0x0000000001461000-memory.dmp

memory/1276-19-0x0000000000841000-0x000000000086F000-memory.dmp

memory/1276-20-0x0000000000840000-0x0000000000CF1000-memory.dmp

memory/1276-21-0x0000000000840000-0x0000000000CF1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

MD5 2d647cf43622ed10b6d733bb5f048fc3
SHA1 6b9c5f77a9ef064a23e5018178f982570cbc64c6
SHA256 41426dd54fcabbf30a68b2aa11aa4f61f3862bea83109d3e3c50cfebed1359e6
SHA512 62400f1e9646268f0326aab5b95efacb0303f4c5879cccf0cbb24d1f66d0db40d0fdfebb09ba785b5dfd54df2d32e8aab48c1f5f333956b606112de68635ac3a

memory/924-42-0x000000007326E000-0x000000007326F000-memory.dmp

memory/924-43-0x0000000000AD0000-0x0000000000B24000-memory.dmp

memory/1852-45-0x0000000000400000-0x0000000000452000-memory.dmp

memory/1852-47-0x0000000005750000-0x0000000005CF4000-memory.dmp

memory/1852-48-0x00000000051A0000-0x0000000005232000-memory.dmp

memory/1852-49-0x0000000005240000-0x000000000524A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TmpE290.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

memory/1852-66-0x0000000005F00000-0x0000000005F76000-memory.dmp

memory/1852-67-0x0000000006590000-0x00000000065AE000-memory.dmp

memory/1852-70-0x0000000006F20000-0x0000000007538000-memory.dmp

memory/1852-71-0x00000000087A0000-0x00000000088AA000-memory.dmp

memory/1852-72-0x0000000006E20000-0x0000000006E32000-memory.dmp

memory/1852-73-0x0000000006E80000-0x0000000006EBC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

MD5 8e74497aff3b9d2ddb7e7f819dfc69ba
SHA1 1d18154c206083ead2d30995ce2847cbeb6cdbc1
SHA256 d8e81d9e336ef37a37cae212e72b6f4ef915db4b0f2a8df73eb584bd25f21e66
SHA512 9aacc5c130290a72f1087daa9e79984565ccab6dbcad5114bfed0919812b9ba5f8dee9c37d230eeca4df3cca47ba0b355fbf49353e53f10f0ebc266e93f49f97

memory/1852-82-0x0000000006EC0000-0x0000000006F0C000-memory.dmp

memory/1628-93-0x0000000000D40000-0x0000000000E52000-memory.dmp

memory/2360-95-0x0000000000400000-0x000000000050D000-memory.dmp

memory/2360-97-0x0000000000400000-0x000000000050D000-memory.dmp

memory/2360-99-0x0000000000400000-0x000000000050D000-memory.dmp

memory/2360-100-0x0000000000400000-0x000000000050D000-memory.dmp

C:\Users\Admin\AppData\Roaming\eSxAZ8KNDN.exe

MD5 88367533c12315805c059e688e7cdfe9
SHA1 64a107adcbac381c10bd9c5271c2087b7aa369ec
SHA256 c6fc5c06ad442526a787989bae6ce0d32a2b15a12a41f78baca336b6560997a9
SHA512 7a8c3d767d19395ce9ffef964b0347a148e517982afcf2fc5e45b4c524fd44ec20857f6be722f57ff57722b952ef7b88f6249339551949b9e89cf60260f0a714

C:\Users\Admin\AppData\Roaming\52qeO4hoCV.exe

MD5 30f46f4476cdc27691c7fdad1c255037
SHA1 b53415af5d01f8500881c06867a49a5825172e36
SHA256 3a8f5f6951dad3ba415b23b35422d3c93f865146da3ccf7849b75806e0b67ce0
SHA512 271aadb524e94ed1019656868a133c9e490cc6f8e4608c8a41c29eff7c12de972895a01f171e8f625d07994ff3b723bb308d362266f96cb20dff82689454c78f

memory/2360-120-0x0000000000400000-0x000000000050D000-memory.dmp

memory/4204-123-0x0000000000F30000-0x0000000000F82000-memory.dmp

memory/2616-125-0x0000000000780000-0x000000000080E000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-355097885-2402257403-2971294179-1000\76b53b3ec448f7ccdda2063b15d2bfc3_30dd1cc1-5c25-4745-b2f5-cffa52b1a886

MD5 83770738437d6bbf279aa270ea854b39
SHA1 65db40b478598901a29042ac097a5df9b4628608
SHA256 4d05ee8b57f2876e2fa548d0b347e80ff94f5a0e51fd2923b5dffb64050cadef
SHA512 1044de6b06fe07ab115adf312c935acaec9c974ab5645387ac34c2e1af3b7c5150634223003a7133ccbdf562e4cf2368db24e7a33b7ffcd259e0b868f927d2c0

C:\Users\Public\Desktop\Google Chrome.lnk

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Public\Desktop\Microsoft Edge.lnk

MD5 1a97a99a3330aeb139954a424954d22b
SHA1 164701c702e5fc3b323f0042b37f953e06b32c06
SHA256 beb31b9e738eeee834b1d5920f461b179cb21c136c97db08fae6cb13de25790a
SHA512 1e01585de8c3dde88e87bcd444ccf430fa0734ec4bc2dfc2642b2da909ad0a38345ba4bf6e39ba151eeece4c1c3c159f6ebc5bbec31fbe27cc96c3bf331ccc7f

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

MD5 f5d7b79ee6b6da6b50e536030bcc3b59
SHA1 751b555a8eede96d55395290f60adc43b28ba5e2
SHA256 2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
SHA512 532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

memory/1276-162-0x0000000000840000-0x0000000000CF1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

MD5 7a02aa17200aeac25a375f290a4b4c95
SHA1 7cc94ca64268a9a9451fb6b682be42374afc22fd
SHA256 836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
SHA512 f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

memory/2760-188-0x0000000000360000-0x00000000005A3000-memory.dmp

memory/1276-190-0x0000000000840000-0x0000000000CF1000-memory.dmp

memory/2616-193-0x00000000089B0000-0x0000000008A16000-memory.dmp

memory/2616-194-0x0000000009B30000-0x0000000009CF2000-memory.dmp

memory/2616-195-0x000000000A230000-0x000000000A75C000-memory.dmp

memory/1276-196-0x0000000000840000-0x0000000000CF1000-memory.dmp

memory/1276-197-0x0000000000840000-0x0000000000CF1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe

MD5 651269f574a059288d0e78b28438a430
SHA1 a22a0fb4669672d2f602d12d2f7a09d91ed6accb
SHA256 feb98395aab41886938dc9f25716097f13792a09af42e22214d862002d82886d
SHA512 d53bc56518f034000c63cc8b692fa55e4902c140bb0b0fc17e693b7a615388d49cd61c5eebd54c024c6708bf7ba345fadfd269c1eb1b3543474a078308b854d7

memory/2760-208-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/4204-220-0x0000000007F70000-0x0000000007FC0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe

MD5 45b55d1e5d2bf60cc572f541ae6fa7d1
SHA1 2329f56147a299bcdbf20520e626cc8253e49a8d
SHA256 039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8
SHA512 5483964e050b2be073d3cf966b6dd6271556d4adfb420fb9ecf81f42f27cd06727016292dceb9a282f9fdcb451507309d1a78f58dd5d84e3022c0ea20c58dbe2

memory/1276-275-0x0000000000840000-0x0000000000CF1000-memory.dmp

memory/5032-276-0x0000000000400000-0x000000000106A000-memory.dmp

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/4524-289-0x0000000000400000-0x0000000001069000-memory.dmp

memory/1276-302-0x0000000000840000-0x0000000000CF1000-memory.dmp

memory/2760-303-0x0000000000360000-0x00000000005A3000-memory.dmp

memory/5032-304-0x0000000000400000-0x000000000106A000-memory.dmp

memory/4524-307-0x0000000000400000-0x0000000001069000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

MD5 7e6a519688246fe1180f35fe0d25d370
SHA1 8e8719ac897dfef7305311dc216f570af40709af
SHA256 32a927e9b33371b82bae9f02b5ebf07c19ae5a3a7e3c0cd3fcbee7cfff7f257a
SHA512 a751e911eb254749a3c8c98740f455a5be32ce1af94dc90eba8fc677d6d7379303f80247748dfcfe9c8570edb3488a5af97fa7ff29c815bec6824dd491e27972

memory/1276-326-0x0000000000840000-0x0000000000CF1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

MD5 0faa6e1a78e6bb809eb5a7cdcdf68e17
SHA1 f1ba39e702710365c345ab034bcd1a6d5ec8d4ad
SHA256 9d6966889f6ec503ae2bd99c666b55429d1835e538e1ac15f06c3524241c0c92
SHA512 261cd43b42ccbe7b6b393d454270dd22110c062632707f73bf045f91aee0f09b4387cac8ba7a9275b1ddaa427240606f654f74224fe6fcd38c8ae40b3c4f8ee7

memory/3684-346-0x00000000028D0000-0x0000000002DF5000-memory.dmp

memory/2392-351-0x0000000000400000-0x0000000000643000-memory.dmp

memory/3684-355-0x000000006E600000-0x000000006E69D000-memory.dmp

memory/3684-354-0x0000000063280000-0x00000000634BE000-memory.dmp

memory/2392-353-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2888-352-0x0000000000400000-0x000000000079D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

MD5 b826dd92d78ea2526e465a34324ebeea
SHA1 bf8a0093acfd2eb93c102e1a5745fb080575372e
SHA256 7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
SHA512 1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

memory/2392-348-0x0000000000400000-0x0000000000643000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe

MD5 30daa686c1f31cc4833bd3d7283d8cdc
SHA1 70f74571fafe1b359cfe9ce739c3752e35d16cf5
SHA256 504518e3b4f3abc7f1ae1bf205fdc4a9f739e05b5e84618bae9c7e66bdc19822
SHA512 9f6c0eea9f03f9aa35ebf27ce8264e41d9072d273d1b8a35415ae4666d31013d895d1108dd67e36910200e2ac4fc45a4a9d761a1aadf02b0fd29ef93cd20a4d9

memory/3684-375-0x00000000028D0000-0x0000000002DF5000-memory.dmp

memory/3684-378-0x00000000028D0000-0x0000000002DF5000-memory.dmp

memory/3684-377-0x00000000028D0000-0x0000000002DF5000-memory.dmp

memory/3684-376-0x00000000028D0000-0x0000000002DF5000-memory.dmp

memory/3684-373-0x00000000028D0000-0x0000000002DF5000-memory.dmp

memory/4256-381-0x0000000000E60000-0x0000000000EB2000-memory.dmp

memory/2392-400-0x0000000000400000-0x0000000000643000-memory.dmp

C:\Users\Public\Desktop\Google Chrome.lnk

MD5 5b28a99e346b15e18efd6ffaf964fffe
SHA1 37fe6cead5d3da7837a27cfcea09aadd712ce09a
SHA256 08af6cdf7f718f41b10f4a6a3cf0adc2fd5386a6630694c8eeb52c92bb9ac368
SHA512 636b21cb3d13de3462100cee70d704f96e5f223ec8e793dc4e8ca40f24cb5d90c3acafed63d11f5ebf4d7536d99017e7598475e7e8c82519622315d7dc72d676

C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe

MD5 37d198ad751d31a71acc9cb28ed0c64e
SHA1 8eb519b7a6df66d84c566605da9a0946717a921d
SHA256 1ed4a8b4c74aab435ea5cd459d5ac961e5a8ca28924801bd84d336135f30efde
SHA512 60923c0a8ce5fd397d49749ccee68ca3fe294d7323551ce9755410ac16bfff56a35bee3e6b9a67d57cdfcb43e4f164712f33cd255b76689174dcf4c475976c96

memory/4348-422-0x0000000000DB0000-0x0000000000DC1000-memory.dmp

memory/5032-425-0x0000000000400000-0x000000000106A000-memory.dmp

memory/4396-426-0x0000000000210000-0x0000000000288000-memory.dmp

memory/1276-428-0x0000000000840000-0x0000000000CF1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe

MD5 03b1ed4c105e5f473357dad1df17cf98
SHA1 faf5046ff19eafd3a59dcf85be30496f90b5b6b1
SHA256 6be5916900ffda93154db8c2c5dd28b9150f4c3aef74dbd4fd86390bc72845ba
SHA512 3f6f8a12d000b913dc8240542be6a64f991dc0802313782d038b971219308e7d381d4d96c25d98ee1b05bca127a9bbc69e3bd54f1722d8381f8060bb506a9765

memory/3368-447-0x00000275455B0000-0x0000027545710000-memory.dmp

memory/3368-448-0x000002755FB10000-0x000002755FC3A000-memory.dmp

memory/3368-449-0x000002755FD90000-0x000002755FEBC000-memory.dmp

memory/3368-453-0x000002755FD90000-0x000002755FEB5000-memory.dmp

memory/3368-461-0x000002755FD90000-0x000002755FEB5000-memory.dmp

memory/3368-467-0x000002755FD90000-0x000002755FEB5000-memory.dmp

memory/3368-465-0x000002755FD90000-0x000002755FEB5000-memory.dmp

memory/3368-463-0x000002755FD90000-0x000002755FEB5000-memory.dmp

memory/3368-459-0x000002755FD90000-0x000002755FEB5000-memory.dmp

memory/3368-455-0x000002755FD90000-0x000002755FEB5000-memory.dmp

memory/3368-457-0x000002755FD90000-0x000002755FEB5000-memory.dmp

memory/3368-451-0x000002755FD90000-0x000002755FEB5000-memory.dmp

memory/3368-450-0x000002755FD90000-0x000002755FEB5000-memory.dmp

memory/404-1080-0x0000000000840000-0x0000000000CF1000-memory.dmp

memory/3368-1530-0x0000027560070000-0x00000275600BC000-memory.dmp

memory/3368-1529-0x000002755FFC0000-0x0000027560064000-memory.dmp

memory/404-1535-0x0000000000840000-0x0000000000CF1000-memory.dmp

memory/4396-1542-0x00000000078F0000-0x000000000790A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\550978852402

MD5 88f7fe768951850ec8970e931cf902f5
SHA1 14b1af049317b2df714c45c6678011e46b255539
SHA256 9dfc1f1a4d75b4e7516dfb2d1fa27525c493a4b37b837685e10322b029395c43
SHA512 0714ace70289dd62269698252c5bd22ddf2db6e672e20f7548b9eb5b3f7e9211042ea19794857a37de97e6a89419a1aaabfe25857593d6d709549a5db17c0a65

C:\Users\Admin\AppData\Local\Temp\filename.exe

MD5 36a627b26fae167e6009b4950ff15805
SHA1 f3cb255ab3a524ee05c8bab7b4c01c202906b801
SHA256 a2389de50f83a11d6fe99639fc5c644f6d4dcea6834ecbf90a4ead3d5f36274a
SHA512 2133aba3e2a41475b2694c23a9532c238abab0cbae7771de83f9d14a8b2c0905d44b1ba0b1f7aae501052f4eba0b6c74018d66c3cbc8e8e3443158438a621094

C:\Users\Admin\AppData\Local\Temp\filen8ame.exe

MD5 0885bc5d9c2aa1895ebd5fcad13b53be
SHA1 ad559563e4e21cb7354a4692b31852839b0b22d7
SHA256 b7763f18a43e9727036d685576fe102901f45fd1b9407395bbc10966a9811d25
SHA512 91c73e9a3a74624dad400c0c5b7670b977946a06344782ca859be70578e64c2f0d4fdb3eadb70821168c64929a8bfe16a18fb10ba65bcd80e14701ef8c05091f

C:\Users\Admin\AppData\Local\Temp\Investigations

MD5 993e7c77985a64987f81795903f4ec4e
SHA1 9daf8b58d2aea92416b4b26d4a8c644bff2c1073
SHA256 18aedca1669442af85f543f052feef6b2d70ee3f191f391930c053d1476cda76
SHA512 26d2518beb0716227cacb6e5f89643b3a8ea7a095dbe741873e274fbb18de4da335dc99ca01951a7db448e5ddc29c85af895ec57f9378cec9851815648d83a5d

memory/3368-1602-0x0000027560970000-0x00000275609C4000-memory.dmp

memory/5352-1606-0x0000022F6CC50000-0x0000022F6CD0C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rern3xys.tho.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5456-1612-0x00000235EF1F0000-0x00000235EF212000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Novels

MD5 fe6b3945c0591e11b27ce50ae5aa2ae5
SHA1 42eb0951d03f96f1be9dfd7fd3c76366c7dee311
SHA256 2dd13bc773aee2738563910e316684b0cf646991fd67581dd4e129a525153af0
SHA512 adff777db68feed90a6c5de04abf23e2b17f4b0bc9fd0e99cf10773ad159cf4e3cfc82f1bba9799c8e73dea613d392261e8c8be46174d0ce51672492eb6ad3f4

C:\Users\Admin\AppData\Local\Temp\Tba

MD5 02dfbccdf45d9f79a8e3b9eadc7c66d2
SHA1 00e7fdbb4466c86ca5dc6cf05623cccf52cce76c
SHA256 ca236e42a79212c9fcab28217df569fc8d3875ef81e206e869b92525d9ede547
SHA512 dc5d3fcc04b1d2b8fad3bd824b899f9a58bed18a708cb3df70c0822ae493dc6ba6f04bd3b57e049e749ea64c21fcd7f78c75b1c6330f0cdde6f70d7b1beb5df0

C:\Users\Admin\AppData\Local\Temp\Actually

MD5 f5218581f47d5d88efb244c2528e9388
SHA1 2c925494f15dd8854b0ff25292e64dba075afc8a
SHA256 446596953913b5ff8e1f4909cdd68e4740a21948b8da28b2223abd731f38f3cf
SHA512 16f7b5fb8dfb306be93036697ad4b18679b6bdcf9b936e3b4ede15c39a80901a2244b7854c9beeab0a8cf25df2c106d127d8977523b54140ac75a241e823720a

C:\Users\Admin\AppData\Local\Temp\Zoophilia

MD5 bbb3a963db3a77c65e1419c6bb3c9992
SHA1 1fee713d2465910ae9740bfea48a471984ba0b54
SHA256 1a4c358cb704b6d3960e9af1dce1b87aa69e41ce590f1477f5d7ef9dd8ddeeec
SHA512 980e8898090779eeb14a27af28239656b219e2ef50275914d98757c368c5878b0bfe5ffa0b102f67fdeecfb618cd857566c67c392eb09538db492e9c5dd738a3

C:\Users\Admin\AppData\Local\Temp\Affiliated

MD5 5a4bb3b58f5344ea0b6ac99794a1a409
SHA1 956ac766f4faf5a8fe38b2fa11fd64832b588ea6
SHA256 3f6a1e674de512477ff87efaa39a6d0158f1a394da442018f2cae16499a67164
SHA512 06460ab54d087095ae5c925f5826aaf23a1012a0dad8ff50615ab9d7bc3851aa794d826d883269717484aac4686f0263c284c27986e5440eaae2c371afa76561

C:\Users\Admin\AppData\Local\Temp\Opposed

MD5 79e8c0f3c8585392970467fba71bdc5c
SHA1 43871ae11904c036fd72e5452274b6dd33e6e4ce
SHA256 c8497414d50438b6eeace3a0402f01e7d8583415daee5466f3f46ac82e55c27f
SHA512 c9b52232b1b416e2d1fc9a2cc28089748f1f27fdd06bd441e1434f665d8422c6161d5fc4148ce3edb20a6106eace041eb819fe2b962fc7411e03994549b27816

C:\Users\Admin\AppData\Local\Temp\Ah

MD5 fdec53e5fc2b73fc6f3f2cebc7e7d581
SHA1 32be33cddaf6888589e6f579ba74553e682cb05d
SHA256 2c846b30ded9be840eb62fe5f6ee78a715bbb27c8c5f13cf7ce7526fd8505278
SHA512 373b289677a94955293f0a6cdfcea1c45f11034c939e5e8eee4a4e28cc3e3e12a5eff9e9d1fa1360e3e2ffd9b452428f3b62621133a3eb7386437840c1c9efd2

C:\Users\Admin\AppData\Local\Temp\Real

MD5 000b4fa86996cb0beda88a400f07f96f
SHA1 30167f5da3bfb8f99973e347f5548325c8821954
SHA256 2be9420210278b027501f7edb4e8356b00550eb01d94aab082b472fab08dc5c3
SHA512 b483f78ae03c5fd2ec95a8599a676bde4096d710b51e486db68bb8fb3180a478b2536abac9ab54b733867705cfcac7fc16eb8d34cc519fcd6756b131fdb7183e

C:\Users\Admin\AppData\Local\Temp\Mls

MD5 f387e0af272b3534f962510925697544
SHA1 2e5fddc860f180d204283ae3d8b7479a73edb7dd
SHA256 076a4be5c1e943bc223adf4eb30f7543911dce2517c305af1df5f0ab012626e0
SHA512 3326c69a65fc163eecf95950cfffbcca800b85c9ba99da3c921c1e54c9bd116f87302a52dade84a8af957d6182db6973e67a02359fd7c8c317c4329e511ec3e9

C:\Users\Admin\AppData\Local\Temp\Drums

MD5 eddfe1bd56d718737082e26b663c5344
SHA1 19751b4253e62d8995fbf7c16686aa9a78045091
SHA256 06969d045e1dedd05bf352e08e66d6b72faca7b0d6cb7a20e3a815b04aec4794
SHA512 d6b8dc233eca6cd4dd8ecda267e80096e152840acd4e47ea8ab0c081fa37e17ad4aa507882aee7bb8e70000fdb46905726243e14d02987440386c1fcd9c3d8db

C:\Users\Admin\AppData\Local\Temp\Sheet

MD5 a333bb92009ef81ed7e36eb059292f7c
SHA1 bd95783b66230cbbdd65668a99dbe2aaa7bf6dff
SHA256 0241ad4bc5a549ba937fc9cde1cc4e8c01bc0ac59940611393bd2573649bc391
SHA512 3f5cf884e21d3cdabcf3cd292cdead32d521ccc9ddefedb91f88ba89d903baaa7c89b21d0992a451e6b63a7632bdb92c3ee27adddd3c69d6e9fc97b2bf04ec9d

memory/4132-1662-0x0000000000840000-0x0000000000CF1000-memory.dmp

memory/4132-1664-0x0000000000840000-0x0000000000CF1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-10 04:08

Reported

2024-09-10 04:10

Platform

win11-20240802-en

Max time kernel

150s

Max time network

150s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

CryptBot

spyware stealer cryptbot

Detects ZharkBot payload

Description Indicator Process Target
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

ZharkBot

botnet zharkbot

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000223001\20177efa39.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000223001\20177efa39.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000223001\20177efa39.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7zSB63B.tmp\Install.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Control Panel\International\Geo\Nation C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\UCBkLFNPpU.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\3emywNfx5k.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000169001\contorax.exe N/A
N/A N/A C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000172001\3546345.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000220001\crypteda.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\hzrP2La2Dq.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\rlk1lTODgV.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000221001\exbuild.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000223001\20177efa39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\filename.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000256001\BowExpert.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\filen8ame.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000262001\385107.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSB476.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSB63B.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000268001\kitty.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000296001\Channel3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000305001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000308001\freedom.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSB63B.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000223001\20177efa39.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Subsystem Framework = "\"C:\\ProgramData\\Microsoft Subsystem Framework\\winmsbt.exe\"" C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\acentric = "\"C:\\Users\\Admin\\Pictures\\Opportunistic Telegraph\\acentric.exe\" /update" C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\acentric = "\"C:\\Users\\Admin\\Pictures\\Opportunistic Telegraph\\acentric.exe\" /update" C:\Users\Admin\AppData\Local\Temp\1000305001\acentric.exe N/A

Checks installed software on the system

discovery

Drops Chrome extension

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini C:\Users\Admin\AppData\Local\Temp\7zSB63B.tmp\Install.exe N/A

Indicator Removal: File Deletion

defense_evasion

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\54E176903A096E58E807B60E1BDFA85C C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_2F09F384AB04F931E2EF39FD04145E2F C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\54E176903A096E58E807B60E1BDFA85C C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_2E1554F9937BF8D3743D83D919742174 C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_5F8ABD199E1CF2EB9B30F8FD50D3DB0D C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\system32\GroupPolicy\gpt.ini C:\Users\Admin\AppData\Local\Temp\7zSB63B.tmp\Install.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_2E1554F9937BF8D3743D83D919742174 C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol C:\Users\Admin\AppData\Local\Temp\7zSB63B.tmp\Install.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199 C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_2F09F384AB04F931E2EF39FD04145E2F C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_5F8ABD199E1CF2EB9B30F8FD50D3DB0D C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199 C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\omni.ja.bak C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File created C:\Program Files (x86)\wSZJZbJpuTjU2\kHGyvmSxTZLwJ.dll C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File created C:\Program Files (x86)\IrvirPnzqtUn\vPqlrDD.dll C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File created C:\Program Files (x86)\XzdfbzSXU\HymxZw.dll C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File created C:\Program Files (x86)\paIbpfUydXCFOQSEXSR\oKaxxzv.dll C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File created C:\Program Files (x86)\rpffIYXEsifWC\wudRSmc.xml C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja.bak C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File created C:\Program Files (x86)\XzdfbzSXU\YzSFFKT.xml C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File created C:\Program Files (x86)\wSZJZbJpuTjU2\eisTiTI.xml C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File created C:\Program Files (x86)\paIbpfUydXCFOQSEXSR\cuFHQcN.xml C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
File created C:\Program Files (x86)\rpffIYXEsifWC\jxmReHp.dll C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\bEiqjeuJfUHunPLypv.job C:\Windows\SysWOW64\schtasks.exe N/A
File created C:\Windows\Tasks\XKQENCkpUFIDpLLmU.job C:\Windows\SysWOW64\schtasks.exe N/A
File created C:\Windows\Tasks\tabOZhFmbQZymAa.job C:\Windows\SysWOW64\schtasks.exe N/A
File created C:\Windows\Tasks\Hkbsse.job C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
File opened for modification C:\Windows\ChipsCounted C:\Users\Admin\AppData\Local\Temp\filen8ame.exe N/A
File opened for modification C:\Windows\MaximizeRepresentative C:\Users\Admin\AppData\Local\Temp\filen8ame.exe N/A
File opened for modification C:\Windows\ChristmasHerbal C:\Users\Admin\AppData\Local\Temp\filen8ame.exe N/A
File opened for modification C:\Windows\PrerequisiteCents C:\Users\Admin\AppData\Local\Temp\filen8ame.exe N/A
File created C:\Windows\Tasks\pbtPycclcJoyVPHqg.job C:\Windows\SysWOW64\schtasks.exe N/A
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8.exe N/A
File opened for modification C:\Windows\LadySquare C:\Users\Admin\AppData\Local\Temp\filen8ame.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\gpupdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\choice.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\UCBkLFNPpU.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000268001\kitty.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000172001\3546345.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\filename.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\forfiles.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\forfiles.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\684126\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\gpupdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000262001\385107.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000308001\freedom.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000221001\exbuild.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\gpupdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000296001\Channel3.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000296001\Channel3.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\7zSB63B.tmp\Install.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Users\Admin\AppData\Local\Temp\7zSB63B.tmp\Install.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Windows\SysWOW64\rundll32.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Users\Admin\AppData\Local\Temp\7zSB63B.tmp\Install.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{0e100a70-0000-0000-0000-d01200000000} C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{0e100a70-0000-0000-0000-d01200000000}\NukeOnDelete = "0" C:\Users\Admin\AppData\Local\Temp\7zSB63B.tmp\Install.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket C:\Users\Admin\AppData\Local\Temp\7zSB63B.tmp\Install.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume C:\Users\Admin\AppData\Local\Temp\7zSB63B.tmp\Install.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\UCBkLFNPpU.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\3emywNfx5k.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\3emywNfx5k.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\3emywNfx5k.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\3emywNfx5k.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\3emywNfx5k.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000223001\20177efa39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000223001\20177efa39.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\hzrP2La2Dq.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\rlk1lTODgV.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\rlk1lTODgV.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\UCBkLFNPpU.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\UCBkLFNPpU.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\UCBkLFNPpU.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\UCBkLFNPpU.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\UCBkLFNPpU.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\UCBkLFNPpU.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\3emywNfx5k.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000169001\contorax.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\hzrP2La2Dq.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\hzrP2La2Dq.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\hzrP2La2Dq.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\hzrP2La2Dq.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\hzrP2La2Dq.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\hzrP2La2Dq.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\rlk1lTODgV.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2432 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 2432 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 2432 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 2876 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 2876 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 2876 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 2564 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2564 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2564 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2564 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2564 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2564 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2564 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2564 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2876 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 2876 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 2876 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 1420 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1420 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1420 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1420 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1420 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1420 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1420 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1420 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1420 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1420 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3884 wrote to memory of 4828 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\UCBkLFNPpU.exe
PID 3884 wrote to memory of 4828 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\UCBkLFNPpU.exe
PID 3884 wrote to memory of 4828 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\UCBkLFNPpU.exe
PID 3884 wrote to memory of 3060 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\3emywNfx5k.exe
PID 3884 wrote to memory of 3060 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\3emywNfx5k.exe
PID 3884 wrote to memory of 3060 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\3emywNfx5k.exe
PID 2876 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 2876 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 2876 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 5068 wrote to memory of 4104 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 5068 wrote to memory of 4104 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 5068 wrote to memory of 4104 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 2876 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 2876 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 2876 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 2876 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe
PID 2876 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe
PID 2876 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe
PID 2876 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 2876 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 2876 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 4104 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe
PID 4104 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe
PID 4104 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe
PID 4972 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 4972 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 4972 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 4972 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 4972 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 4972 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 4972 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 4972 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 2876 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 2876 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 2876 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 2876 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe
PID 2876 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8.exe

"C:\Users\Admin\AppData\Local\Temp\ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Roaming\UCBkLFNPpU.exe

"C:\Users\Admin\AppData\Roaming\UCBkLFNPpU.exe"

C:\Users\Admin\AppData\Roaming\3emywNfx5k.exe

"C:\Users\Admin\AppData\Roaming\3emywNfx5k.exe"

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"

C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe

"C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe"

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

"C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"

C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe

"C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe"

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"

C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe

"C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"

C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe

"C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe"

C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe

"C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Users\Admin\AppData\Local\Temp\1000169001\contorax.exe

"C:\Users\Admin\AppData\Local\Temp\1000169001\contorax.exe"

C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe

"C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe"

C:\Users\Admin\AppData\Local\Temp\service123.exe

"C:\Users\Admin\AppData\Local\Temp\service123.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\1000172001\3546345.exe

"C:\Users\Admin\AppData\Local\Temp\1000172001\3546345.exe"

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\1000220001\crypteda.exe

"C:\Users\Admin\AppData\Local\Temp\1000220001\crypteda.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Roaming\hzrP2La2Dq.exe

"C:\Users\Admin\AppData\Roaming\hzrP2La2Dq.exe"

C:\Users\Admin\AppData\Roaming\rlk1lTODgV.exe

"C:\Users\Admin\AppData\Roaming\rlk1lTODgV.exe"

C:\Users\Admin\AppData\Local\Temp\service123.exe

"C:\Users\Admin\AppData\Local\Temp\service123.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f

C:\Users\Admin\AppData\Local\Temp\1000221001\exbuild.exe

"C:\Users\Admin\AppData\Local\Temp\1000221001\exbuild.exe"

C:\Users\Admin\AppData\Local\Temp\1000223001\20177efa39.exe

"C:\Users\Admin\AppData\Local\Temp\1000223001\20177efa39.exe"

C:\Users\Admin\AppData\Local\Temp\filename.exe

"C:\Users\Admin\AppData\Local\Temp\filename.exe"

C:\Users\Admin\AppData\Local\Temp\1000256001\BowExpert.exe

"C:\Users\Admin\AppData\Local\Temp\1000256001\BowExpert.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k move Luck Luck.bat & Luck.bat & exit

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa opssvc"

C:\Users\Admin\AppData\Local\Temp\filen8ame.exe

"C:\Users\Admin\AppData\Local\Temp\filen8ame.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k move Investigations Investigations.bat & Investigations.bat & exit

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 684126

C:\Windows\SysWOW64\findstr.exe

findstr /V "VegetablesIndividualBindingGba" Ever

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b ..\Wire + ..\Qualified + ..\Manufacturers + ..\Wesley + ..\Haiti + ..\Done + ..\Drop + ..\Runner + ..\Defend + ..\Judy + ..\Dow C

C:\Users\Admin\AppData\Local\Temp\684126\Intake.pif

Intake.pif C

C:\Windows\SysWOW64\choice.exe

choice /d y /t 5

C:\Windows\SysWOW64\cmd.exe

cmd /c schtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /F

C:\Windows\SysWOW64\cmd.exe

cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url" & echo URL="C:\Users\Admin\AppData\Local\SecureData Technologies\TurtleHarbor.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url" & exit

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /F

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa opssvc"

C:\Users\Admin\AppData\Local\Temp\1000262001\385107.exe

"C:\Users\Admin\AppData\Local\Temp\1000262001\385107.exe"

C:\Users\Admin\AppData\Local\Temp\7zSB476.tmp\Install.exe

.\Install.exe

C:\Users\Admin\AppData\Local\Temp\7zSB63B.tmp\Install.exe

.\Install.exe /RVsWdidvDs "385107" /S

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\cmd.exe

cmd /c md 590819

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\findstr.exe

findstr /V "MEDICAIDGROUPSSHARPGOVERNOR" Novels

C:\Users\Admin\AppData\Local\Temp\1000268001\kitty.exe

"C:\Users\Admin\AppData\Local\Temp\1000268001\kitty.exe"

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b ..\Sheet + ..\Drums + ..\Actually + ..\Mls + ..\Real + ..\Zoophilia + ..\Ah + ..\Opposed + ..\Affiliated y

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5904 -ip 5904

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5904 -s 508

C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif

Associates.pif y

C:\Windows\SysWOW64\choice.exe

choice /d y /t 5

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe' -Force

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m help.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"

C:\Windows\SysWOW64\cmd.exe

/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\Wbem\WMIC.exe

"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "bEiqjeuJfUHunPLypv" /SC once /ST 04:10:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSB63B.tmp\Install.exe\" ld /dzndidE 385107 /S" /V1 /F

C:\Users\Admin\AppData\Local\Temp\1000296001\Channel3.exe

"C:\Users\Admin\AppData\Local\Temp\1000296001\Channel3.exe"

C:\Users\Admin\AppData\Local\Temp\1000305001\acentric.exe

"C:\Users\Admin\AppData\Local\Temp\1000305001\acentric.exe"

C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe

"C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe"

C:\Users\Admin\AppData\Local\Temp\1000308001\freedom.exe

"C:\Users\Admin\AppData\Local\Temp\1000308001\freedom.exe"

C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif

C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif

C:\Users\Admin\AppData\Local\Temp\684126\RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\684126\RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\684126\RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\684126\RegAsm.exe

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Users\Admin\AppData\Local\Temp\7zSB63B.tmp\Install.exe

C:\Users\Admin\AppData\Local\Temp\7zSB63B.tmp\Install.exe ld /dzndidE 385107 /S

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Users\Admin\AppData\Local\Temp\service123.exe

C:\Users\Admin\AppData\Local\Temp\/service123.exe

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\IrvirPnzqtUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\IrvirPnzqtUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\XzdfbzSXU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\XzdfbzSXU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\paIbpfUydXCFOQSEXSR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\paIbpfUydXCFOQSEXSR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rpffIYXEsifWC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rpffIYXEsifWC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\wSZJZbJpuTjU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\wSZJZbJpuTjU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\PUTDAnRtyjWVGhVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\PUTDAnRtyjWVGhVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\YvqfOxNMInRmMKRLj\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\YvqfOxNMInRmMKRLj\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\BQNzqhxBfHqWtlDw\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\BQNzqhxBfHqWtlDw\" /t REG_DWORD /d 0 /reg:64;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IrvirPnzqtUn" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IrvirPnzqtUn" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IrvirPnzqtUn" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XzdfbzSXU" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XzdfbzSXU" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\paIbpfUydXCFOQSEXSR" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\paIbpfUydXCFOQSEXSR" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rpffIYXEsifWC" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rpffIYXEsifWC" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wSZJZbJpuTjU2" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wSZJZbJpuTjU2" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\PUTDAnRtyjWVGhVB /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\PUTDAnRtyjWVGhVB /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\YvqfOxNMInRmMKRLj /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\YvqfOxNMInRmMKRLj /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\BQNzqhxBfHqWtlDw /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\BQNzqhxBfHqWtlDw /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "gBgyJsKDt" /SC once /ST 02:08:16 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "gBgyJsKDt"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==

C:\Windows\system32\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc

C:\Windows\system32\gpscript.exe

gpscript.exe /RefreshSystemParam

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "gBgyJsKDt"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "XKQENCkpUFIDpLLmU" /SC once /ST 03:11:54 /RU "SYSTEM" /TR "\"C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe\" sw /RPMfdidEj 385107 /S" /V1 /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "XKQENCkpUFIDpLLmU"

C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe

C:\Windows\Temp\BQNzqhxBfHqWtlDw\WMtLPDMwewkdcpE\ZFEETlD.exe sw /RPMfdidEj 385107 /S

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 588 -ip 588

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 588 -s 1072

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\SysWOW64\cmd.exe

/C powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell start-process -WindowStyle Hidden gpupdate.exe /force

C:\Windows\SysWOW64\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "bEiqjeuJfUHunPLypv"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"

C:\Windows\SysWOW64\cmd.exe

/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\XzdfbzSXU\HymxZw.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "tabOZhFmbQZymAa" /V1 /F

C:\Windows\SysWOW64\Wbem\WMIC.exe

"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "tabOZhFmbQZymAa2" /F /xml "C:\Program Files (x86)\XzdfbzSXU\YzSFFKT.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /END /TN "tabOZhFmbQZymAa"

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "tabOZhFmbQZymAa"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "SRfKrRwEqnYAel" /F /xml "C:\Program Files (x86)\wSZJZbJpuTjU2\eisTiTI.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "WSQcaCQWFMkky2" /F /xml "C:\ProgramData\PUTDAnRtyjWVGhVB\kVAdkOY.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "zokZtMKIpqszWbaxV2" /F /xml "C:\Program Files (x86)\paIbpfUydXCFOQSEXSR\cuFHQcN.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "PQSZsILzVeTTvIYycWH2" /F /xml "C:\Program Files (x86)\rpffIYXEsifWC\wudRSmc.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "pbtPycclcJoyVPHqg" /SC once /ST 02:06:35 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\BQNzqhxBfHqWtlDw\ptOdIzkz\CJRxwdd.dll\",#1 /yeIEdidqCEt 385107" /V1 /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "pbtPycclcJoyVPHqg"

C:\Windows\system32\rundll32.EXE

C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\BQNzqhxBfHqWtlDw\ptOdIzkz\CJRxwdd.dll",#1 /yeIEdidqCEt 385107

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\BQNzqhxBfHqWtlDw\ptOdIzkz\CJRxwdd.dll",#1 /yeIEdidqCEt 385107

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "XKQENCkpUFIDpLLmU"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3120 -ip 3120

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 1000

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5828 -ip 5828

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5828 -s 2288

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "pbtPycclcJoyVPHqg"

Network

Country Destination Domain Proto
RU 185.215.113.16:80 185.215.113.16 tcp
RU 185.215.113.117:80 185.215.113.117 tcp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 117.113.215.185.in-addr.arpa udp
DE 95.179.250.45:26212 tcp
RU 185.215.113.26:80 185.215.113.26 tcp
FI 65.21.18.51:45580 tcp
RU 185.215.113.26:80 185.215.113.26 tcp
US 154.216.17.216:80 154.216.17.216 tcp
RU 185.215.113.17:80 185.215.113.17 tcp
FI 95.216.107.53:12311 tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
DE 95.179.250.45:26212 tcp
TM 91.202.233.158:80 91.202.233.158 tcp
DE 95.179.250.45:26212 tcp
CZ 188.124.59.28:443 tcp
RU 80.249.144.180:80 fivev5sb.top tcp
RU 185.215.113.67:15206 tcp
RU 195.133.13.230:80 sevtv17pn.top tcp
RU 80.249.144.180:80 fivev5sb.top tcp
DE 95.179.250.45:26212 tcp
RU 80.249.144.180:80 fivev5sb.top tcp
NL 45.156.25.118:443 tcp
DE 95.179.250.45:26212 tcp
CZ 188.124.59.28:443 tcp
DE 95.179.250.45:26212 tcp
FI 81.19.139.138:443 conditionprovice.pro tcp
RU 185.215.113.19:80 185.215.113.19 tcp
RU 185.215.113.19:80 185.215.113.19 tcp
DE 95.179.250.45:26212 tcp
RU 185.215.113.16:80 185.215.113.16 tcp
CZ 188.124.59.28:443 tcp
US 104.20.4.235:443 pastebin.com tcp
RU 185.215.113.26:80 185.215.113.26 tcp
FI 65.21.18.51:45580 tcp
RU 37.140.192.11:443 softonic-pc.ru tcp
DE 95.179.250.45:26212 tcp
FI 95.216.107.53:12311 tcp
CH 179.43.188.227:80 240902175059845.std.kqve01.top tcp
NL 45.200.149.147:80 45.200.149.147 tcp
RU 37.140.192.11:443 softonic-pc.ru tcp
RU 194.58.114.223:80 194.58.114.223 tcp
US 162.159.130.233:443 cdn.discordapp.com tcp
DE 95.179.250.45:26212 tcp
US 103.130.147.211:80 103.130.147.211 tcp
GB 2.22.99.85:443 steamcommunity.com tcp
DE 95.179.250.45:26212 tcp
US 104.21.39.10:443 tenntysjuxmz.shop tcp
FR 176.150.119.15:56001 tcp
DE 95.179.250.45:26212 tcp
NL 45.66.231.48:80 tcp
DE 95.179.250.45:26212 tcp
RU 195.133.13.230:80 sevtv17pn.top tcp
US 172.67.162.113:443 femininedspzmhu.shop tcp
DE 95.179.250.45:26212 tcp
FR 176.150.119.15:56002 tcp
GB 2.22.99.85:443 steamcommunity.com tcp
FI 81.19.139.138:443 conditionprovice.pro tcp
US 104.21.39.10:443 tenntysjuxmz.shop tcp
NL 45.200.149.147:27667 tcp
DE 95.179.250.45:26212 tcp
DE 95.179.250.45:26212 tcp
FR 176.150.119.15:56003 tcp
DE 95.179.250.45:26212 tcp
CZ 188.124.59.28:443 tcp
DE 95.179.250.45:26212 tcp
N/A 224.0.0.251:5353 udp
DE 95.179.250.45:26212 tcp
NL 45.156.25.118:443 tcp
DE 95.179.250.45:26212 tcp
US 54.210.117.250:443 service-domain.xyz tcp
GB 92.123.143.219:80 r11.o.lencr.org tcp
US 8.8.8.8:53 168.245.100.95.in-addr.arpa udp
US 8.8.8.8:53 219.143.123.92.in-addr.arpa udp
FR 176.150.119.15:56001 tcp
GB 142.250.179.227:80 o.pki.goog tcp
GB 142.250.179.227:80 o.pki.goog tcp
GB 142.250.179.227:80 o.pki.goog tcp
GB 216.58.204.78:443 clients2.google.com tcp
GB 142.250.200.1:443 clients2.googleusercontent.com tcp
CZ 188.124.59.28:443 tcp
GB 216.58.204.78:443 clients2.google.com tcp
DE 95.179.250.45:26212 tcp
US 44.236.110.137:80 api.check-data.xyz tcp

Files

memory/2432-0-0x0000000000020000-0x00000000004D1000-memory.dmp

memory/2432-1-0x0000000077C76000-0x0000000077C78000-memory.dmp

memory/2432-2-0x0000000000021000-0x000000000004F000-memory.dmp

memory/2432-3-0x0000000000020000-0x00000000004D1000-memory.dmp

memory/2432-5-0x0000000000020000-0x00000000004D1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

MD5 b4a5d241373c621a7a0d9ba5fac59fb5
SHA1 2f8e03a99f3a1bbcdc7841ae032e07af8b2fb7ac
SHA256 ca9ccf76ae648c07d97e9b02bbf14d5fb4e69a4514a1b7a7ab18af0f465d15e8
SHA512 d20d0d0c7ccfbc85a7d6cd7b0303536f3c6facd46fecacd14c87e1f7ab8aeda3d2bfe8dba395f60cf005608f81a928915991407dd4c497f9d08c3aa40b59ec39

memory/2876-17-0x0000000000FF0000-0x00000000014A1000-memory.dmp

memory/2432-16-0x0000000000020000-0x00000000004D1000-memory.dmp

memory/2876-19-0x0000000000FF1000-0x000000000101F000-memory.dmp

memory/2876-20-0x0000000000FF0000-0x00000000014A1000-memory.dmp

memory/2876-21-0x0000000000FF0000-0x00000000014A1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

MD5 2d647cf43622ed10b6d733bb5f048fc3
SHA1 6b9c5f77a9ef064a23e5018178f982570cbc64c6
SHA256 41426dd54fcabbf30a68b2aa11aa4f61f3862bea83109d3e3c50cfebed1359e6
SHA512 62400f1e9646268f0326aab5b95efacb0303f4c5879cccf0cbb24d1f66d0db40d0fdfebb09ba785b5dfd54df2d32e8aab48c1f5f333956b606112de68635ac3a

memory/2564-42-0x000000007363E000-0x000000007363F000-memory.dmp

memory/2564-43-0x0000000000490000-0x00000000004E4000-memory.dmp

memory/2364-45-0x0000000000400000-0x0000000000452000-memory.dmp

memory/2364-47-0x0000000005920000-0x0000000005EC6000-memory.dmp

memory/2364-48-0x0000000005370000-0x0000000005402000-memory.dmp

memory/2364-49-0x0000000005320000-0x000000000532A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TmpC9F7.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

memory/2364-64-0x00000000060D0000-0x0000000006146000-memory.dmp

memory/2364-65-0x0000000006750000-0x000000000676E000-memory.dmp

memory/2364-68-0x00000000070E0000-0x00000000076F8000-memory.dmp

memory/2364-69-0x00000000088A0000-0x00000000089AA000-memory.dmp

memory/2364-70-0x0000000007010000-0x0000000007022000-memory.dmp

memory/2364-71-0x0000000007070000-0x00000000070AC000-memory.dmp

memory/2364-72-0x00000000089B0000-0x00000000089FC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

MD5 8e74497aff3b9d2ddb7e7f819dfc69ba
SHA1 1d18154c206083ead2d30995ce2847cbeb6cdbc1
SHA256 d8e81d9e336ef37a37cae212e72b6f4ef915db4b0f2a8df73eb584bd25f21e66
SHA512 9aacc5c130290a72f1087daa9e79984565ccab6dbcad5114bfed0919812b9ba5f8dee9c37d230eeca4df3cca47ba0b355fbf49353e53f10f0ebc266e93f49f97

memory/1420-91-0x0000000000900000-0x0000000000A12000-memory.dmp

memory/3884-93-0x0000000000400000-0x000000000050D000-memory.dmp

memory/3884-98-0x0000000000400000-0x000000000050D000-memory.dmp

memory/3884-97-0x0000000000400000-0x000000000050D000-memory.dmp

memory/3884-96-0x0000000000400000-0x000000000050D000-memory.dmp

C:\Users\Admin\AppData\Roaming\UCBkLFNPpU.exe

MD5 88367533c12315805c059e688e7cdfe9
SHA1 64a107adcbac381c10bd9c5271c2087b7aa369ec
SHA256 c6fc5c06ad442526a787989bae6ce0d32a2b15a12a41f78baca336b6560997a9
SHA512 7a8c3d767d19395ce9ffef964b0347a148e517982afcf2fc5e45b4c524fd44ec20857f6be722f57ff57722b952ef7b88f6249339551949b9e89cf60260f0a714

C:\Users\Admin\AppData\Roaming\3emywNfx5k.exe

MD5 30f46f4476cdc27691c7fdad1c255037
SHA1 b53415af5d01f8500881c06867a49a5825172e36
SHA256 3a8f5f6951dad3ba415b23b35422d3c93f865146da3ccf7849b75806e0b67ce0
SHA512 271aadb524e94ed1019656868a133c9e490cc6f8e4608c8a41c29eff7c12de972895a01f171e8f625d07994ff3b723bb308d362266f96cb20dff82689454c78f

memory/3884-118-0x0000000000400000-0x000000000050D000-memory.dmp

memory/3060-121-0x00000000007A0000-0x00000000007F2000-memory.dmp

memory/4828-123-0x0000000000240000-0x00000000002CE000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3007475212-2160282277-2943627620-1000\76b53b3ec448f7ccdda2063b15d2bfc3_4880fff3-ce96-47a8-956d-b60b04225313

MD5 e72b3d100fa0ef0125dc011edcfc9ec9
SHA1 ca8aa648b5143eb87c84d4b71f46eafe42743513
SHA256 2a70cb6efc5f4270501519712d34446f42d0ae329d828306b035dee441ac47f3
SHA512 16c30888003285620eba314ad10cde0ec47f60399da69606c3f52e3bd56bb1279deb4e872f6b4fb17b780468159f6a3e0b6ae6b2fef614013c5605844ddf775a

C:\Users\Admin\Desktop\Microsoft Edge.lnk

MD5 25abbde25c5376fe04a390355d93523c
SHA1 94000b8e8f54ba2c126235378b37c2eb39810987
SHA256 a0993aafe53d1073a2d77fb8b87be0e4f81c604d79c9149763f885c523f79847
SHA512 51633ae16c3e288b7851ccdd3c8c0746b70e0cf53fdcfa5a34d5ec2f7e8ae6f49ca371903bdd111562f3336d70e4c1477094d846cb6d5cc9c35d3b713d8cfa74

C:\Users\Public\Desktop\Google Chrome.lnk

MD5 1ad89ebd7cc325dfc6e3c2e976825414
SHA1 9efe251545b1dee9682d74ea7e21f7c4f08a3e50
SHA256 600a7eaae57f100ecd7236ba10feba3f221686a0bdc41d13b083d3470c3fb248
SHA512 267858eca97f5a43cc3f69eadfff3b1744ef24b49f1b877d024fce8a2f3af38395226e10480ff460d6464d5c9dfa02e552401cde15ac1884329160f035a98999

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

MD5 f5d7b79ee6b6da6b50e536030bcc3b59
SHA1 751b555a8eede96d55395290f60adc43b28ba5e2
SHA256 2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
SHA512 532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

MD5 7a02aa17200aeac25a375f290a4b4c95
SHA1 7cc94ca64268a9a9451fb6b682be42374afc22fd
SHA256 836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
SHA512 f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

memory/2876-184-0x0000000000FF0000-0x00000000014A1000-memory.dmp

memory/4664-185-0x0000000000B50000-0x0000000000D93000-memory.dmp

memory/2876-188-0x0000000000FF0000-0x00000000014A1000-memory.dmp

memory/4828-189-0x0000000008660000-0x00000000086C6000-memory.dmp

memory/4664-190-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/4828-206-0x00000000096F0000-0x00000000098B2000-memory.dmp

memory/4828-214-0x0000000009DF0000-0x000000000A31C000-memory.dmp

memory/2876-233-0x0000000000FF0000-0x00000000014A1000-memory.dmp

memory/2876-232-0x0000000000FF0000-0x00000000014A1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe

MD5 45b55d1e5d2bf60cc572f541ae6fa7d1
SHA1 2329f56147a299bcdbf20520e626cc8253e49a8d
SHA256 039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8
SHA512 5483964e050b2be073d3cf966b6dd6271556d4adfb420fb9ecf81f42f27cd06727016292dceb9a282f9fdcb451507309d1a78f58dd5d84e3022c0ea20c58dbe2

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

MD5 7e6a519688246fe1180f35fe0d25d370
SHA1 8e8719ac897dfef7305311dc216f570af40709af
SHA256 32a927e9b33371b82bae9f02b5ebf07c19ae5a3a7e3c0cd3fcbee7cfff7f257a
SHA512 a751e911eb254749a3c8c98740f455a5be32ce1af94dc90eba8fc677d6d7379303f80247748dfcfe9c8570edb3488a5af97fa7ff29c815bec6824dd491e27972

C:\Users\Admin\AppData\Local\Temp\1000029001\joffer2.exe

MD5 651269f574a059288d0e78b28438a430
SHA1 a22a0fb4669672d2f602d12d2f7a09d91ed6accb
SHA256 feb98395aab41886938dc9f25716097f13792a09af42e22214d862002d82886d
SHA512 d53bc56518f034000c63cc8b692fa55e4902c140bb0b0fc17e693b7a615388d49cd61c5eebd54c024c6708bf7ba345fadfd269c1eb1b3543474a078308b854d7

memory/4664-311-0x0000000000B50000-0x0000000000D93000-memory.dmp

memory/3060-312-0x0000000008870000-0x00000000088C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

MD5 b826dd92d78ea2526e465a34324ebeea
SHA1 bf8a0093acfd2eb93c102e1a5745fb080575372e
SHA256 7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
SHA512 1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

memory/3772-319-0x0000000000400000-0x0000000000643000-memory.dmp

memory/4972-320-0x0000000000400000-0x000000000079D000-memory.dmp

memory/3772-315-0x0000000000400000-0x0000000000643000-memory.dmp

memory/3772-318-0x0000000000400000-0x0000000000643000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

MD5 0faa6e1a78e6bb809eb5a7cdcdf68e17
SHA1 f1ba39e702710365c345ab034bcd1a6d5ec8d4ad
SHA256 9d6966889f6ec503ae2bd99c666b55429d1835e538e1ac15f06c3524241c0c92
SHA512 261cd43b42ccbe7b6b393d454270dd22110c062632707f73bf045f91aee0f09b4387cac8ba7a9275b1ddaa427240606f654f74224fe6fcd38c8ae40b3c4f8ee7

memory/872-336-0x00000000029B0000-0x0000000002ED5000-memory.dmp

memory/872-337-0x0000000063280000-0x00000000634BE000-memory.dmp

memory/872-338-0x000000006E600000-0x000000006E69D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe

MD5 30daa686c1f31cc4833bd3d7283d8cdc
SHA1 70f74571fafe1b359cfe9ce739c3752e35d16cf5
SHA256 504518e3b4f3abc7f1ae1bf205fdc4a9f739e05b5e84618bae9c7e66bdc19822
SHA512 9f6c0eea9f03f9aa35ebf27ce8264e41d9072d273d1b8a35415ae4666d31013d895d1108dd67e36910200e2ac4fc45a4a9d761a1aadf02b0fd29ef93cd20a4d9

memory/872-348-0x00000000029B0000-0x0000000002ED5000-memory.dmp

memory/872-350-0x00000000029B0000-0x0000000002ED5000-memory.dmp

memory/872-352-0x00000000029B0000-0x0000000002ED5000-memory.dmp

memory/872-351-0x00000000029B0000-0x0000000002ED5000-memory.dmp

memory/872-349-0x00000000029B0000-0x0000000002ED5000-memory.dmp

memory/872-347-0x00000000029B0000-0x0000000002ED5000-memory.dmp

memory/3260-363-0x0000000000CB0000-0x0000000000D02000-memory.dmp

memory/2876-383-0x0000000000FF0000-0x00000000014A1000-memory.dmp

memory/4672-384-0x0000000000400000-0x0000000001069000-memory.dmp

memory/3528-385-0x0000000000400000-0x000000000106A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe

MD5 37d198ad751d31a71acc9cb28ed0c64e
SHA1 8eb519b7a6df66d84c566605da9a0946717a921d
SHA256 1ed4a8b4c74aab435ea5cd459d5ac961e5a8ca28924801bd84d336135f30efde
SHA512 60923c0a8ce5fd397d49749ccee68ca3fe294d7323551ce9755410ac16bfff56a35bee3e6b9a67d57cdfcb43e4f164712f33cd255b76689174dcf4c475976c96

memory/3192-407-0x0000000000AC0000-0x0000000000B38000-memory.dmp

memory/3772-408-0x0000000000400000-0x0000000000643000-memory.dmp

memory/872-409-0x0000000000400000-0x0000000000799000-memory.dmp

memory/872-410-0x00000000029B0000-0x0000000002ED5000-memory.dmp

memory/2876-412-0x0000000000FF0000-0x00000000014A1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\service123.exe

MD5 32b081279389cc8eede564ba26311783
SHA1 d005d7963188546ea21f7556a8bd5a1a66974e82
SHA256 bb289b68fe8799e07fa3572dfae65a3fc4538438a3e67de3d22fe415b021f327
SHA512 dac75ee300b4b7d7d480fe5564d1945a5fc8884e5df4c3656b90d9948b39efeb339f273f29eaf24a607d02dae22030c941daa9d336fadc76900805b048b9a1bb

memory/4672-414-0x0000000000400000-0x0000000001069000-memory.dmp

memory/3192-415-0x0000000005980000-0x000000000599A000-memory.dmp

memory/3528-416-0x0000000000400000-0x000000000106A000-memory.dmp

C:\ProgramData\DHCAECGI

MD5 b8d37de9e393e5bad1f71f1a2221da6f
SHA1 9ad2f3acb69c0f245ffe99d9a56398f6ccf986ca
SHA256 1f1cfe66b5885ba23077aa974c61278ec3807c17500a28fe8d084deac75e80c5
SHA512 05f392ce6beba2f55e7df9261ce6f9938aaeffcb2b606346002da4b6f78af33c092e8f0024b9aa69fe5b816dbba5d00f9ac0073dc0a7656ee6315fa9e21f025e

C:\ProgramData\JEHIIDGC

MD5 87210e9e528a4ddb09c6b671937c79c6
SHA1 3c75314714619f5b55e25769e0985d497f0062f2
SHA256 eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1
SHA512 f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

C:\ProgramData\freebl3.dll

MD5 c8137aed8c92dccdb9b24462831bfdbf
SHA1 80b3c17aad575db77c6affc53bb1d73b267e470b
SHA256 55bbe2d98c2ed8a1a269ff7012402cfb0831484710b459457454c734d5279489
SHA512 36690911017cf2297ab992bc1cdb32ffd84354eae808b59162e2a83d9371bfb0772e135554c60b4d527eb114550c4ce7889f64f88817d7c0269d169823c6058c

memory/3772-451-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2876-456-0x0000000000FF0000-0x00000000014A1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe

MD5 03b1ed4c105e5f473357dad1df17cf98
SHA1 faf5046ff19eafd3a59dcf85be30496f90b5b6b1
SHA256 6be5916900ffda93154db8c2c5dd28b9150f4c3aef74dbd4fd86390bc72845ba
SHA512 3f6f8a12d000b913dc8240542be6a64f991dc0802313782d038b971219308e7d381d4d96c25d98ee1b05bca127a9bbc69e3bd54f1722d8381f8060bb506a9765

C:\ProgramData\mozglue.dll

MD5 f9b7f2d733b3f13de1fcd73668b0d2b6
SHA1 0f1d0c90f22c3bfd4ce21383c1416876b5bb8848
SHA256 83f0860892332266f22cf019c1c12334e0e38134f9f169b7fe6fd16f829965ea
SHA512 3bc8c9d27c6a320b4a1ff51e2e45571e40112e01e0e0bac7f4aa184ad878740e3445d99d27b3bee919a504578d0ac453e0201bbfe2e763c73291feb326ff712a

memory/4668-480-0x000001CFDC3A0000-0x000001CFDC4CA000-memory.dmp

memory/4668-479-0x000001CFC1C00000-0x000001CFC1D60000-memory.dmp

memory/4668-483-0x000001CFDC4D0000-0x000001CFDC5F5000-memory.dmp

memory/4668-485-0x000001CFDC4D0000-0x000001CFDC5F5000-memory.dmp

memory/4668-482-0x000001CFDC4D0000-0x000001CFDC5F5000-memory.dmp

memory/4668-481-0x000001CFDC4D0000-0x000001CFDC5FC000-memory.dmp

memory/4668-1563-0x000001CFC3B10000-0x000001CFC3B5C000-memory.dmp

memory/4668-1562-0x000001CFDC600000-0x000001CFDC6A4000-memory.dmp

C:\ProgramData\msvcp140.dll

MD5 ce0346af6335f61bc91a1fa78613eda4
SHA1 d2b91890a78876bba508173d2716e99d8655eecc
SHA256 3684fcd163fad9db0c46e46f6ec87a1825fa5c8d4db463fa7a4d9fe1c4224d3d
SHA512 8375bcd8a16ff099da5137505f91125e8b5ad348ccaa4d667549b2507cf491647b8debbf6ec54e6e4dfd3d0fd05c8511c3d7f675df0c10c71d2b0ee8c8111438

C:\ProgramData\nss3.dll

MD5 4c63a8a6c7c07e0f2eca4f00f042d094
SHA1 c915965b4e25e8bc9d941a714fc98fae12e34beb
SHA256 13a3f09d20e529304842cad15ac8d2c38d6d5ef6386ae1535f240be2a3cca449
SHA512 a49dedab6bbd2f7b3ce58ffc99dc503997f5b38a27c45808959cacb138575c8cef4612632b811b0a19421d2de832c6fba6890a22269fb1412943940e4b69a8f5

C:\Users\Admin\AppData\Local\Temp\007475212216

MD5 f449d56174097356fd6c9d659da7a769
SHA1 193828f90b29e73431875426e6c981512159c987
SHA256 d6a4b8e138d979f5d8fcedd1653603d2939c3d5717b7be2fd64df0cdbf54ba78
SHA512 756a61582cca62b1d30b8d12a59c9ba92791e94b17033ebaa0fb0f75b9eeb50c131e5911131132660103b6e57550b703f07c8f42cd2272b01a2988990ed1812a

C:\Users\Admin\AppData\Local\Temp\1000169001\contorax.exe

MD5 771b8e84ba4f0215298d9dadfe5a10bf
SHA1 0f5e4c440cd2e7b7d97723424ba9c56339036151
SHA256 3f074fb6a883663f2937fd9435fc90f8d31ceabe496627d40b3813dbcc472ed0
SHA512 2814ef23653c9be5f5e7245af291cf330c355ed12b4db76f71b4de699c67a9ffd1bdc0cc1df5352335b57ab920404b9c8e81cd9257527264bde4f72a53700164

C:\ProgramData\softokn3.dll

MD5 4e52d739c324db8225bd9ab2695f262f
SHA1 71c3da43dc5a0d2a1941e874a6d015a071783889
SHA256 74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
SHA512 2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

memory/2816-1612-0x00000000005D0000-0x00000000005F0000-memory.dmp

memory/2816-1613-0x0000000000E90000-0x0000000000E96000-memory.dmp

C:\ProgramData\vcruntime140.dll

MD5 a37ee36b536409056a86f50e67777dd7
SHA1 1cafa159292aa736fc595fc04e16325b27cd6750
SHA256 8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA512 3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

C:\ProgramData\KEGCFCAKFHCGCBFHCGHD

MD5 e737fb045ddd54701af8ed9329bb3918
SHA1 8d340dd98ecfbeed130aa3c25c572ecab9013a28
SHA256 487f0a2c4a3bae7ccc324614f3ac64ce3c213e827d0fcfbfd84185e243cbfd23
SHA512 64cb543bd0bd5ab4a859c61a333de6fee92535ba786610fdde55a3ae76abe75f92de14477464dc34b231e9e67a04ed343c135e5cb1fe3101b86e0510b2507603

C:\Users\Admin\AppData\Local\Temp\1000172001\3546345.exe

MD5 fd2defc436fc7960d6501a01c91d893e
SHA1 5faa092857c3c892eab49e7c0e5ac12d50bce506
SHA256 ba13da01c41fa50ec5e340061973bc912b1f41cd1f96a7cae5d40afc00ff7945
SHA512 9a3e1f2dc5104d8636dc27af4c0f46bdb153fcfada98831b5af95eeb09bb7ef3c7e19927d8f06884a6837e10889380645b6138644f0c08b9cb2e59453041ec42

memory/5316-1664-0x0000000000FF0000-0x00000000014A1000-memory.dmp

memory/3772-1666-0x0000000000400000-0x0000000000643000-memory.dmp

memory/5316-1677-0x0000000000FF0000-0x00000000014A1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\crypteda.exe.log

MD5 84cfdb4b995b1dbf543b26b86c863adc
SHA1 d2f47764908bf30036cf8248b9ff5541e2711fa2
SHA256 d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b
SHA512 485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce

memory/3608-1777-0x0000000000C90000-0x0000000001141000-memory.dmp

memory/3608-1779-0x0000000000C90000-0x0000000001141000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000226001\fikbbm0902845.exe

MD5 c965aa525ae4cfbc3b45c6b7e9271a59
SHA1 3a84d4c1c9277173b530263107af4caf1f61213f
SHA256 50ea6c698e72e13b8132b66bbca9479b7f4815ebb2f8adb3ca1cfec79523107e
SHA512 bfddf9f5cb766b20f564b6a94048d1779431794b02cbd0993f4f3554b46b1a4e17bd3def58200da665fd991d1480b22992181ef543413d8013a19889484c3f1c

C:\Users\Admin\AppData\Local\Temp\filename.exe

MD5 36a627b26fae167e6009b4950ff15805
SHA1 f3cb255ab3a524ee05c8bab7b4c01c202906b801
SHA256 a2389de50f83a11d6fe99639fc5c644f6d4dcea6834ecbf90a4ead3d5f36274a
SHA512 2133aba3e2a41475b2694c23a9532c238abab0cbae7771de83f9d14a8b2c0905d44b1ba0b1f7aae501052f4eba0b6c74018d66c3cbc8e8e3443158438a621094

C:\Users\Admin\AppData\Local\Temp\1000256001\BowExpert.exe

MD5 db2a12edc73769f2f2b6b01545afe2c3
SHA1 73dc44fb0753296f51b851299f468031ceb77b54
SHA256 e6db7d34b498982601b2c45ac5b2a1c1b9502e502514ccffae9862f2aa719f42
SHA512 dadf36bc9c5d88c28b9064892cc263c912ce668435b71802df756c0a4e680f8407011d36498a2511dda7165aea866c0ae794f9ec8fbcc42c7da1661399316ce4

C:\Users\Admin\AppData\Local\Temp\filen8ame.exe

MD5 0885bc5d9c2aa1895ebd5fcad13b53be
SHA1 ad559563e4e21cb7354a4692b31852839b0b22d7
SHA256 b7763f18a43e9727036d685576fe102901f45fd1b9407395bbc10966a9811d25
SHA512 91c73e9a3a74624dad400c0c5b7670b977946a06344782ca859be70578e64c2f0d4fdb3eadb70821168c64929a8bfe16a18fb10ba65bcd80e14701ef8c05091f

C:\Users\Admin\AppData\Local\Temp\1000262001\385107.exe

MD5 8476b436d654b00484f7f47eba6d8d43
SHA1 c189b06cdb17df5267fbc827d4b1f870865c9f02
SHA256 299261f2394d208c7012a522e016c17887c4a567951fffec0b390b2e993220b2
SHA512 266b6af81c0be51c1d30791310aaa61305efcf7c9e23913c8cdbdc4f6131f45606c24280e47b9ac30990d2b0704b770d644baaacb37aee3eeef10889d699de02

memory/3120-1891-0x0000000000D40000-0x00000000013F3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000268001\kitty.exe

MD5 0ec1f7cc17b6402cd2df150e0e5e92ca
SHA1 8405b9bf28accb6f1907fbe28d2536da4fba9fc9
SHA256 4c5ca5701285337a96298ebf994f8ba013d290c63afa65b5c2b05771fbbb9ed4
SHA512 7caa2416bc7878493b62a184ddc844d201a9ab5282abfa77a616316af39ff65309e37bb566b3e29d9e764e08f4eda43a06464acaf9962f911b33e6dbc60c1861

C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif

MD5 18ce19b57f43ce0a5af149c96aecc685
SHA1 1bd5ca29fc35fc8ac346f23b155337c5b28bbc36
SHA256 d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd
SHA512 a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558

memory/4044-1911-0x0000000004EC0000-0x0000000004EF6000-memory.dmp

memory/4044-1913-0x0000000005530000-0x0000000005B5A000-memory.dmp

memory/4044-1914-0x0000000005CD0000-0x0000000005CF2000-memory.dmp

memory/4044-1915-0x0000000005D70000-0x0000000005DD6000-memory.dmp

memory/4044-1922-0x0000000005E50000-0x00000000061A7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dqsm15cb.gs3.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4044-1927-0x0000000006340000-0x000000000635E000-memory.dmp

memory/4044-1928-0x00000000068E0000-0x0000000006976000-memory.dmp

memory/4044-1930-0x00000000068A0000-0x00000000068C2000-memory.dmp

memory/4044-1929-0x0000000006850000-0x000000000686A000-memory.dmp

memory/4668-1933-0x000001CFDC6B0000-0x000001CFDC704000-memory.dmp

memory/5948-1937-0x0000026CB4B60000-0x0000026CB4C1C000-memory.dmp

memory/5940-1943-0x0000025D70C80000-0x0000025D70CA2000-memory.dmp

memory/5396-1959-0x0000000005890000-0x0000000005BE7000-memory.dmp

memory/3120-1971-0x0000000000D40000-0x00000000013F3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000296001\Channel3.exe

MD5 3b9d26d2e7433749f2c32edb13a2b0a2
SHA1 969437df8f4ad08542ce8fc9831fc49a7765b7c5
SHA256 ae7bc6b6f6ecb206a7b957e4bb86e0d11845c5b2d9f7a00a482bef63b567ce4c
SHA512 51b95e19087d44f5dc4f8f3fb2cb1151f0b4dee7069bd1bfecdbe1db7326f9b44733a0eccf513ec9763d613f183ba7dc1184ce2f448591aa2e4234f823b1885e

C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe

MD5 1b2583d84dca4708d7a0309cf1087a89
SHA1 cae0d1e16db95b9269b96c06caa66fa3dab99f48
SHA256 e0d9f3b8d36e9b4a44bc093b47ba3ba80cabd7e08b3f1a64dec7e3a2c5421bac
SHA512 a51b8ed6a6cf403b4b19fc7e9f22d5f60265b16cdf24a7033bc0ee0da8c31861caa212dc5fb3bf17e28842fc28a263564076ad4e9905afd483763859bafd4493

memory/5688-2026-0x0000000000070000-0x00000000000FC000-memory.dmp

memory/5688-2028-0x000000001DDC0000-0x000000001DECA000-memory.dmp

memory/5688-2029-0x000000001B950000-0x000000001B962000-memory.dmp

memory/5688-2030-0x000000001C710000-0x000000001C74C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000308001\freedom.exe

MD5 d6b80519cb7c625d200d2899c345c8c6
SHA1 5bdc488ee5c3139260fad6957fedfd9167427011
SHA256 9b31ce85872a2d41ea6e3181066790e56d4fb29d593ba9a156e12133490799ca
SHA512 12376e5d59cb61bc4de1678e08dd8a452d837eb2dd1102cfca718f12614d858b97c72fbedf2f5f978a26152251a58b07347cbb42fd8ade4b533f5192bcc74e6b

memory/5688-2046-0x000000001E2D0000-0x000000001E346000-memory.dmp

memory/5688-2048-0x000000001B9B0000-0x000000001B9CE000-memory.dmp

memory/5688-2051-0x000000001E820000-0x000000001E9E2000-memory.dmp

memory/5688-2052-0x000000001EF20000-0x000000001F448000-memory.dmp

memory/4292-2075-0x00000000009B0000-0x0000000000A3C000-memory.dmp

memory/5368-2085-0x0000000000FF0000-0x00000000014A1000-memory.dmp

memory/5368-2088-0x0000000000FF0000-0x00000000014A1000-memory.dmp

memory/5840-2097-0x0000000005020000-0x0000000005377000-memory.dmp

memory/588-2137-0x0000000000D40000-0x00000000013F3000-memory.dmp

memory/5828-2154-0x00000000001D0000-0x0000000000883000-memory.dmp

C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

MD5 5da730b2f6b92211ebcf0cd961319e95
SHA1 33e558931dad7573792d3f307c9974223d2a4484
SHA256 26ef47fa779cce835ec9ecc95a9a21689253ae93e8172f0be3733f4fa6476966
SHA512 c49ec14b494a1c11912d422da0f1289910e3dd501853760fc85a615f36a908a87cb00bd4f4f95c54baf504930cac7a0545c0597912818c641c8478dc44a604b1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

MD5 238d2612f510ea51d0d3eaa09e7136b1
SHA1 0953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256 801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA512 2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

MD5 0b1cf3deab325f8987f2ee31c6afc8ea
SHA1 6a51537cef82143d3d768759b21598542d683904
SHA256 0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA512 5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

MD5 2a1e12a4811892d95962998e184399d8
SHA1 55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA256 32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512 bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\es\messages.json

MD5 bd6b60b18aee6aaeb83b35c68fb48d88
SHA1 9b977a5fbf606d1104894e025e51ac28b56137c3
SHA256 b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55
SHA512 3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 ec4abeafe52b9c6ddefef61c818bd56a
SHA1 270f39096f0532c96d4fcc6a694d2bc99cc4366c
SHA256 11e89e9ff6a7aeada328c5e0be4f6686faa8ebddd9f1680a9770283f4fb20ce5
SHA512 78ea882d2cc9e718466b0cbb442874f8c70f37289c83560d7d4ffa0463b47b43f77111912a02bc3c574697b4e40ff27ad4c656adf2ef4ef30387f8d89ccfe376

memory/5828-2610-0x00000000001D0000-0x0000000000883000-memory.dmp